Skip to main content

How WAF works

A Web Application Firewall (WAF) protects web applications by inspecting HTTP requests and responses. It then applies a set of rules to identify and block malicious traffic.

ModSecurity and OWASP Core Rule Set (CRS)​

Threat Protection's WAF leverages ModSecurity and the OWASP Core Rule Set (CRS) for its detection capabilities. ModSecurity acts as the engine that inspects and filters traffic, while CRS provides the framework of rules that define which threats to look for and how to respond.

Building upon the rules in the CRS, our engineers have added custom rules tailored to prevent emerging threats. Customers cannot select individual rules; instead, they choose a paranoia level that activates a predefined set of rules.

Paranoia Level​

The Paranoia Level lets you define how aggressive the WAF policy for the Traffic Configuration will be. A lower Paranoia Level means fewer rules are enabled, which means less likelihood of false positives.

There are four paranoia levels available, ranging from 1 to 4. At level 4, traffic is subject to the most comprehensive set of rules, pre-processors, and HTTP compliance checks, among other stringent security measures.

The paranoia levels correspond to the OWASP-managed rule set, where more aggressive rules offer greater security but increase the likelihood of false positives. At level 1, the risk of false positives is typically lower, requiring less tuning compared to higher levels.

Anomaly Scoring​

Anomaly scoring aids in detecting sophisticated attacks and reducing false positives.

Each rule violation increases the anomaly score for a request. If the score exceeds a certain threshold, the WAF blocks the request. This model helps in identifying complex attack patterns that may not be apparent from a single rule violation.

When a rule is triggered, no immediate disruptive action is taken (e.g., the transaction is not blocked). Instead, the matched rule contributes to a cumulative anomaly score. Each matched rule logs a record of the match for future reference, including the ID of the rule, the data that caused the match, and the requested URI.

After all applicable rules have been matched and the request has been inspected, the WAF evaluates the total anomaly score. If this score meets or exceeds the predefined anomaly score threshold, the transaction is denied. Transactions that do not exceed the threshold are allowed to proceed normally.