Incorrect training of behavioral models or significant changes in the web application can lead to many false positives. To increase the accuracy of detecting attacks, it is recommended to retrain the models once a week. The commands below allow you to perform actions on models.
Settings are managed using specially designed queries. The general conventions (authorization, response codes, the *_hash methods and paginated selection) are described in the relevant section.
Request example:
curl http://api.example.com:8080/ml/v1/get_ml_hosts --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"ml_hosts": [string, ...]
}
Response example:
{
"status": "success",
"ml_hosts": ["example.com", ...]
}
Request example:
curl http://api.example.com:8080/ml/v1/set_ml_hosts --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"ml_hosts": ["example.com", "example.org"]
}'
ml_hosts - a list of hosts for which models will be created and applied. The list is transmitted in its entirety and completely replaces the previously saved one. The value null deletes the list; an empty list is not allowed.
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
When creating a list of hosts, wildcard values can be used. The model is applied in the following order of priority from highest to lowest:
example.com — building and applying a domain-only model example.com;.example.com — building and applying a model for a domain example.com and its subdomains;*.example.com — building and applying a model for domain subdomains only example.com, excluding the main domain;* — building and applying a model for all domains.Validation conditions:
example.com and .example.com is not allowed;Request example:
curl http://api.example.com:8080/ml/v1/get_model_names --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"models": [string, ...]
}
Response example:
{
"status": "success",
"models": ["*", "*.example.org", "example.com"]
}
Request example:
curl http://api.example.com:8080/ml/v1/del_models --header "Content-type: application/json" --data '{
"key": "%PRODUCT KEY%",
"model": "example.com"
}'
model - the name of the behavioral model that needs to be deleted.
Before deleting, a backup copy of the model is created.
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
The correct construction of models requires about 400,000-800,000 unique queries. If the number of requests was insufficient during training, then you can restart it and use the requests from the previous sample. To do this, follow 4 steps:
service mikiri-waf-mlc stop
/var/lib/mikiri-waf-mlc/data/backup/%HOST%.d_%TIMESTAMP% (where %TIMESTAMP% is the creation date of the backup copy of the training sample created by MLC before starting model construction) to /var/lib/mikiri-waf-mlc/data/ml/%HOST%.d. For example, for the model example.com:mv /var/lib/mikiri-waf-mlc/data/backup/example.com.d_1613587613 /var/lib/mikiri-waf-mlc/data/ml/example.com.d
curl http://api.example.com:8080/ml/v1/set_training --header "Content-type: application/json" --data '{
"key": "%PRODUCT KEY%",
"host": "example.com",
"duration": 4,
"complete": false
}'
service mikiri-waf-mlc start
Request example:
curl http://api.example.com:8080/ml/v1/rep_models --header "Content-type: application/json" --data '{
"key": "%PRODUCT KEY%",
"src_model": "example.com",
"dst_model": "example.org"
}'
src_model - the host whose behavioral model is being copied;
dst_model - the host to copy the model for. The host must be present in the list of hosts.
An existing dst_model model is overwritten a backup copy is created for it. The training status is copied along with the model.
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Only the hosts that are present in the list of hosts are displayed.
Request example:
curl http://api.example.com:8080/ml/v1/get_training --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
{
"status": "success",
"training": [
{
"host": string,
"duration": integer,
"complete": boolean,
"progress": integer
},
...
]
}
Response example:
{
"status": "success",
"training": [
{
"host": "example.com",
"duration": 4,
"complete": false,
"progress": 95
},
...
]
}
host - the name of the host;duration - the duration of the training in days (the default value is 4);complete - the training status of the model;progress - the training progress, from 0 to 100.In the example below, a training period of 4 days is set for the host example.com.
Request example:
curl http://api.example.com:8080/ml/v1/set_training --header "Content-type: application/json" --data '{
"key": "%PRODUCT KEY%",
"host": "example.com",
"duration": 4,
"complete": false
}'
At least one of the parameters duration or complete is required.
host - the name of the host. The host must be present in the list of hosts;
duration - the training period in days, greater than 0. If the parameter is omitted, the default value is 4;
complete - the training status of the model.
or
curl http://api.example.com:8080/ml/v1/set_training --header "Content-type: application/json" --data '{
"key": "%PRODUCT KEY%",
"host": "example.com",
"duration": 4
}'
or
curl http://api.example.com:8080/ml/v1/set_training --header "Content-type: application/json" --data '{
"key": "%PRODUCT KEY%",
"host": "example.com",
"complete": false
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/ml/v1/set_training --header "Content-type: application/json" --data '{
"key": "%PRODUCT KEY%",
"host": "*.example.com",
"duration": 4,
"complete": false
}'
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Request example:
curl http://api.example.com:8080/ml/v1/set_training --header "Content-type: application/json" --data '{
"key": "%PRODUCT KEY%",
"host": ".example.com",
"duration": 2,
"complete": false
}'
Executing the command with the parameter value complete: false allows you to start the retraining process of the model, if it has been completed complete: true interrupts the training process.
Before starting the model training process, the host must be added to the list of hosts.
Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}