Cloudflare Intrusion Detection System: Watching the Whole Network, Not Just the Perimeter

Cloudflare has announced plans for a new product, Cloudflare Intrusion Detection System (IDS), designed to monitor network traffic for suspicious activity and alert security teams to potential attacks. The system is built as a component of the Cloudflare One platform, connecting to both WARP for devices and Magic Transit for offices and data centers.

The core idea is to provide a comprehensive analysis of all traffic across an entire network, examining both external and internal communications. This moves beyond traditional firewall rules that rely on known attack patterns and static rule sets.

Moving Beyond Static Rules

Traditional network security often depends on firewall rules configured for physical appliances. While Cloudflare Magic Firewall addresses this by delivering network-level firewall rules from its global data centers, it still requires teams to know what they are looking for. Attacks that don't match a specific rule pattern, especially those originating from inside the network, can evade detection.

Cloudflare IDS is intended to close this gap by analyzing all traffic for behavior that indicates malicious intent. It operates on the assumption that a breach may have already occurred, a core tenet of the Zero Trust security model. To implement this model effectively, an organization requires two things:

  • A comprehensive view of the entire network that is constantly analyzed to identify issues that static rules might miss.
  • An intrusion detection system to perform that analysis.

With WARP and Magic Transit providing the network connection, Cloudflare IDS aims to deliver the analysis layer, offering a single view of activity across the network, including potential internal breaches.

Two Modes of Detection

The new system is designed to detect attacks through two methods. First, it will analyze traffic shape, learning what constitutes normal behavior for a network. For instance, a user who typically logs into a limited set of systems suddenly performing a port scan or attempting to access many systems at once would be flagged as clearly suspicious.

Second, it will perform traffic inspection. This involves looking inside the packets that traverse the network to identify targeted attacks that can otherwise appear as normal traffic. These kinds of sophisticated attacks are often invisible to traditional, rules-based detection methods because the pattern itself looks benign.

Learning From the Network

Because it is part of the Cloudflare network, the IDS product can benefit from aggregated intelligence. Attackers often reuse the same playbook across different organizations. Cloudflare IDS can learn from attacks seen against its own network and those of its other customers to identify new attack types. The platform also supports external threat feeds, as well as allowing customers to bring their own.

This is intended to address the burden of maintaining a homegrown or standalone IDS. Such solutions are known to be highly resource-intensive, requiring significant CPU and memory to operate effectively. By running the IDS on Cloudflare’s edge network, which runs the same software in every data center, organizations can offload that computational burden and scale without worrying about capacity.

Deployment and Next Steps

The product is designed for simple deployment, requiring only a button click to begin analyzing traffic patterns in Magic Transit traffic and Magic Firewall events against threat feeds. When a suspicious event is detected, an alert is sent to the security team, who can then drill down into the data from the dashboard. Blocking an identified attack is intended to be a one-click remediation that can be pushed out to the global network.

Cloudflare IDS is slated to follow the general availability of Magic Firewall. Organizations interested in early adoption are directed to contact their Cloudflare account team for further information.