[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-researchers-build-a-safer-way-to-train-firewalls-on-live-traffic":10,"sections":34},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":29,"feedback":33,"feedback_at":22,"cost_usd":33,"total_tokens":33},6228,"researchers-build-a-safer-way-to-train-firewalls-on-live-traffic","Researchers Build a Safer Way to Train Firewalls on Live Traffic","A new academic framework filters out attack traffic before a firewall's positive security model learns from it, cutting poisoning damage sharply.","A new research framework wants to teach web application firewalls what \"normal\" traffic looks like without letting attackers poison the lesson.\n\nResearchers built WAPP - the Whitelisting Autonomous Policy Producer - to fix a known weakness in positive security, the practice of learning legitimate traffic patterns and blocking anything that falls outside them. The system adds trust filtering, deterministic rule synthesis, confidence scoring, and validation before any rule gets enforced. Tested against a live Coraza and OWASP Core Rule Set stack, plain unfiltered learning fell apart fast: a DVWA username field degraded once just 0.2% of training traffic was malicious, and broke outright at 0.5%. On a frozen poisoning dataset, WAPP's full filtering setup pushed measured poisoning resilience from 53% to 90%, beating the older Kruegel-Vigna baseline's 62%.\n\nThat gap matters because positive security has always been a tempting idea nobody trusted enough to run unsupervised - one bad request in the training data and the firewall bakes an attacker's payload into its own rulebook. WAPP's deterministic rule synthesizer also matched a language model's attack-blocking performance without paying for model inference, which is the more useful headline for anyone running this at request-level scale.\n\nThe catch: free text fields still let malicious input through even without any poisoning at all, so this is a fix for structured fields like usernames, not a general autopilot for your WAF.","[\"security\",\"waf\",\"cybersecurity\",\"research\"]","2026-09-10T04:00:00.000Z","2026-09-10T08:06:48.303Z","2026-09-10T08:07:00.238Z","published",null,[],"security",[24,26,27,28],"waf","cybersecurity","research",[30],{"name":31,"url":32},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2609.06840",0,{"sections":35},[36,41,44,49,54,59,64,68,73,78,83,88,93,98],{"name":37,"slug":38,"count":39,"latest_published_at":40},"AI","ai",3480,"2026-09-11T04:00:00.000Z",{"name":42,"slug":24,"count":43,"latest_published_at":40},"Security",629,{"name":45,"slug":46,"count":47,"latest_published_at":48},"Policy","policy",336,"2026-09-11T00:56:21.000Z",{"name":50,"slug":51,"count":52,"latest_published_at":53},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":55,"slug":56,"count":57,"latest_published_at":58},"Hardware","hardware",153,"2026-09-09T15:12:32.000Z",{"name":60,"slug":61,"count":62,"latest_published_at":63},"Consumer Tech","consumer-tech",99,"2026-09-09T17:27:33.000Z",{"name":65,"slug":66,"count":67,"latest_published_at":40},"Science","science",98,{"name":69,"slug":70,"count":71,"latest_published_at":72},"Software","software",75,"2026-09-10T20:41:21.000Z",{"name":74,"slug":75,"count":76,"latest_published_at":77},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":79,"slug":80,"count":81,"latest_published_at":82},"Startups","startups",55,"2026-09-09T23:14:29.000Z",{"name":84,"slug":85,"count":86,"latest_published_at":87},"Gaming","gaming",43,"2026-09-10T12:18:06.000Z",{"name":89,"slug":90,"count":91,"latest_published_at":92},"General","general",41,"2026-09-08T01:57:23.000Z",{"name":94,"slug":95,"count":96,"latest_published_at":97},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":99,"slug":100,"count":101,"latest_published_at":102},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]