Will Machine Learning Replace The WAF?
summary
Claims that ML replaces signature WAFs are rejected while showing impact and limits: a production system built in 2022 runs 80 million HTTP requests per second, trains from existing signature labels and augmented evasion examples, uses CatBoost and TensorFlow Lite, and achieves under a millisecond D90 latency to score requests bimodally, flag zero‑day patterns before public disclosure, and reduce analyst time, but signatures remain the guidance for labeling and ML can be poisoned or evaded, prompting ideas like silent 200 responses or payload sanitization.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:09What is a WAF?
- 2:35History of WAFs
- 4:15Developing a custom WAF
- 5:59Limitations of old WAFs
- 7:00Log4j and threat speed
- 15:50Machine learning approach
- 19:11ML WAF performance
- 21:54The future of WAFs
- 23:33Lessons from spam filtering
- 26:38AI vs. AI threat landscape
- 30:47Preventing feedback loops
- 31:51Q&A and conclusion
related talks
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
55mApisecure, 14 & 15 March 2023 - Sagar Bhure, Security Engineer at F5.
42m How machine learning and AI can help reduce the cyber- attacks
44mAdvancing Cybersecurity with AI and Machine Learning: Opportunities and Challenges- 44mAdvancing Cybersecurity with AI and Machine Learning: Opportunities and Challenges
23mLeave It To The Machines
09mAI/ML Won't Save you
43mMaking WAF Mainstream: From Static Defenses to... (Roy Weisfeld, Surya Pentakota)