Set up WAF Anomaly Detection
Overview
WAF Anomaly Detection is a built-in capability of F5 Distributed Cloud Web Application Firewall (WAF) that learns the normal traffic patterns of your applications and identifies suspicious deviations in real time. It helps your security team distinguish real attacks from false positives with greater speed and confidence.
Background
Security and operations teams that protect web applications with a WAF often face a difficult tradeoff:
- Spend time tuning manually. Teams must study normal application behavior in detail to reduce false positives. This process is slow and labor-intensive.
- Accept more noise. Teams skip detailed tuning to move faster, but risk misreading normal application behavior as attacks. This creates false positives that waste time and erode confidence.
Without application-specific context, WAF protections remain broad and imprecise. Security teams end up in lengthy tuning cycles, chasing down development teams to verify whether flagged requests are genuinely suspicious or simply expected behavior.
WAF Anomaly Detection addresses this gap by automatically building a baseline of what "normal" looks like for each application.
How it works
WAF Anomaly Detection analyzes your application's traffic patterns at the individual load balancer level to build statistical baselines. It evaluates the following attributes:
- Request paths
- Query parameters
- HTTP cookies
- Key headers
The system uses the previous 48 hours of server logs to establish these baselines. It then scores incoming requests against the baselines in real time to identify deviations that may indicate an attack or confirm a false positive.
Key technical details
- Detection method: WAF Anomaly Detection uses deterministic heuristics to analyze server logs and build a set of characteristics that describe normal traffic.
- Scope: Anomaly detection runs on requests that triggered a WAF signature, not on all traffic. This ensures the detected anomalies are high value while keeping performance impact very low.
- Enforcement behavior: Detected anomalies enrich security events with additional context. They do not change the actions your WAF takes. Your existing WAF enforcement behavior remains the same.
- Data handling: The feature operates on existing server logs. It does not collect new data or introduce new data storage locations.
What you can see
When Anomaly Detection flags a request as anomalous, it doesn't just return a score — it also returns a list of anomaly reports explaining why the request was flagged. Each report pinpoints which part of the request raised concern and provides a human-readable explanation.
Scoring Summary
| Score | Meaning |
|---|---|
| +1 | Benign — request matches the learned traffic profile |
| -1 | Anomalous — request deviates from learned patterns in a suspicious way |
| 0 | No opinion — no learned model exists for this application |
When the score is -1, one or more anomaly reports are attached to the response.
What an Anomaly Report Contains
Each individual anomaly report includes:
| Field | Description | Example |
|---|---|---|
| Location | Where in the HTTP request the issue was found | Query, Header, Cookie, URL path, Body, Body (JSON) |
| Field | The specific field/parameter name | q, User-Agent, Authorization, Path |
| Sub-field | Additional qualifier (only for Authorization) | Bearer, Basic |
| Reason | Machine-readable code (stable, for filtering/querying) | UNEXPECTED_CHARACTER_PATTERN |
| Message | Human-readable explanation | profiled request field with new suspicious characters: angle-brackets quotes |
Example Output
| Location | Field | Sub-field | Reason | Message |
|---|---|---|---|---|
| Query | q | UNEXPECTED_CHARACTER_PATTERN | profiled request field with new suspicious characters: angle-brackets | |
| Header | Authorization | Bearer | UNEXPECTED_VALUE_LENGTH | field value length outside expected range |
| Header | User-Agent | UNEXPECTED_CHARACTER_PATTERN | profiled request field with new suspicious characters: shell-operators | |
| URL path | Path | UNEXPECTED_VALUE_LENGTH | field value length outside expected range | |
| Cookie | session_id | UNPROFILED_FIELD_NEW_SUSPICIOUS_CHARACTERS | unprofiled request field with new suspicious characters: path-traversal |
Reason Codes
There are 7 reason codes, each corresponding to a different type of anomaly detected.
Field Classification
The system classifies every request field into one of three states based on how much historical data was available during the learning phase:
| Field State | Term Used in Messages | Description |
|---|---|---|
| Never seen | Unexpected | Field was never encountered in learned traffic |
| Seen, not enough to profile | Unprofiled | Field appeared in traffic but lacked enough data for a full statistical profile |
| Fully profiled | Profiled | Field has a complete per-key profile (character patterns, length ranges, entropy thresholds) |
Complete Reason Code Reference
| Reason Code | What It Detects | When It Triggers |
|---|---|---|
UNEXPECTED_PARAMETER_COUNT | Unusual number of query parameters | The count of query parameters falls outside all learned ranges |
UNEXPECTED_FIELD_SUSPICIOUS_CHARACTERS | Unexpected field with suspicious characters | A never-before-seen field contains character classes associated with attacks (for example:angle brackets, shell operators) |
UNPROFILED_FIELD_NEW_SUSPICIOUS_CHARACTERS | Unprofiled field with new suspicious characters | A field that was seen but not fully profiled contains attack-related characters not covered by the aggregate traffic profile |
UNEXPECTED_CHARACTER_PATTERN | Profiled field with new suspicious characters | A fully-profiled field contains character classes that were never observed in its learned profile |
UNEXPECTED_VALUE_LENGTH | Value length outside expected range | A field's value length falls outside the learned length distribution |
ABNORMAL_VALUE_STRUCTURE | Unusual value randomness | A field's value has abnormal entropy (randomness/structure), suggesting encoded payloads or injected content |
SUSPICIOUS_PARAMETER_NAME | Known suspicious parameter name | A query parameter has a name associated with common attack vectors (for example:cmd, eval) and was not learned, and its value contains dangerous characters |
Suspicious Character Labels
When a reason involves suspicious characters, the message includes human-readable labels describing what was detected:
| Label | Characters Detected |
|---|---|
angle-brackets | < > |
shell-operators | | ^ * + $ % ! |
path-traversal | ../ patterns |
line-breaks | \r \n |
quotes | `" ' `` |
brackets | ( ) { } [ ] |
path-separators | / \ |
control-characters | Non-printable characters |
double-URL-decoding | Value required double URL decoding |
base64-decoding | Value required Base64 decoding |
These labels appear space-separated in the message, for example:
unexpected request field with suspicious characters: angle-brackets shell-operators
Security Analytics Details
When a security event contains an anomaly, the following details appear in Security Analytics:
| Field | Description |
|---|---|
| Anomaly Class | The type of anomaly detected (for example, character usage anomaly or field length anomaly) |
| Anomaly Location | Where the anomaly occurred (for example, a specific query parameter or header) |
| Anomalous finding | The specific value (for example, User-Agent, Authorization, Path) that deviated from the baseline |
All anomaly fields are filterable.
Benefits
- Reduce false positives faster. WAF Anomaly Detection gives your security team the application-specific context needed to confidently identify and dismiss false positives — without chasing down development teams for answers.
- No disruption to existing workflows. Anomaly data enriches your existing security events. Your current WAF rules, policies, and enforcement behavior remain unchanged.
- Per-application intelligence. Baselines are built at the individual load balancer level, so the system understands what is normal for each of your applications independently.