/wp-admin/install.php, the ML engine scores it 1.0, the shadow stage records the hit, and the source is banned at the kernel, all within the same second.
We build DAV NGWAF, a web application firewall that uses machine learning to judge every request. We also set up and run the Linux servers behind it on AWS, Google Cloud, Microsoft Azure and Oracle Cloud, or on your own bare-metal hardware. Use either one, or both together.
Astro Pema AI LLC, Ashland, Oregon. Linux systems administration since 2001.
Two services, one approach
Both come from the same place: years of running Linux servers on the open internet, and a firewall built to defend them.
DAV New Generation Web Application Firewall
A next-generation web application firewall
- A neural network written in Rust scores each HTTP request as it arrives
- Attacks are mapped to MITRE ATT&CK techniques, so you know what was tried
- Repeat offenders are dropped at the network layer, before they reach your web server again
- DAVSOC, our security operations dashboard, shows detections and reports
- Live SOC dashboard, on request See DAVSOC working on our own traffic with a guided, view-only login. Ask through the contact form.
Linux Systems Administration
Through Pema Hosting, on any major cloud or bare metal
- You open the cloud account in your name and keep full ownership
- We help you choose the right instance and Linux distribution on AWS, Google Cloud, Microsoft Azure or Oracle Cloud
- Bare-metal and on-premises Linux servers too
- We keep it patched, backed up and monitored
How DAV Next-Generation Web Application Firewall handles a request
Rule-based firewalls match known signatures. DAV NGWAF also looks at the shape of each request and at how a source behaves over time, so it can catch variations that no rule was written for.
Most requests aren't human
In January 2026, 49% of requests on Fastly's network came from bots, and bots made 60% of the requests that reached origin servers, the ones that cost CPU, memory and bandwidth.
Most bots aren't welcome
Imperva measured automated traffic at 53% of all web traffic in 2025, with bad bots alone at 40%. Fastly found 99% of bot traffic unwanted.
The request arrives
NGINX at the edge serves every site on the server, records the real client address, and writes one shared log that DAV reads.
Rules and the model judge it
Signature rules catch known attacks and probes for files the site doesn't have. A CNN-GRU neural network in the Rust engine scores what the rules can't name.
Behavior is weighed
One odd request may be a mistyped link; a pattern of probes is an attacker. Suspicious sources are tracked in a shadow stage before enforcement, and detections are classified with MITRE ATT&CK.
The source is blocked
Attacking addresses are dropped by the kernel, open connections included, so blocked traffic stops costing bandwidth, CPU and memory.
Runs on ordinary hardware
Inference runs on the CPU by default, on both x86 and Arm servers, including AWS Graviton. GPU acceleration is available for very high traffic.
Fits NGINX and Apache
DAV NGWAF ships with the edge configuration for NGINX, with Apache supported behind it, so it slots into the stack you already run.
Engine, dashboard and edge together
The Rust engine, the DAVSOC dashboard and the edge configuration are delivered as one product and tested together.
Your traffic stays on your server
Inspection happens on your own machine. Requests are not sent to an outside cloud service to be judged.
Sources: Fastly Threat Insights Report 26Q1 (January 2026 data); Imperva Bad Bot Report 2026 (2025 data). Each measures its own network, so the totals differ.
Licensing
DAV NGWAF will be available to customers in spring 2027, under two licensing models.
| License | What you get | Good for |
|---|---|---|
| Business | The compiled DAV NGWAF product, built and tested for your server, with a yearly license per detection engine. One engine protects every site in its log. Each renewal delivers the latest release; critical security fixes are included. | Small and mid-sized businesses and hosting providers protecting their own sites |
| Source and white label | Full source access, by agreement | Acquisition, or reselling DAV NGWAF under your own brand |
Until launch, DAV NGWAF protects our own production servers, where you can see it working in the live reports. To join early access or discuss a white-label agreement, contact us.
In production, not in a lab
We built DAV NGWAF from scratch: first as a Python prototype, then rewritten in Rust for speed and safety. It combines regular-expression rules with an original CNN-GRU neural network that we designed and trained on our own NVIDIA GPU, compiled directly into the engine. Since late 2025 it has protected our own servers every day, on bare metal and in the cloud, including the AWS server this page comes from.
- Protecting production domains on bare metal and in the cloud since late 2025
- Live WAF verification reports, updated hourly
- MITRE ATT&CK report, last 7 days, updated hourly
- Layered detection coverage report (PDF), updated daily
- Lab results: WAF responses and XDP vs nftables enforcement
- Technical overview: how DAV NGWAF works, detection, enforcement, security and lifecycle
- Dual-layer IDS paper (PDF)
- DAV NGWAF technical document (PDF)
About Astro Pema AI
Astro Pema AI LLC is an Ashland, Oregon USA company founded by Juan David Correa-Landreau, who has worked in Linux systems administration and consulted independently since 2001, the year he earned his Red Hat Certified Engineer (RHCE) certification. He holds a BS in Mathematics and Computer Science from the University of Puerto Rico at Mayagüez, a certificate in Data Science and Machine Learning from MIT IDSS, and a Deep Learning Professional Certificate from Carnegie Mellon University.
DAV NGWAF grew from a Python prototype into a Rust engine with network-layer enforcement and MITRE ATT&CK mapping. Its development has been documented publicly from the start but the code has never been published.