Bringing Zero-Trust security and automatic documentation to legacy, undocumented binary systems via WebAssembly (WASM) filters.
Original specifications are lost, and the original developers are gone. Systems run blindly on legacy knowledge.
Legacy protocols transmit sensitive data (PANs, API keys) in plaintext, lacking modern encryption and authentication.
Connecting mainframes to modern cloud services or secure AI models is impossible without complex, fragile middleware.
Rewriting the mainframe code from scratch is a multi-million dollar, high-risk venture.
API Time Machine acts as a non-invasive, active cyber-defense envelope. Instead of editing the mainframe's code, it listens to the network traffic, reverse-engineers the protocol structure automatically, and deploys a real-time WebAssembly (WASM) security filter onto the edge proxy.
The system reads network capture files (.pcap) asynchronously. Instead of bloating the SQL database with gigabytes of raw binary files, the backend streams raw payloads into a local storage folder (data/payloads/), saving only a lightweight string path. A transparent Python descriptor shims the database queries so the code remains 100% backward-compatible.
Packets are grouped by Jaccard similarity and structural attributes (direction, signatures, length buckets, and hex prefixes). The system maps transitions chronologically to build a cyclic Markov-chain transition graph.
Analyzes offsets to determine data types (ASCII, integers, timestamps) and generates a declarative Kaitai Struct YAML definition. This schema compiles into a Rust-based WebAssembly module designed for the Envoy Proxy, with resilient fallbacks if tools are missing locally.
meta:
id: legacy_banking
endian: be
seq:
- id: mti
type: u2
- id: bitmap
type: b64
- id: pan
type: strz
encoding: asciiThe proxy inspects incoming payloads. If it detects unencrypted PII (like Credit Card numbers) or anomalous structures, it drops the connection. Security incidents are written to a TelemetryLog database table, keeping audit logs persistent across system restarts.
The automated fuzzer restricts targets, blocking loops targeting loopback (127.0.0.1), private networks, or AWS Metadata (169.254.169.254).
Upload endpoints read data in chunked sizes (5MB for headers, 100MB for PCAP files) rather than dumping whole payloads into memory.
The token key endpoint is rate-limited (20/minute) using slowapi to mitigate credential stuffing.
GDPR erasure requests execute chunked deletions in batches of 1000 to prevent SQLite transaction locking while purging all metadata.