Threat Protection model update (7.6.0)

The Threat Protection model is to detect various types of attacks such as SQL injection, cross site scripting, local file inclusion, command/code/common injections, etc. It is utilized in ML-based Anomaly Detection and API Protection as a secondary layer of security, reinforcing the primary machine learning models.

We have introduced a major update to the Threat Protection model. The update is done after long research and testing using large amounts of data for model training. The new update increases model accuracy and reduce false positives and false negatives. We will continue to collect more data to further refine the model. Future updates will be published along with the FDS updates.

We also provide the flexibility to adjust the sensitivity level of the model. Setting it to Level 1 makes the model least sensitive, allowing it to tolerate broader activities and produce fewer false positives, but it may miss some attacks. On the other hand, setting it to Level 4 increases the model's sensitivity, enabling it to detect more potential threats but also raising the likelihood of false positives.

For ML-based Anomaly Detection:

config waf machine-learning-policy

edit <machine-learning-policy_id>

set svm-sensitivity-level {1 | 2| 3 | 4}

next

end

For ML-based API Protection:

config waf api-learning-policy

edit <api-learning-policy_ID>

set svm-sensitivity-level {1 | 2| 3 | 4}

next

end

When upgrading to version 7.6.0, the old command svm-type {standard | extended} will be replaced. The 'standard' option now corresponds to sensitivity Level 1, and 'extended' maps to Level 4.

For more information, see the following topics.

Administration Guide

• ML Based Anomaly Detection

• Configuring ML Based API Protection policy

CLI Reference

• waf machine-learning-policy

• waf api-learning-policy