Scoring Every Request: Cloudflare’s ML-Based WAF Detection

Handling roughly 32 million HTTP requests per second and serving over 22% of known web servers, Cloudflare sees a substantial portion of the Internet’s traffic. That visibility lets it track attack patterns as they appear and evolve. Its Web Application Firewall (WAF) has long relied on Managed Rules—static, analyst-authored signatures that block requests matching known attack profiles. These regex-based rules are effective against established attack vectors, but they struggle with variations and bypasses, since attackers can mutate payloads to evade signature matching.

The problem was clear during the log4j response, when Cloudflare had to update rules continuously to counter evolving evasion techniques. That reactive approach leaves gaps while human analysts catch up. To address this, Cloudflare is introducing a new machine learning-based WAF detection engine. Available in Early Access for Enterprise, Pro and Biz customers, the feature complements existing managed rulesets such as OWASP and Cloudflare Managed.

Complementing Managed Rules with ML Scores

The new system offers several advantages over traditional managed rules:

  • Complete traffic coverage: Every request is scored for the likelihood it contains a SQL injection (SQLi) or cross-site scripting (XSS) attack.
  • Improved detection over time: The model is trained on traffic labelled by managed rules across all of Cloudflare’s network, giving smaller sites the same protection as large properties.
  • Proactive identification: The ML engine aims to spot bypasses and anomalies before they are exploited or manually identified.

The approach builds on the paradigm introduced with Bot Analytics. Each request receives a score, regardless of whether any action is taken on it. That allows users to visualize score trends for their full traffic stream and inspect the distribution of scores for a specific attack vector, helping them determine a threshold that separates good from bad traffic.

Mitigation happens through custom WAF rules where the ML score is a condition. These rules incorporate any HTTP request parameter, including dynamic fields like bot scores. In the future, Cloudflare plans to bring this scoring and analytics experience to its managed rulesets, so customers can create rules from traffic patterns instead of relying on trial-and-error log validation.

Scoring for SQLi and XSS

Currently, the system exposes three scores: an overall score and separate ones for SQLi and XSS. Exposed as cf.waf.ml.score, cf.waf.ml.score.sqli and cf.waf.ml.score.xss, they range from 1 (definitely malicious) to 99 (valid traffic). The scores are calculated on transformed request data, which makes attack fingerprints easier to identify. Each part of a request—body, URI, headers—is scored independently so users can pinpoint exactly where a malicious payload was found.

Training data comes from traffic already classified by the existing WAF rules, augmented for robustness. Building this system posed several engineering challenges, including assembling a reliable dataset, scaling the labelling process, selecting the right model architecture, and inferencing on every one of the 32 million requests per second processed globally. Cloudflare plans to publish a blog series detailing the technical implementation—how dataset quality was maintained, how the model architecture was chosen, and how evaluation was grounded in behavioral testing.

Roadmap Ahead

The company will roll out the detection engine to customers in the coming months and collect feedback. Long term, it intends to extend the ML detections to cover all attack vectors recognised by managed rules, while also feeding attacks caught by the ML model back into the managed rulesets to keep them current.