What is the difference between the negative security model (signature scanning) and the positive security model?

Short answer

The negative model asks whether there is a known attack pattern in the request: attack forms are defined as signatures and are searched for in every request; it is easy to set up but cannot see an attack whose signature has not been written. The positive model asks whether the request complies with the shape the application expects: for every path, the allowed methods, parameters, and length and type limits are defined, and a request that does not comply with the definition is counted as a violation; there is no need to know the form of the attack, but a map of the application is needed (two security models). On TR7, the counterpart of the negative model is the Signature & Rule Library and the OWASP Rules screen of the vService, and the counterpart of the positive model is the Page Types list of the Virtual Host Group and the Check Fields inspections. The map of the positive model does not have to be written manually; it is produced with Analysis & Learning from the traffic collected in the Learning mode. The two models are combined in the same attack score (hybrid security model).

Comparison

	Negative model	Positive model
The question it asks	Is there a known attack pattern?	Does the request comply with the expected shape?
Its source	The built-in signature library, custom signatures at the global and vService layer (rule layers)	Learned, imported or manually written Page Types
TR7 screen	Signature & Rule Library, OWASP Rules	Page types, Check Fields
Violation score	2, 4, 6 or 8 according to the risk level; 9 in three built-in signature rules (violation scores)	24
Unknown attack	Does not catch it if there is no signature	Catches it if it deviates from the expected shape (Can TR7 WAF catch a zero-day attack without a signature?)
Preparation	Not required	Learning, import or rule writing
Modes it works in	Learning, Monitor, Blocking	Monitor, Blocking (in Learning only the body size, truncated body and multipart inspections, without entering the score)
Turning off	The OWASP settings of the rule are turned off (in the Learning mode it is still scanned)	Structure Checks and Argument Checks are turned off on the Checks card; the allowed methods, the switches that block a body type, the MIME type lists and the unparsable body inspections on the RAW tab are independent of these switches

The Rules of the Positive Model in TR7

Rules come to the Page types list in four ways (how the rule set is formed):

Source	How
Analysis & Learning	The learning record accumulated in the Learning mode or with the Conditional Learning identity is processed with a manually started analysis; the suggestions are examined and applied. Conditional learning does not write rules itself; it only collects this record
Learning Methods	Teacher and AI Learning write the suggestions they produce to the rule automatically while the group is in the Monitor or Blocking mode
Event Logs	False positive records are selected and processed into the rule with Allow, Teach or Allow / Teach
Manually and from a file	Add, Import and Import (OpenAPI) on the Page types screen

How the two models are combined in a single score: What is TR7's hybrid security model; how do the two models work together?

Common Misconceptions

• "For the positive model, all the rules must be written manually." The rules are learned from the traffic or produced from the OpenAPI document (Analysis & Learning, Import (OpenAPI)).
• "In the Learning mode, the structural inspections work too." In the Learning mode, the path, header and field structure inspections do not run, the body inspections do not enter the score and no request is blocked according to the attack score; structural violations enter the score only in the Monitor and Blocking modes.

How it is done in the documentation

• WAF - WAAP · Two Security Models
• WAF Rules · Page Types
• Signature & Rule Library · What Is Signature & Rule Library?
• Path Check Fields · The Tabs and the Section They Inspect

Related questions

• What is TR7's hybrid security model; how do the two models work together?
• Can TR7 WAF catch a zero-day attack without a signature?
• What are the basic building blocks of TR7 WAF (WAF Mode, Virtual Host Group, Page Types, Any Paths, Check Fields, Signature)?