Closing the gap between known attacks and unknown threats

Signature-based WAF rules are effective at stopping known attack payloads, but they have an inherent blind spot: if no rule exists for a specific attack, the attack goes undetected. Cloudflare's WAF attack scoring system, now in general availability, addresses this by using a machine learning model trained on observed true positives across Cloudflare's network to classify every HTTP request with a probability score of maliciousness.

This model can flag requests that are similar to known attacks but different enough to evade managed rules, helping detect zero-day exploits and novel evasion techniques before they become publicly known. The feature is rolling out gradually to Enterprise customers on Core and Advanced Security bundles, with broader Enterprise access following in the coming months.

Why signatures aren't enough

Cloudflare's Managed Ruleset and OWASP Managed Ruleset are continuously updated to protect against known threats while minimizing false positives. But when a new attack vector emerges, human-paced rule updates create a window of opportunity for attackers. The Log4j RCE attack illustrated this challenge clearly: frequent rule updates were needed as new bypasses emerged through modified attack patterns.

Attack scoring addresses that gap. The model classifies each request across three attack categories — SQL injection (SQLi), cross-site scripting (XSS), and a range of remote code execution (RCE) attacks including shell injection, PHP injection, Apache Struts exploits, and Log4j-style attacks. Additional attack types are planned for the future.

Scores range from 1 to 99, with low scores indicating malicious or likely malicious requests and high scores indicating clean traffic. These scores can be used in WAF Custom Rules alongside existing managed rules.

A real-world validation came with CVE-2022-42889, a critical Apache Commons Text vulnerability affecting versions 1.5 through 1.9. Although the exploit payload wasn't immediately blocked by managed rules, the attack scoring system identified it with a very low score — enabling protection without any rule deployment time.

Exploring traffic with Security Analytics

The new Security Analytics view complements attack scoring by showing traffic distributions regardless of whether requests were blocked. This lets you explore potentially malicious traffic before deploying any rules, with filters for WAF Attack Score, Bot Management, and Content Scanning that can be mixed and matched.

The view includes top statistics, interactive graph distributions, and sampled logs. A dedicated "Attack Analysis" option provides a stacked chart showing traffic from the attack score perspective.

To investigate potential threats:

  1. Navigate to Security > Analytics (the previous Security > Overview is now available under Security > Events).
  2. Apply filters using the sliders or the one-click insights shortcuts — charts update automatically.
  3. Expand sampled logs below the traffic distribution to verify findings. Note that not all fields are currently logged; a low score could stem from a malicious payload in the HTTP body, which may not be visible in sample logs today.
  4. Click "Create custom rule" once you've confirmed the filter doesn't match false positives — the WAF Custom Rules builder opens with all filters pre-populated.

Using attack scores in rules and logs

Attack scores are available in HTTP logs and in the event log samples under Security > Events. The new fields work in WAF Custom Rules and WAF Rate Limiting Rules:

  • cf.waf.score — aggregate attack score
  • cf.waf.score.xss — XSS attack score
  • cf.waf.score.sqli — SQL injection attack score
  • cf.waf.score.rce — RCE attack score

These fields can be combined with any other available fields when building rules. For example, a rule could log any request with an aggregate score below 40.

What's next

The rollout is the first step toward a more intelligent WAF. Cloudflare is working on expanding coverage to additional attack vectors and improving visibility, with the technology being made available to more customers over time.