Detecting zero-days before zero-day

This post details the evolution of Cloudflare's Web Application Firewall (WAF) towards achieving zero time to mitigation for zero-day exploits. It introduces the use of machine learning algorithms, trained on a combination of real-world traffic (leveraging signatures and bot management data) and synthetically generated data, to classify and block novel attack vectors. The post outlines a three-step process: creating a training set from existing signatures and true negatives, enhancing this set with artificial data, and building a fast inline classifier. It emphasizes the limitations of signature-based detection for zero-days and the necessity of ML for rapid threat response.