CloFix AI Protection Engine Guide

Overview

The AI Protection Engine scores each request before, and without, OWASP CRS. You can disable CRS and the engine still learns and enforces from the ai_engine mode.

It has two scoring modules, a mode ceiling so a high score cannot jump past the action you configured, and Threat Learning for IP-independent signatures.

Request path

On each request the engine builds a capped field map from the path, query, body, and headers. Module A scores the payload. Module B scores behavior. Both run under a hard millisecond budget. CapAction then limits the result so enforcement never exceeds the configured mode.

Safe rollout Start at mode monitor, watch the false-positive rate, raise to challenge, then block.

Payload classifier (Module A)

Module A normalizes obfuscation in layers: URL encoding, HTML entities, Base64, hex, and unicode, up to 5 layers. Bomb guards stop runaway decode: 64KB normalized, 16KB per field.

The classifier builds a 40-dimension feature vector: entropy, density, decode layers, and attack shapes for SQLi, XSS, RCE, LFI/RFI, SSRF, XXE, SSTI, JNDI, GraphQL, JWT, prompt injection, and more.

Scoring is a pure-Go logistic regression model (seed-v2 / payload-v2.json). Every decision includes the top feature reasons.

Behavioral detector (Module B)

Module B keeps per-domain velocity windows at 10 seconds, 1 minute, 10 minutes, and 1 hour. It also watches path diversity, scanner user-agent signals, and EWMA/MAD baselines.

Actions and mode ceiling

The action ladder is Allow, then Monitor, Challenge, RateLimit, and Block. The mode ceiling caps that ladder:

monitorNever returns Challenge or Block, even when the score is high.

challengeEnforcement can rise as far as a challenge.

blockEnforcement can rise as far as a block.

After an AI block, fingerprint ban uses block_time. The default is 15 minutes.

Threat Learning

When learning is on, high-confidence decisions create or hit IP-independent signatures: a skeleton plus SimHash for payloads, client fingerprints, and behavior sequences. An active signature can challenge or block without CRS.

Control	What it does
approve_first	An admin must promote a candidate signature.
auto	Promotion uses hits and distinct sources.
scope	Domain or global.
SimHash	Near-match with a configurable Hamming distance. Default is 3.
capacity	Up to 5000 signatures per domain, then LRU eviction.

Lifecycle is candidate, then active. Operators can approve, mark a false positive, or mark a true positive.

Hot-path budget

The default deadline is 2ms (budget_ms). Fail-open allows the request on timeout or panic. Fail-closed degrades to monitor.

Exclude paths skip the dashboard, login, challenge, health, metrics, and any custom prefixes you add. Decisions stream to ClickHouse asynchronously (ai_decisions, ai_feedback, signatures) and never block Inspect. An in-memory ring feeds the Recent table.

Configuration

Put the block in the domain configuration, or use Configuration Manager.

domain conf

ai_engine {
    enabled on;
    mode monitor;
    payload on;
    behavioral on;
    learning on;
    budget_ms 2;
    block_time 15m;
}

Dashboard and rollout

Open /waf-dashboard/ai-engine for KPIs, recent decisions, the Threat Learning tab, and FP/TP feedback.

Rollout order Monitor first. Confirm the false-positive rate. Then challenge. Then block.

The same host can also run the API Security Engine and the Bot Management Engine. Feature summary: AI Protection Engine card.