Improving the accuracy of our machine learning WAF using data augmentation and sampling

Data Acquisition in a Privacy-Constrained Setting

The first hurdle is simply having access to request data at all. Cloudflare’s strict privacy guidelines mean that not every request is retained, and any data that is available must be carefully selected, anonymised, and stripped of sensitive information before it can be used for training. This limits the volume and richness of raw material we can draw upon.

Even when data is available, assembling a representative dataset is tricky. The heterogeneity of benign traffic makes it hard to find enough clean samples that reflect the diversity of charsets and content-encodings seen in production. Malicious samples present an inverse problem: some attacks are injected into otherwise normal requests, making them structurally similar to benign traffic but requiring precise labeling to be useful for training.

The Labeling Bottleneck and Sample Difficulty

Supervised learning depends on high-quality labels, and here we face a two-sided problem. First, many freely available attack samples in the wild are auto-generated by indiscriminate scanning tools. These payloads tend to be structurally and statistically similar, and often dated. Training on them produces models that recognize only the most trivial attack variants.

Second, label noise is a real concern. Attacks that are esoteric, specific, or unusual are likely to be misclassified as benign by a traditional rules-based WAF, which then poisons the training set with incorrect labels. The severity of this problem grows precisely for the attacks we most want to catch.

There is also the question of what constitutes a "difficult" sample. A human analyst’s intuition about complexity does not always match what a particular preprocessor or model finds hard. This mismatch complicates dataset curation and evaluation, because we cannot rely on obvious heuristics to grade samples for training value.

Constraints on Model Complexity

Production requirements impose additional limits. A WAF must inspect every request in the critical path, which means the underlying ML model has to be relatively simple and light-weight. We cannot compensate for poor training data by scaling up to enormous architectures that would introduce prohibitive latency at the edge. The data quality problem is therefore not something we can easily paper over with brute-force compute during inference.

Dataset Requirements for a Strong ML WAF

• Large volumes of heterogeneous samples covering all attack categories, including obfuscated variants.
• A diverse set of negative and benign requests to prevent false positives in production traffic.
• Balanced representation across techniques, so the model does not overfit to tool-generated payloads.

These requirements point to a central fact: for a model to perform reliably, the distribution it learns from must reflect the distribution it will encounter at run time. An incomplete or skewed dataset yields predictions that are a direct reflection of those data gaps.

The path forward is a combination of data augmentation and generation techniques, which we will examine next.

Synthetic negatives and harder positives

One of the core challenges in training a machine learning WAF is assembling a training set that is diverse enough to cover the enormous space of possible HTTP traffic without relying on sensitive real customer data. Data augmentation addresses this by generating artificial but realistic data, based on the statistical distribution of existing real-world samples, to improve both robustness and accuracy.

False positives are a particular concern for WAFs, since the risk of blocking legitimate traffic discourages users from enforcing strict rules. A rules-based system tends to rely on specific high-risk keywords or character sequences; our goal with augmentation was to instead train a model to perform a more holistic analysis of content and context, making it considerably less likely to block legitimate requests.

There are many character sequences that appear almost exclusively in payloads but are not themselves dangerous. To reduce false positives and improve overall performance, we focused on generating large quantities of heterogeneous negative samples to force the model to consider the structural, semantic, and statistical properties of the content when making a classification decision.

Generating benign content

In the context of our data, augmentation means mutating benign content in ways that guarantee it remains benign. Options include adding random character noise, permuting keywords, or merging benign content from multiple sources. Alternatively, benign content can be seeded with "dangerous" keywords or ngrams that frequently occur in payloads — the result is still benign, but trains the model not to be overly sensitive to the presence of malicious tokens lacking proper semantics and structure.

Generating benign content is easier than generating malicious content, since malicious payloads have a stricter grammar and syntax due to containing code. In the future, tools such as sqli-fuzzer could automate the process of fuzzing a given payload by applying transformations that preserve underlying semantics while changing representation or adding obfuscation. It is also possible to append malicious content to non-malicious content, although this does not generate genuinely new malicious content — it simply places existing payloads in a different context.

Pseudo-random noise samples

A particularly useful approach for increasing the number of negative training samples was to generate large quantities of pseudo-random strings of increasing complexity. The probability of any pseudo-random string being a valid attack is essentially zero, but by building token sampling distributions that make it increasingly difficult for the model to distinguish noise from real payloads, we observed dramatically better performance on false positive rate and overall model robustness.

This method works by taking a collection of tokens, defining a probability distribution over those tokens, and independently sampling a stream of tokens to create each sample. Sample length is selected from a separate discrete distribution.

For a simple example, the token collection might consist of ASCII characters with a uniform sampling distribution:

['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9']

Sampling random strings of length 0–32 from this collection produces uninteresting negative samples:

8hwk1d740hfstbb4aogbpi4qayppvdl41b6blornuzktp4yl

1deq7rug1zftmn9tjr73yttjnye99zh2140z2x9lr8n6sxhucdgn6bmqvfv7auw8fwbkrtxilk45ht-

As the token collections become more complex, the noise moves towards much more difficult examples, including fragments of valid URIs, user agents, XML/XSLT content, or restricted language identifiers. Examples of more complex collections include:

Ascii_script: alphanumeric characters plus '<', '>', '/', '</', '-', '+', '=', '< ', ' >', ' ', ' />'

alphanumerics, plus special characters, plus a variant of full javascript or sql keywords and (multi-character) sub-token fragments

Constructing a suite of noise generators of varying complexity is straightforward, targeting different content types: JSON, XML, URIs with SQL-esque noise, and so on. As strings grow longer, the probability they contain dangerous-looking subsequences increases, which makes this an effective test of model robustness for padding attacks.

We used these noise strings extensively to enhance the core training and testing dataset: training the model on increasingly difficult noise before fine-tuning on exclusively real data, appending noise of varying complexity to both malicious and benign samples to induce robustness, and estimating false positive rates for specific classes of benign content.

Beyond independent sampling

A natural extension to independent token sampling is dropping the independence assumption to emulate real data generation processes more closely, yielding samples with increasingly realistic local and global structure. Simple Markov chains are one option; contemporary autoregressive language models are another.

We experimented with language models trained on our corpus of real malicious payloads and found them extremely effective at generating novel payloads and transforming payloads into obfuscated representations. As training approached convergence, the likelihood of each generated sample being a valid payload approached 100%. Early samples served as extremely strong negatives, while later samples functioned as positives. This direction appears promising not only for training classifiers but for building adversarial penetration-testing agents.

Results summary

Our evaluation considered both quantitative metrics and the model's general properties and behavioral constraints — an important distinction in this domain, where data is inherently noisy, labels are not fully trustworthy, and the domain of inputs is extremely large.

We focused on F1 score, the weighted average (harmonic mean) of precision and recall, since it accounts for both false positives and false negatives:

Where:

True Positives (TP): malicious content classified correctly by the model

False Positives (FP): benign content that the model classified as malicious

True Negatives (TN): benign content classified correctly by the model

False Negatives (FN): malicious content that the model classified as benign

For multi-class problems, Macro, Micro, and Weighted F1 scores can be calculated; we obtained nearly identical results with all three methods:

The F1 score ranges from 1 (best) to 0 (worst). After augmentation, the model achieved a Macro F1 score of 0.99, compared to 0.61 before augmentation, with similar precision and recall.

Beyond F1 score, we observed several other improvements in model characteristics.

False positive characteristics

• Estimated false positive rate reduced by approximately 80% on test data sets. There are significantly fewer false positives involving PromQL and other SQL-structured analogues — PromQL examples now result in high scores and are classified correctly:

Today, the only major category of false positives is literal SQL or JavaScript files.

• General false positive rate on noise from JSON-esque, XML/SOAP-esque, and SQL-esque content-generators reduced to about a 1/100,000 rate from about 1/50 to 1/1.

True positive characteristics

• True positive rate for highly fuzzed content is vastly improved. Models trained solely on real data were easily bypassed by advanced fuzzing tools; models trained on real plus augmented data are extremely resistant, with many payloads receiving higher risk scores as fuzzing increases:

These generate approximately the same scores despite resulting from only a few byte alterations.

• Proportion of client-provided test sets containing payloads not blocked by rules-based WAF for XSS/SQLi classified successfully rose to about 97.5% (with the remaining 2.5% being arguable), up from about 91%.
• Padding a payload with almost any amount of ASCII, JSON-esque content, special characters, or other content does not substantially reduce the risk score. Due to hard noise long-length augmented training samples, even a six-byte payload in a 100-kilobyte string is caught:

Both generate similar scores even though one has junk padding around the payload.

Execution performance

• Runtime characteristics are unchanged for inference.

We also validated the model against Cloudflare's mature signature-based WAF and confirmed comparable performance, with the ML WAF demonstrating particular strength on highly obfuscated or irregularly fuzzed content and avoiding some rules-based engine false positives.

Conclusion

Building a machine learning-powered WAF required assembling a diversified training set while avoiding sensitive real customer data for privacy and regulatory reasons. Fuzzing, data augmentation, and synthetic data generation enabled us to create a broader, more diverse dataset, improving the solution's false positive robustness and overall model performance.

These techniques also reduced the time complexity required to retrieve and clean real data while inducing the correct model behavior. Future work will investigate autoregressive language models to generate synthetic pseudo-valid payloads.