What is AI Learning and how does it work?

Short answer

AI Learning is the automatic learning method that clears false positives with evidence collected from the traffic as a whole; it is not a machine learning model but a counting mechanism that compares the request, client, country and ASN counts with thresholds. It is turned on in the Learning Methods window and runs in the period selected in AI Learning Frequency (between 30 minutes and 1 day); in every run, it reads the Event Logs attack records of the last 1 day to 3 months. The records that pass the Country Filter, Only Browsers, Only Valid Domain Names and Skip Blacklist IPs filters are gathered into a single suggestion for the same host group, page type, inspection field and parameter. The suggestion is written to the rule when it meets all the defined thresholds: Required Requests (default 10), Required Clients (5), Required Countries (1) and, if filled in, Required ASN Networks. The change written may be excluding the signature, adding the parameter or header to the allow list, removing a parameter from the required parameter list, enlarging a numeric limit, clearing the pattern or turning off a blocking switch. Every learning applied appears in the AI Learning History view and in the operation record, and can be undone with Revert Learning. The host group must be in Monitor or Blocking mode; in Learning mode, no Event Logs record is created.

How Does It Work?

Step	Description
Source	Attack records written to Event Logs; no record is created in a group in Learning mode
Filters	Country Filter (all countries if empty), Only browsers, Only Valid Domain Names, Skip Blacklist IPs (the three are unchecked by default)
Grouping	Host group + page type + inspection field + field to be learned + parameter
Thresholds	Required requests 10 and Required clients 5 are mandatory; Required countries 1 and Required ASN Networks are optional
Maturity	The ratio of every defined threshold is calculated separately, and the progress is the lowest ratio; automatic applying requires 100% (How is Learning Progress read (Request, Client, Country, ASN network axes); why is the lowest axis decisive?)
Timing	At exact multiples of the period starting from midnight on the device (What do the AI Learning evaluation periods (30 min / 1 day … 1 day / 3 months) mean?)
Applying	Written to the rule automatically; Rule Creation Policy determines whether a new page type is opened
Trace	The AI Learning History view and the operation record of the vService
Reverting	Revert learning (Can I revert a learned rule?)

• In a cluster, the automatic run runs on the first device and reads the records of both devices; the thresholds are filled separately with each device's own records.
• Candidates that have not reached the threshold are watched in the AI Learning Tracking view on the AI Learning & Teacher Tracking tab and, if wanted, are applied manually (Can I apply AI Learning's suggestions manually without waiting for it to apply them automatically (Learn Selected)?).

AI Learning in TR7

In the Left Monitor Panel → WAF-Protected vServices → vService → WAF Management, the pencil icon of the Learning Methods card in the Learning & Reporting section is clicked; in the Learning methods window, the AI learning switch is turned on, AI learning frequency is selected, the filters and thresholds are entered and Edit is clicked. If the switch is on but no period is selected, the card shows the "AI learning is on but no period is selected" warning and no run is made.

The same setting with WEB-CLI (the period value 1sa_2g is the "1 hours (2 days)" option):

waf options update poolId <vService> --collectiveLearning true --collectiveLearningFrequency 1sa_2g --minReq_SL 10 --minCi_SL 5 --minCountry_SL 1

In WEB-CLI, there is no default value for --minCi_SL and --minCountry_SL; the command changes only the fields that are given, so if the field has neither been given in the command nor saved before, that threshold is not required at all.

• If it produces no suggestions: AI Learning produces no suggestions; why? · The difference from Teacher: What is the difference between AI Learning and Teacher? · The risk of being fooled: Can an attacker fool AI Learning by making their traffic look widespread; how is this risk reduced?

Common Misconceptions

• "AI learning detects new attacks." It only relaxes rules from false positive records; detection is the job of the inspections that produce Event Logs.
• "AI learning runs in Learning mode." Since it requires Event Logs records, the host group must be in Monitor or Blocking mode.
• "When the switch is turned off, the settings are deleted." The fields are hidden but their values are preserved; when the switch is turned on again, the same settings become valid.

How it is done in the documentation

• Learning Methods · AI Learning
• AI Learning & Teacher Tracking · How Does It Work?
• AI Learning & Teacher Tracking · How Is Learning Progress Read?
• WEB-CLI waf options · The AI Learning

Related questions

• What is the difference between AI Learning and Teacher?
• Which rule changes in the background when I Allow / Teach (Learning Suggestion)?
• AI Learning produces no suggestions; why?