Hello, Hatterheads 🎩
The net has won and I'll post something interesting about traffic and the net today/tomorrow.
But now the idea came spontaneously to write about waf, and first of all to discount articles about them .✨

What are the waf's defenses

Behavior Analysis and Reputation Analysis.

Roughly speaking there are bases of suspicious ip - from strange proxies or tor . And different patterns of attack behavior they can indicate malicious traffic, including types of requests, anomalous server responses. WAF used to use it mainly, but now other methods are often used too.

Traffic analysis using AI 

Artificial intelligence algorithms allow behavioral analysis of traffic patterns, using basic behavioral indicators for different types of traffic to detect anomalies indicative of an attack. This allows you to detect attacks that don't match known malicious patterns. However, I've always been suspicious of this method because I understand how difficult it is to build a training foundation for this and then effectively enforce it. This minimum is very expensive. Because of this often such methods are not effective

Application profiling  

This involves analyzing the application structure, including typical queries, URLs, values and allowed data types. This allows WAF to identify and block potentially malicious requests.

Correlation engines.  

They analyze incoming traffic and sort it using known attack signatures, application profiling, AI analysis, and customizable rules to determine whether it should be blocked.

Adding lag time when proxying traffic is just as useful.

I strongly suggest checking out the archive below💥. 

By the way in addition to waf there are articles about how F5 works. I think it's a pretty cool topic.

And that's it . Thanks for reading❤️ .
And don't run to the card queen garden without being ready to paint roses🌹🃏
#waf #web