Cloudflare Introduces Application Profiles and Tests WAF Against AI-Generated Attacks

Cloudflare Introduces Application Profiles

Cloudflare has introduced Application Profiles, a new feature designed to enforce positive security policies for web applications. This system works by analyzing the structure and format of HTTP requests. By understanding what 'good' traffic looks like, it can identify and block deviations, thereby reducing the potential attack surface.

The introduction of Application Profiles addresses a growing concern among customers regarding protection from attacks leveraging frontier AI models. These models enable even non-technical individuals to generate malicious payloads and autonomously probe applications, mutating tactics based on application feedback or Web Application Firewall (WAF) responses.

Testing WAF Against AI Models

In parallel with the launch of Application Profiles, Cloudflare conducted tests on its existing Web Application Firewall (WAF) using attack payloads generated by frontier AI models. This dynamic testing approach involved making the AI act as a hacker, with no access to source code or WAF rules, only observing selected HTTP response data.

The objective was to evaluate the WAF's performance against the rapid iteration and mutation capabilities of AI-driven attacks. AI models can quickly test different encodings, send payloads in various parts of HTTP requests, and move to new vulnerabilities, surpassing human attacker speeds.

Improved Security Measures

The testing process revealed areas where the WAF could be improved. As a direct result of these findings, Cloudflare developed new detection rules. These enhancements benefit Cloudflare customers by providing better protection against sophisticated, AI-generated attack techniques.

Managed WAF rules and machine learning-based detections remain crucial for identifying common attack types such as SQL injection, cross-site scripting, remote code execution, and new CVEs. The new Application Profiles complement these existing tools by focusing on preventing attacks that deviate from expected application behavior.

Addressing Evolving Threats

The development of Application Profiles and the WAF testing against AI models reflect Cloudflare's strategy to stay ahead of evolving threats. The company acknowledges that simply patching vulnerabilities faster is not a sustainable solution, especially when applications may have unmapped vulnerabilities.

By understanding and enforcing what constitutes legitimate application traffic, Cloudflare aims to provide a more proactive security posture against the increasingly sophisticated and automated attacks facilitated by advanced AI models.