For years, a web application firewall was mostly a large list of known-bad patterns. It was useful, but brittle. A new attack vector slipped through until someone wrote a signature, and legitimate traffic that happened to look like an old attack got blocked. The usual fix was more rules, more tuning, and more full-time WAF administration.
A different model is now in production at several major vendors. Instead of asking “does this request match a known attack?”, these systems ask “does this request look like it belongs here?” The answer comes from models that learn what normal traffic looks like for a specific application and flag deviations from that baseline.
[Read More]