AI 資安與執行期防護
F5 WAF Adds Per-Application Anomaly Baselines, Turns Scan Findings Directly into Virtual Patching Rules
F5 has added anomaly detection and agentic threat intelligence to Distributed Cloud WAF, while connecting vulnerability scan findings to runtime blocking workflows. The new capabilities could shorten the exposure window, but detection rates, false-positive rates, and latency figures are still based solely on vendor testing.
On September 1, F5 updated its Distributed Cloud Web Application Firewall (WAF) to score every HTTP request using a real-time machine learning classifier and neural-network risk engine, augmented by new per-application anomaly detection. The system builds a statistical baseline from each application's traffic and identifies requests that deviate from normal HTTP methods, headers, parameters, and traffic patterns. Unlike systems that only match known attack signatures, it aims to intercept injection and polymorphic attacks for which no CVE rule yet exists. The [F5 announcement](https://www.f5.com/company/news/press-releases/virtual-patching-ai-powered-waf-runtime-security) and [technical documentation](https://docs.cloud.f5.com/docs-v2/web-app-and-api-protection/concepts/ai-powered-risk-scoring) indicate that the models operate in the data path and combine their output with conventional signatures, indicators of compromise, and policies to produce a final risk score.
Another change connects findings from Distributed Cloud Web App Scanning to the WAF enforcement layer. Teams can generate narrowly scoped virtual patching rules based on a CVE, attack path, HTTP method, header, or parameter, blocking exploitable requests at the edge before fixing the source code through the standard change-management process. The same workflow also extends to BIG-IP. Agentic threat intelligence aggregates external attack intelligence, correlates it with a customer's actual attack surface, and recommends actions such as blocking IP addresses, applying virtual patches, or adjusting policies.
The technical value lies in compressing “discover a vulnerability—assess its relevance—enforce a block” into an automatable closed loop instead of having scanners merely generate backlogs. However, virtual patching is not a source-code fix and may be bypassed by semantically equivalent, transformed inputs. Existing research has shown that real-world WAFs can be affected by adversarial SQL injection. The [AdvSQLi paper](https://arxiv.org/abs/2401.02615) provides reproducible evidence of this risk.
F5 claims that internal testing achieved 98% detection effectiveness and a 1% false-positive rate, but it has not disclosed the dataset, traffic distribution, comparison baseline, or additional tail latency. The results therefore cannot be directly extrapolated to production environments. Anomaly detection and agentic threat intelligence are also still being rolled out in phases. Engineering teams should first conduct shadow-mode testing with their own API traffic, encoding transformations, and legitimate traffic spikes, measuring false blocks, rule rollback time, and fail-open/fail-closed behavior when the model-serving system fails.