What is a zero-day attack?

Short answer

A zero-day attack is an attack that targets a software vulnerability that is not yet known or whose patch has not been released (NIST · zero day attack); since the vulnerability is new, there is no ready-made signature specific to it. Defense against such attacks relies on recognizing not a single vulnerability but the general form of the attack. In TR7 WAF, this has two counterparts (WAF's zero-day defense): the positive security model, that is, giving a structural violation score to a request that deviates from the request shape learned in the Page Types rules (allowed method, parameter, length, content type); and the signature categories in Signature & Rule Library, such as Encoding Evasion and OS Command Execution, which are aimed not at a single vulnerability but at the attack technique. Structural checks run in the Monitor and Blocking modes and in Teacher mode (in Teacher, the request is not blocked); in Learning mode, the path, header and field structure checks do not run.

Where It Is Used in TR7

Where	Field / label	What for
WAF Management → the Page Types row on the mode card	Page Types	The expected request shape of the application; a request that deviates from this shape receives a structural violation score (violation scores)
WAF Management → Checks	Structure Checks, Argument Checks	Whether the length, value and allowed/required name list checks are on; Allowed Methods, Block All JSON/XML/Form Contents, MIME and RAW checks keep running while both switches are off as well
WAF → Signature & Rule Library	Signature Categories (e.g. Encoding Evasion, OS Command Execution)	Signatures aimed at the attack technique that also catch some of the unknown variants

How the positive model catches unknown attacks, and its limits: Can TR7 WAF catch a zero-day attack without a signature?

Common Misconceptions

• "Nothing can be done against a zero-day attack until its signature is released." Even without a signature, a request that deviates from the learned shape of the application is caught by the structural check; the signatures aimed at the technique also catch some of the unknown variants.
• "The positive model catches every zero-day attack." An attack hidden in the value of an allowed parameter, within the allowed length and format, is not caught by the structural check; in this case, only the signatures can catch it.
• "The risk ends when the patch is released." The system is vulnerable until the patch is applied; during this time, WAF complements the protection but does not replace the patch.

How it is done in the documentation

• WAF - WAAP · Zero-Day Defense
• WAF - WAAP · Violation Scores
• Checks · Structure Checks

Related questions

• Can TR7 WAF catch a zero-day attack without a signature?
• What is the difference between the negative security model (signature scanning) and the positive security model?