Learning
Enable Machine Learning in WAF
Last updated
Was this helpful?
Enable Machine Learning in WAF
Last updated
Was this helpful?
Haltdos’s security is adaptive through automated learning and can make policy recommendations by learning about application behavior, which can make it easier for security teams to manage policies. Administrators retain full control over the activation and deactivation of each ruleset, with the opportunity to screen for false-positive before committing to production.
This module also defends against 0-day attacks by assigning suspicion score to every request based on anomaly based machine learning techniques. The learning requires creation of baseline during normal operations to understand user and application behavior for every URL. Once the baseline has been set, the WAF solution starts to look for anomalous patterns and block malicious 0-day attacks. As an adaptive solution, the learning continues at the set sampling rate to improve the baseline for dynamic web applications.
1. Go to WAF > Listeners > Learning
2. Configure your settings.
3. Click Save.
PARAMETERS
ACCEPTED VALUES
DEFAULT
Learning Mode
Drop-down
Learning Disabled
Sampling Rate
Integer
10
Trigger Threshold
Integer
100000
Error Rate
Integer
5
Drop Rate
Integer
5
IP Prefixes
Integer
Blank
This option specify the learning mode to enable/disable Machine Learning. When enabled it will start learning the requests and store all the required information and accordingly take action on the request detected malicious.
Specify the rate of sampling of requests for learning. This allows anomaly based machine learning to generate baseline at the specified sampling rate.
Specify the minimum number of HTTP requests required per URL to enable learning mitigations. When the threshold is breached then it triggers is turned on for the learnt URLs.
Specify the maximum allowed error rate from the source IP beyond which the IP is temporarily blacklisted.
Specify the maximum allowed drop rate from the source IP beyond which the IP is temporarily blacklisted.
Users can specify the list of IPs.
