Defensive AI: Cloudflare’s framework for defending against next-gen threats

This post introduces Cloudflare's 'Defensive AI' framework, detailing its application in enhancing security products. It highlights the development of API Anomaly Detection for API Gateway, which uses ML to model expected API request sequences and identify deviations. For the WAF, it discusses the evolution of WAF Attack Score, an ML model trained on attack traffic to detect new and undiscovered attacks. In email security, it describes Honeycomb (sender domain reputation) and Labyrinth (per-customer spoof detection) as AI-powered protections against phishing. Finally, it introduces Zero Trust user risk scoring, which uses AI to analyze user behavior anomalies for enhanced access control.