Anomaly Detection

​

Objective

• Detect timing-based attacks and suspicious request patterns
• Identify content similarity across multiple requests
• Detect artificially “clean” inputs lacking human-like imperfections
• Monitor suspicious header configurations
• Track token usage across different clients
• Take configurable actions against detected anomalies

​

How It Works

1. Timing patterns - Detects suspiciously regular or frequent request patterns, identifying requests sent at exact, fixed intervals
2. Content similarity - Identifies repeated identical content across requests using hash-based and semantic similarity analysis
3. Artificially “clean” inputs - Detects inputs that lack human-like imperfections, suggesting programmatic generation
4. Suspicious headers - Analyzes header configurations for bot-like patterns
5. Token usage patterns - Monitors tokens used across multiple IPs or user agents to detect credential leakage or misuse

​

Configuration Options

​

Available Actions

​

Example Configuration

{
  "plugins": [
    {
      "name": "anomaly_detector",
      "settings": {
        "threshold": 0.7,
        "action": "block",
        "retention_period": 3600,
        "timing_pattern_weight": 0.3,
        "content_similarity_weight": 0.3,
        "suspicious_headers_weight": 0.2,
        "token_usage_weight": 0.2,
        "min_time_between_requests": 2,
        "max_requests_to_analyze": 20
      }
    }
  ]
}

Note: When action is set to block, requests identified as anomalous will be rejected with a 403 Forbidden status code.

​

Anomaly Detection Factors

​

Timing Patterns

• Suspiciously regular intervals between requests (e.g., exactly 1 request every 5 minutes)
• Requests that come too frequently (based on min_time_between_requests)
• Very short or perfectly even request intervals indicating automated traffic
• Automated patterns that humans typically don’t exhibit

​

Content Similarity

• Identical payloads sent repeatedly
• Unusual repetition patterns
• Content that appears machine-generated

​

Suspicious Headers

• Missing or generic User-Agent strings
• Missing Accept headers
• Missing Accept-Language headers
• Missing Referer or Origin headers
• Other header anomalies typical of automated tools

​

Token Usage Patterns

• Multiple IP addresses
• Different User-Agent strings
• Unusual access patterns

​

Best Practices

1. Start with alert_only mode: Monitor anomaly detection before blocking to avoid false positives
2. Adjust threshold based on your traffic: Lower thresholds catch more anomalies but may increase false positives
3. Tune weights for your use case: Adjust the weights of different factors based on your application’s specific threats
4. Use with rate limiting: Combine with rate limiting for comprehensive protection
5. Consider user experience: Use throttling instead of blocking for borderline cases
6. Monitor logs: Watch for patterns in anomaly detection to refine your configuration

​

Integration with Contextual Security

1. Data Sharing: When the Anomaly Detector identifies suspicious behavior, it feeds this data to the fingerprint tracking system.
2. Enhanced Decision Making: The Contextual Security plugin can then use this data to make more informed decisions about whether to allow, block, or challenge requests.
3. Persistent Protection: Even if an attacker changes their behavior slightly, the combined fingerprinting and contextual analysis can still identify them.
4. Adaptive Security: As more anomalous behavior is detected, the security posture automatically strengthens against the specific threats targeting your application.

​

Client Fingerprint Strategy

• IP address
• User-Agent
• Token (if present)
• Additional headers (e.g., Accept-Language)

​

Data Storage

• Timestamp history per fingerprint
• Last N request bodies for semantic analysis
• Last headers per fingerprint/token

​

Use Cases

​

Related Documentation

• Bot Detection
• Rate Limiting
• Contextual Security