MeridianMeridian

PT AF Cloud Uses Machine Learning to Detect Shifts in Web Attack Patterns from Millions of WAF Events

Positive Technologies has detailed how its PT AF Cloud service applies anomaly detection to WAF events, turning tens of millions of daily security events into actionable weekly alerts for SOC teams. The system builds traffic profiles based on the distribution of triggered protection rules for each tenant and compares current hourly or daily profiles against a weighted historical baseline using Jensen-Shannon distance. This approach identifies meaningful changes in attack composition even when overall event volume remains stable, catching the start of scans, exploitation of newly published vulnerabilities, or post-release application changes that trigger new rules. Two detection modes operate in parallel: an hourly mode for rapid spikes and a daily mode for gradual shifts distributed across multiple hours. Alerts include comparative tables of top rules, unique attack vectors, and direct links to the relevant events in the PT AF interface. Over four weeks the detector surfaced roughly 1,100 anomalies across the cloud, with expert review confirming that 69 percent indicated either an attack or a protection misconfiguration.

HabrTranslated from Russian

Read at source

Positive Technologies has published a detailed technical overview of the anomaly detection engine inside PT AF Cloud, its cloud-hosted web application firewall. The system processes tens of millions of WAF events daily and reduces them to an average of one notification per client per week, highlighting moments when the character of attacks against a tenant changes noticeably.

Traditional volume-based thresholds frequently miss attacks that begin during periods of declining legitimate traffic or that introduce new attack vectors without dramatically increasing total event counts. PT AF Cloud therefore constructs a profile for every tenant consisting of the proportional distribution of triggered protection rules. These profiles are compared against a weighted historical baseline using Jensen-Shannon distance, a symmetric measure bounded between 0 and 1 that remains finite even when a previously unseen rule appears.

Two parallel detectors run on different time scales. The hourly detector uses a short baseline of several hours to surface rapid changes such as the sudden appearance of SQL-injection or directory-traversal rules with hundreds of distinct payloads. The daily detector compares 24-hour profiles against several preceding days and catches slower shifts that never dominate any single hour. Both detectors combine an absolute distance threshold with a tenant-specific z-score to avoid flooding noisy or low-volume tenants with alerts.

When an anomaly is confirmed, the service automatically prepares an email containing the percentage change in event volume, the top five rules for both the current and baseline periods, the count of unique attack vectors, and direct links into the PT AF web interface filtered to the relevant time window. Analysis of 519 alerts sent over two weeks showed that 69 percent corresponded to either an active attack or a protection rule firing on legitimate traffic after an application change.

Internally, events are exported from PT AF Cloud into a Security Lakehouse where Apache Airflow orchestrates hourly profile recalculation and anomaly scoring. Separate delivery tasks ensure that transient notification-service outages do not cause duplicate messages.

Positive TechnologiesSecurity LakehousePT AF CloudApache Airflow
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users
Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users

Mail.ru has begun notifying a small group of long-term Cloud Mail users that their complimentary 1TB storage, originally granted through a 2013-2014 app installation promotion, will be reduced to the standard 8GB free tier. Affected users receive personalized deadlines, with some facing storage limits starting 30 October and final deletion of excess files scheduled for 30 January 2027. The company confirmed the change impacts fewer than 0.5 percent of Cloud Mail users and stated that core free features remain available. Once the 8GB limit is exceeded, uploads, edits, and sharing are blocked while users have three months to download data or purchase additional space before files move to the trash for 14 days prior to permanent removal. This follows a similar reduction of lifetime 100GB storage performed by the service in 2024.

AntiMalwareOct 29, 2026Translated from Russian

Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts
Other

Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts

Kimi K3 is an open-weights model that outperforms closed systems from GPT and Anthropic on several independent benchmarks. Developers achieved this by scaling three dimensions simultaneously: one million tokens of context, deeper layers, and 896 Mixture-of-Experts specialists. The team replaced the standard KV-cache with a fixed-size state matrix updated via the delta-rule, solving numerical instability by clamping the forgetting coefficient alpha between e^-5 and 1. Sequential state updates were parallelized across chips, GPUs, and multi-GPU nodes using the open-source FlashKDA kernel built on CUTLASS. Inter-layer information flow was preserved through learned pseudo-queries that selectively retrieve relevant outputs from prior blocks rather than passing full activations. Load balancing across 896 routed experts uses per-expert quantile thresholds and a distributed histogram method to guarantee fair token allocation without full sorting.

HabrOct 29, 2026Translated from Russian

Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria
Other

Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria

Innostage has published the second part of its evaluation of PT NGFW version 1.10.3, focusing on functional capabilities rather than raw performance. The testing covered 156 individual checks grouped into categories such as basic technical features, firewalling, IDS/IPS, web filtering, malware protection, logging, routing, deployment, cryptographic controls and access management. Out of the total, 136 checks passed fully, seven passed with remarks, and 13 did not meet the predefined criteria. Key confirmed functions include high-availability clustering, centralized management via PT-MNGT, AD-based rule application, Site-to-Site VPN, TLS inspection, and Syslog integration with external security systems. Several advanced scenarios, including custom block pages, application risk classification, and centralized software distribution, were not confirmed under the test conditions. The report provides detailed protocol notes that help organizations map product capabilities against their specific infrastructure and regulatory requirements.

HabrOct 29, 2026Translated from Russian