PHP based Intrusion Detection System

During the last few weeks a friend of mine and myself spent some time working on a PHP based Web application IDS, which essentially is designed to be an additional layer of protection for any website it is used on.

It's not officially published yet since we're still changing some parts but I'd like to hear other peoples opinion on this prior contributing it to PEAR, which is what we are intending to do in near future. You will find the project including a Subversion repository temporarily on http://code.google.com/p/phpids/

The detection system is pretty simple and based on a set of various upgradeable regular expressions that will be cross-checked against any variable passed to the systems main class, named IDS_Monitor. In addition we provide an easy extendable logging mechanism that allows storing detected results in files, sending them via email and things like that.

Here's an example of use:

<*?php

try {
$storage = new Filter_Storage();
$storage->getFilterFromXML('phpids/default_filter.xml');

$get = new IDS_Monitor($_GET, $storage);
$result = $get->run();

// display results
print_r($result);


//Or store the data using IDS_Log_Composite and
// Log_File
require_once('phpids/log/log_file.php');
require_once('phpids/log/log_composite.php');

$compositeLog = new IDS_Log_Composite();
$compositeLog->addLogger(
Log_File::getInstance('results.txt')
);

if (!empty($result)) {
$compositeLog->execute($result);
}

} catch (Exception $e) {
printf(
'An error occured: %s',
$e->getMessage()
);
}

?*>

Obviously the effectiveness of the IDS is dependent on the quality of patterns that are used, therefore the system is supplied with a bunch of default patterns, mainly written by .mario who is one of the versed people dealing with filtering I've ever met. Moreover to mention is Ronald (better known as Jungsonn), who also shared his thoughts and expertise. Thank you.

So I think very most XSS and SQL injection vectors (being trivial or advanced) should be covered.

Are there any comments or suggestions?