Viewing anomaly detection log

There are new attack logs for anomaly detection model violations. The anomaly detection log has the following sub-types:

• Anomaly in HTTP argument
• HTTP Method violation
• Charset detect failed

When machine learning detects an attack, the attack logs will be generated in Log & Report. Click an attack to view more information about that attack in the far-right panel.

Anomaly Detection Information (bar chart)

The illustration below shows the anomaly values of HMM probability and argument length for the argument in a bar chart. The green bar represents the average values of the learned samples for the argument; the yellow bar represents the anomaly values for the current argument. Comparing it with the average values, you can easily see how abnormal the argument is.

Attack Detection Information

The illustration shows the threat analysis results. Using this information, you can see what kind of attack the argument could include. Anomaly detection model may detect multiple attack types in one argument. There are three suspicious levels as shown in the pie chart.

The chart above reports two kinds of attack types: Cross-site Scripting and Local File Inclusion/Remote File Inclusion. The system treats the Cross Site Scripting attack as more suspicious.

Add additional samples from attack logs

If the attack reported by the model is wrongly detected as an anomaly and should be categorized to regular traffic, you can click This is not a threat!. The system will include this newly added sample into the sample set and rebuild the model, so that the traffic which has the similar characteristics with this sample will not be reported as attacks anymore.

This process may take one or two minutes, and FortiWeb will not detect machine-learning anomalies at this process.

The added samples will be displayed as Additional Samples in the Parameter View.

Adjust machine-learning model

You can adjust an anomaly detection model by clicking the Operation button. It has three options: Rebuild the Model, Relearn the Model, and Goto Argument Setting.

Button	Description
Rebuild the Model	Clear the preceding model, and then begin collecting new samples and build the models again. The samples collected for the previous model will be discarded.
Relearn the Model	Clear the preceding model, and then begin collecting more samples to build the model. The samples collected for the previous model will be not discarded. They will be reused to build the new model.
Goto Argument Setting	Clicking this button to display the dialog where you can adjust the argument related to anomaly detection.

Aggregate machine-learning log

There are also aggregation logs for anomaly detection in Aggregation Attacks, as illustrated below.

Enable packet log for machine-learning attack logs

There is also a packet log for machine-learning attack logs. It is enabled by default. You can enable packet log for anomaly detection attack logs from the GUI, as shown below.