Enhanced Accuracy for Custom Rules Using Syntax-Based Detection (8.0.0)

FortiWeb 8.0.0 enhances the Custom Rule filter mechanism by integrating Syntax-Based Detection (SBD) into the Signature Violation filter type. This improvement introduces an optional secondary check to reduce false positives by verifying whether traffic that matches a Signature-Based Detection (SD) pattern also exhibits known malicious syntax characteristics.

Previously, Custom Rules relying on Signature Violation filters evaluated only SD results. While effective, SD can occasionally flag benign input—especially in cases involving uncommon or edge-case formats. When SBD is enabled as a follow-up check, the Custom Policy Detection (CPD) engine will only apply an action if both SD and SBD classify the same data as malicious.

In the Custom Rule > Signature Violation filter editor, four new toggles allow administrators to selectively enable Syntax-Based Detection for the following SD categories:

• Cross Site Scripting

• Cross Site Scripting (Extended)

• SQL Injection

• SQL Injection (Extended)

These toggles are disabled by default and must be explicitly enabled per class. Once enabled, when a request triggers a match against the selected signature class:

• FortiWeb attempts to reuse SBD results for the relevant data segment (e.g., specific header, cookie, argument, or payload).

• If no cached result is available, the CPD engine invokes the SBD module directly to perform additional inspection on the matched content.

• If the content passes SBD analysis, the match is disregarded, and no Custom Rule action or log is generated.

• If the content fails SBD validation, FortiWeb logs the event and applies the action configured in the Custom Rule.

This process ensures that validation occurs in context—preserving the exact source (e.g., arg #2, cookie #1, header #0) and direction (request or response) of the original signature match.

Note: To take effect, both the SBD and SD modules must be enabled in the same Web Protection Profile.

This layered inspection approach improves accuracy without sacrificing performance. SBD execution is avoided when results can be reused, reducing redundant computation and ensuring efficient policy enforcement.