Positive Technologies has implemented an anomaly detection system for its PT AF Cloud web application firewall. The tool monitors traffic profiles by analyzing the distribution of security rule triggers rather than just event volume, which helps identify shifts in attack patterns that traditional threshold-based alerts might miss.
The system utilizes the Jensen-Shannon distance to compare current traffic profiles against a baseline. An alert is triggered only if the deviation exceeds a fixed threshold and is statistically significant for a specific client, based on their historical data. This dual-condition approach prevents false positives for clients with naturally variable traffic.
The detection mechanism operates in two modes: hourly, for rapid response to scanning or fuzzing, and daily, for identifying gradual shifts. Notifications sent to users include comparative data on top rules, unique attack vectors, and direct links to the PT AF interface for investigation.
Data from September 2026 shows that the system processes millions of events, with typical clients receiving approximately one notification per week. During a two-week test period, experts analyzed 519 alerts, finding that 69% represented actual attacks or configuration errors requiring attention, with a 97% detection rate for these significant events.
