Two agents do this work. MLA runs on the Filter server and analyzes requests that signature analysis did not block on its own. A request it blocks receives blocking type 3. MLC builds behavioral models and detects brute-force (blocking type 7), machine-learning attacks (blocking type 8), flood (blocking type 9) and DDoS (blocking type 10). It does not block the request.
MLA receives a request when the signature score is below the threshold in waf_mla_core. A signature with a score of 12 is blocked by the Filter and is not sent to MLA. The test signature mikiri-waf-test has that score.
A behavioral model is created for a list of domains. Analysis by MLA starts after that model exists. The list is set in WMC under ML settings. The sequence is Activating AI protection.
MLC uses the traffic it receives from Filter over RabbitMQ. In distributed mode each extra node detects brute-force, flood, DDoS and site parsing on its own and sends requests to the master node, which is the only node that builds the model.
Train the model before you judge it. While it is training and again while you check it, turn on detection mode for requests that MLA marks as illegitimate. In that mode the event is recorded and the request is not blocked. This option is not waf_host_dm. waf_host_dm stops blocking for the whole host, including signatures.
Retrain about once a week. Incorrect training, or a model left in place after the application changed, produces false blocks. complete: false starts retraining of a finished model. complete: true interrupts training. Deleting a model, or overwriting one by replication, writes a backup first. The methods are Behavioral model management.
If MLA falls behind the request rate, follow MLA is overloaded before training a new model on a partial sample.
The attacks page in WMC shows the event. A machine-learning block from MLA uses blocking type 3. MLC detects brute-force (blocking type 7), machine-learning attacks (blocking type 8), flood (blocking type 9) and DDoS (blocking type 10) and does not block the request.
Export the request and adjust the model as described in Behavioral model tuning. Do this for requests you have confirmed are legitimate. The same page explains why a host must not be added to waf_host_wl to hide these events: that option stops analysis of the host, including signatures.
To stop MLA blocking without stopping signatures, leave the MLA detection-mode option on. To stop MLC machine-learning detection for one host, use waf_mlc_ml_detect_host_wl or waf_mlc_ml_detect_host_dm. Brute-force and DDoS detection for one host use waf_mlc_bf_detect_host_dm and waf_mlc_ddos_detect_host_dm. The options are in Managing settings of the Filter.
A model blocks a request that does not match the traffic it was trained on. A new model does this more often. Leave MLA detection mode on until the attacks page shows no mass false blocks, then turn it off. While it stays on, MLA does not block.