Can TR7 WAF catch a zero-day attack without a signature?

Short answer

Yes, if the attack deviates from the learned request shape of the application or uses a known attack technique (zero-day defense). The positive model of TR7 WAF does not search for signatures: the Check Fields inspections in Page Types rules count an unexpected parameter, an out-of-limit length, count or depth, an HTTP method or content type that is not allowed, a field that does not match the value pattern (regex), an unparsable body and an uploaded file whose type detected from its content is not allowed as a 24-point structural violation; this score on its own reaches even the threshold of the loosest level (Elementary, 24). When an Analysis & Learning run that ignores the old rules is run with Rule Creating Mode Data based (default) or Comprehensive, the requests that carry data, or all requests, that come to unlearned pages are also blocked. On the signature side, general signatures aimed not at a single vulnerability but at an attack technique (such as Encoding Evasion, OS Command Execution, Template/Expression Eval) catch part of the exploit payloads of new vulnerabilities, and the hits accumulate in a single attack score (Signature Categories); a request whose source is in the blacklist receives 100 points with Blacklist Protection regardless of its content. The strength of this protection depends on the quality of the learned rule set: structural violations enter the score only in the Monitor and Blocking modes, if Structure Checks or Argument Checks is off the related inspections are not produced, and a new attack hidden inside the allowed form of an allowed parameter can be caught only by signatures. AI Learning is not a layer that detects attacks; it keeps the rule set up to date according to false positives.

How Does It Work?

A signature requires knowing the form of the attack; a zero-day attack, on the other hand, does not yet have a written signature. TR7 WAF can catch such a request in five separate ways; all of them write to the same attack score, and the decision is made with this single score when the scanning finishes (hybrid security model):

Way	How it catches an attack without a signature	Score
Structural inspections (positive model)	For every path of the application, the allowed methods, the expected parameters, the length, count, size and depth limits, the value patterns, and the allowed content and file types are kept in Page Types rules. A request that goes outside this definition receives a violation even if its content matches no signature	24
Protection of unlearned pages	An Analysis & Learning run that ignores the old rules (Ignore Old Rules, default) rebuilds the Any Paths rule in a restrictive way according to the selected Rule Creating Mode: with Data based (default), the requests that carry data and come to unlearned pages, and with Comprehensive, all requests that come to unlearned pages fall into the Any paths rule and are blocked. The rule creation manner of the automatic learning (Teacher, AI learning), on the other hand, is determined by Rule Creation Policy	24
Signatures aimed at an attack technique	Most signatures look not at a single CVE but at a technique: such as command injection, template and expression language injection, directory traversal, insecure deserialization, double encoding and Unicode abuse. If the exploit payload of a new vulnerability uses one of these techniques, it is caught without the vulnerability's own signature being written	2 · 4 · 6 · 8
Score accumulation	The scanning does not stop at the first hit; the hits in all sections of the request are summed. Hits that stay below the threshold on their own can together reach the OWASP Protection Level threshold (If a request contains several attacks, does the WAF stop at the first match or evaluate all of them?)	Total
IP reputation	If the source address is in the IP Intelligence & Reputation blacklist or in the Frontend Blacklist and Blacklist Protection is on, the request receives a score regardless of its content	100

Since the highest threshold of the five protection levels is 24, in the Blocking mode a single structural violation or blacklist hit blocks the request at every level; at the default Very tight level (threshold 4), a single signature hit of Medium or higher is also enough (How does TR7 WAF decide whether to block a request?).

What the Structural Inspections Catch

Inspection group	Example deviation	Which main switch it depends on
Limits (Structure Limits)	Key and value length, field count and total size in path, query, header, JSON, XML and form fields; nesting depth in JSON and XML; raw body size	Structure Checks
Value pattern and repetition	The field value not matching the defined regular expression (regex); the same field being repeated more than allowed	Structure checks
Allowed and required fields	The page carrying a parameter, header, JSON or XML key that has never been seen; a required field being missing	Argument Checks
Method and content policy	An HTTP method that is not allowed; the switches that block the JSON, XML or form body as a whole; the type of the uploaded file or the raw body detected from its content not being in the allowed list	Independent of the main switches
Content integrity	An unparsable JSON, XML or form body; a body that exceeds the processable size or gives a parsing error in an unexpected way	Structure checks or the setting on the RAW tab, according to the body type

The details of the inspections and which main switch they depend on: Checks · the main switches of the inspections

Factors That Determine the Strength of the Protection

Factor	Its effect
Learning quality	No separate rule is created for paths that were not visited during the learning; the general inspections of the Any Paths rule are applied to these paths. How complete the learning is is monitored from the Learning Coverage panel
Rule Creating Mode and Rule Creation Policy	Comprehensive: every access outside the learned pages is blocked · Data based (default): unlearned accesses that carry data are blocked · Page independent: pages are not learned one by one; access is managed with a single general rule
Structure Checks	If it is off, the length, size, depth and field value inspections are not produced
Argument Checks	If it is off, the unexpected or missing parameter inspection is not performed
Max. Allowed Arguments	If the allowed parameter list of a page exceeds this number (default 25), the list inspection is dropped on that page
WAF Mode	In the Learning mode, the path, header and field structure inspections do not work and the body inspections do not enter the score; in the Monitor mode, the violation is recorded but the request goes through
OWASP Protection Level	It does not affect the structural violation and the blacklist hit; it determines how many of the signature hits are enough for blocking

The Role of Learning in TR7

• The map of the positive model does not have to be written manually: it is produced with Analysis & Learning from the traffic collected in the Learning mode, or it is built from the OpenAPI document with Import (OpenAPI) (What is the difference between the negative security model (signature scanning) and the positive security model?).
• The learning cannot be steered with the traffic of a single source: for a rule suggestion to be accepted, the request, client, country and ASN network count thresholds are required together (when the learning is finished).
• AI Learning and Teacher teach false positives to the rule from the event records in the Monitor or Blocking mode; since the rule set stays up to date as the application changes, the positive model can be kept tight. Neither of them is an attack detection layer that evaluates requests inline.
• Structural violations appear in Event Logs with the Severity value Structural; the Attacks tab in the record shows in which field the violation occurred.

Common Misconceptions

• "AI learning detects unknown attacks." AI Learning is a learning method that evaluates the event records in the Monitor or Blocking mode with statistical thresholds and produces rule changes; it is not an attack detection layer that evaluates requests inline.
• "The positive model catches every zero-day attack." An attack hidden in the value of an allowed parameter, within the allowed length and form, is not caught by the structural inspection; in this case, only signatures can catch it. The value pattern (regex) inspection narrows this gap in the defined fields (Path Check Fields).
• "In the Learning mode, the structural inspection is performed too." In the Learning mode, the path, header and field structure inspections do not run, the body inspections do not enter the score and no request is blocked according to the attack score.
• "For zero-day protection, the protection level must be set to Aggressive." A structural violation (24) reaches the threshold on its own at every level; zero-day protection is determined more by the coverage of the learned rule set than by the level (Which protection level should I choose (Elementary, Normal, Tight, Very Tight and Aggressive)?).

How it is done in the documentation

• WAF - WAAP · Zero-Day Defense
• WAF - WAAP · Violation Scores
• Checks · Structure Checks
• Learning Methods · Rule Creation Policy
• Path Check Fields · The Main Switches of the Inspections

Related questions

• What is the difference between the negative security model (signature scanning) and the positive security model?
• What is TR7's hybrid security model; how do the two models work together?
• Which attacks does TR7 WAF protect against?
• My application's code was written securely; is a WAF still necessary?