Heuristics and Rules: Why We Built a New Old WAF

This post details the rationale and technical approach behind augmenting Cloudflare's heuristic-based Web Application Firewall (WAF) with a traditional, rules-based WAF. It explains the historical limitations of rules-based systems (like SpamAssassin and ModSecurity) and the advantages of heuristic-based approaches. However, it acknowledges the need for rules-based systems for testing, compliance (e.g., PCI), and rapid response to new attack vectors. The new WAF was designed to be user-configurable, accept ModSecurity rule sets, add less than 1ms of latency, update globally within 30 seconds, provide feedback on triggered rules, and scale to handle billions of requests. The post also mentions rearchitecting some security systems for more visibility and flexibility.