PT AF Cloud Uses Machine Learning to Detect Shifts in Web Attack Patterns from Millions of WAF Events
Positive Technologies has published a detailed technical overview of the anomaly detection engine inside PT AF Cloud, its cloud-hosted web application firewall. The system processes tens of millions of WAF events daily and reduces them to an average of one notification per client per week, highlighting moments when the character of attacks against a tenant changes noticeably.
Traditional volume-based thresholds frequently miss attacks that begin during periods of declining legitimate traffic or that introduce new attack vectors without dramatically increasing total event counts. PT AF Cloud therefore constructs a profile for every tenant consisting of the proportional distribution of triggered protection rules. These profiles are compared against a weighted historical baseline using Jensen-Shannon distance, a symmetric measure bounded between 0 and 1 that remains finite even when a previously unseen rule appears.
Two parallel detectors run on different time scales. The hourly detector uses a short baseline of several hours to surface rapid changes such as the sudden appearance of SQL-injection or directory-traversal rules with hundreds of distinct payloads. The daily detector compares 24-hour profiles against several preceding days and catches slower shifts that never dominate any single hour. Both detectors combine an absolute distance threshold with a tenant-specific z-score to avoid flooding noisy or low-volume tenants with alerts.
When an anomaly is confirmed, the service automatically prepares an email containing the percentage change in event volume, the top five rules for both the current and baseline periods, the count of unique attack vectors, and direct links into the PT AF web interface filtered to the relevant time window. Analysis of 519 alerts sent over two weeks showed that 69 percent corresponded to either an active attack or a protection rule firing on legitimate traffic after an application change.
Internally, events are exported from PT AF Cloud into a Security Lakehouse where Apache Airflow orchestrates hourly profile recalculation and anomaly scoring. Separate delivery tasks ensure that transient notification-service outages do not cause duplicate messages.
Related articles
How to Prepare Your Website for Data Center Outages: Business Resilience Checklist
Following strikes on Yandex data centers, many businesses discovered that their sites and all backups were stored in a single location, leading to complete outages. The article provides a detailed checklist to mitigate such risks by separating critical components across different providers. Key recommendations include moving DNS to an independent provider, lowering TTL values, maintaining a live mirror site on separate hosting, and isolating corporate email. Additional steps cover local backups, monitoring, access management, and CDN usage. The guidance differentiates between virtual hosting, VPS or dedicated servers, and website builders like Tilda, while emphasizing compliance with Russian data localization laws such as 152-FZ.
How to Properly Compare CDNs: TTFB, p95 Latency, Caching, DDoS Protection and True Pricing
Selecting a CDN based solely on the number of points of presence is as unreliable as choosing a car by dashboard buttons. Networks with dozens of global PoPs may underperform for audiences concentrated in Novosibirsk or Yekaterinburg, while smaller regional providers often deliver superior peering with Russian operators. The article evaluates CDNVideo, EdgeCenter, Curator, NGENIX and Yandex Cloud CDN across verifiable features, network design, caching behavior, security controls, operations and commercial models. Performance data is separated because marketing claims cannot substitute for independent measurements from services such as CDNMON. Emphasis is placed on p95 metrics, cache hit ratios, origin shielding, raw logs and API limits rather than marketing scores. The analysis shows that no single universal ranking exists; optimal choice depends on traffic profile, audience geography, security requirements and operational workflows.
Innostage Lab Benchmarks PT NGFW 1.10.3 Performance in Eight Load Scenarios
Innostage researchers conducted extensive performance testing of PT NGFW version 1.10.3, the certified release at the time of trials. The evaluation covered TCP connection setup rates, concurrent session capacity, and throughput on a custom EMIX traffic profile with varying security modules enabled. Tests used Cisco TRex generators and a high-rule-count policy of 100,000 entries to simulate realistic enterprise conditions. Results showed the device sustaining 700,000 CPS and 6.4 million concurrent connections, matching or approaching vendor claims under HA-cluster configuration. Throughput remained above 27 Gbps even with IPS, application control, antivirus, NAT, URL filtering, and logging active. The report highlights differences in test methodology compared with vendor figures, including packet sizes and clustering setup.
Java Card Tutorial: Implementing Supplementary Security Domain to Limit ISD Privileges
A detailed technical guide demonstrates how to create a Supplementary Security Domain (SSD) on Java Card platforms to isolate applet management from the Issuer Security Domain (ISD). The approach prevents full card compromise if ISD keys are exposed by restricting SSD privileges to specific functions such as accepting extradition only from the ISD. Using the FunGP library and SCP02 protocol, the tutorial walks through installation, personalization with encrypted keys, and extradition of applets under the new domain. GlobalPlatform specifications including GP CS v2.3 and GP CIC v2.0 are followed for install parameters, privileges, and STORE DATA commands. After personalization the SSD reaches the PERSONALIZED lifecycle state, allowing secure delegation of applet control while the ISD retains overall card management rights. The method eliminates the need for custom operating systems and provides a standards-compliant way to enforce least-privilege access on smart cards.