# Context-Aware AI Firewall

A stateful intrusion prevention system that reassembles TCP packet streams in order and uses deep-learning models to detect and block malware split across packets.

This firewall captures per-flow network traffic and buffers and reassembles it based on TCP sequence numbers, handling out-of-order packets, duplicates, overlaps and gaps, so it can see the full reconstructed payload rather than inspecting packets in isolation. It then extracts sequence features such as Shannon entropy, packet intervals, headers and payloads, and classifies the reconstructed stream with a PyTorch LSTM or Transformer model to detect malicious sessions.

Detected attacks trigger dynamic session termination and a temporary one-hour blacklist of the attacking IP at the firewall gateway. The project positions this against traditional packet filters, which inspect packets independently and are blind to payloads split across multiple harmless-looking packets, and stateful-inspection firewalls, which track connection state but are still described as easily bypassed by slow or irregular packet timing.

It is built with a FastAPI backend and a React frontend.

Website: https://github.com/Felix-au/Fragmented-Firewall