What is TR7's hybrid security model; how do the two models work together?

Short answer

On TR7, signature scanning and structural inspections do not make separate decisions: every violation the two find is written to the single attack score of the same request, and the blocking decision is made with this single score after the scanning has finished (hybrid security model). Signature hits bring 2, 4, 6 or 8 points according to the risk level (9 in three built-in signature rules), and structural violations bring 24 points; the total is compared with the OWASP Protection Level threshold (default Very Tight, 4), and a request that reaches or exceeds the threshold is blocked in the Blocking mode. In this way, known attacks are caught with signatures, and deviations that have no signature are caught with Page Types rules, on the same scale. The hybrid model is the default but not compulsory: if Structure Checks and Argument Checks are turned off on the Checks card, the length, value and field list inspections are not produced (the allowed methods, body type and MIME type blocks and the RAW inspections still work); if OWASP scanning is turned off in the rules, signature scanning is not performed in that section in the Monitor and Blocking modes.

How Does It Work?

1. The request is split into the path, query, header and body sections; every section goes through both signature scanning and the structural inspections of the matching Page types rule.
2. Every violation is written with its score to the same hit table. The scanning does not stop at the first violation; the request is scanned to the end (If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?).
3. When the scanning finishes, the total score is compared with the OWASP Protection Level threshold; the result is applied by the WAF Mode of the group.

Component	Contribution	Where it is set
Signature hit	2 · 4 · 6 · 8 (9 in three built-in signature rules)	Signature & Rule Library, OWASP Rules
Structural violation	24	Page Types → Check Fields
Blacklist hit	100	Blacklist Protection
Threshold	The value at which the total turns into blocking: Aggressive 2, Very tight 4, Tight 8, Normal 16, Elementary 24	OWASP Protection Level (What is the OWASP Protection Level; how many levels are there?)

There are three situations in which the score does not lead to blocking (three situations that do not enter the score): a signature whose State is Monitor is recorded with its real score but is not added to the total; in the Learning mode, signature hits are not added to the score and no blocking decision is made; a request that comes with the Teacher identity is not blocked even if its score reaches the threshold.

When the Models Are Turned Off Separately

Setting	Its effect	Not affected
Structure Checks off	The length, count, size and depth limits, the field value inspections (value length, value regex, repetition count) and the unparsable JSON, XML or form body inspection are not produced	The rule values are not deleted; when the switch is turned on, they return with the same values
Argument Checks off	The allowed and required field lists are not applied	The value inspections continue because they depend on Structure checks
Both off	Only signature scanning and the inspections independent of the switches remain	The allowed methods, the switches that block a body type as a whole, the file upload and raw body MIME type lists, and the unparsable body and unexpected parsing error inspections on the RAW tab (not affected by these switches)
OWASP off in the rule	Signature scanning is not performed in the related section in the Monitor and Blocking modes (in the Learning mode all sections are still scanned); the structural inspection continues	The OWASP settings of the other sections (Path Check Fields)

The Checks settings are vService-wide and are applied to all Virtual Host Groups. The edit window of the card is saved with Edit; in a cluster setup, the change is sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is synchronized manually.

Common Misconceptions

• "Signature and rule inspections block separately." The decision is made with a single total score after the scanning has finished (hybrid security model).
• "When Checks is turned off, the learned rules are deleted." The values are kept; when the Checks switch is turned on again, they are applied.
• "While the two switches are off, the WAF only scans signatures." The allowed method, body type block, MIME type list and unparsable body inspections on the RAW tab still work, and a violation brings 24 points.

How it is done in the documentation

• WAF - WAAP · The Hybrid Security Model
• WAF - WAAP · The Three Situations That Do Not Enter the Score
• Checks · What Is Checks?
• Path Check Fields · The Main Switches of the Inspections

Related questions

• What is the difference between the negative security model (signature scanning) and the positive security model?
• What is the attack score and how is it calculated?
• How does TR7 WAF decide whether to block a request?