Machine Learning - Anomaly Detection

FAQ

• How to handle false positives for ML Based Anomaly Detection?

• Which content-types are supported by ML?

• Which charset are supported by ML?

• What are the major specification & limitation of machine learning - Anomaly Detection

• How to find out the SVM threat model database version?

• Why is machine learning anomaly case-sensitive with URL and parameter name? Can we turn it off?

• After how many minutes or hours the “unconfirmed” parameter will be discarded by the garbage collector?

• Is there a way to check how many samples are discarded due to ‘sample-limit-by-ip’ in the machine learning database?

• Is Sample Collection mode Extended removed in the 6.4 version? I don’t see it in GUI or CLI configuration

• The 6.3 option “dynamically update when parameters change is enabled” is no longer available in 6.4/7.0. Are there any mechanism changes?

• How does noisy samples impact machine learning function, and how to alleviate the impact?

Machine learning trouble-shooting

• Machine learning oes not learn parameters successfully

• Machine learning status does not change from Unconfirmed to Running stage

• Machine learning does not block traffic

• Machine learning upgrade&compatibility issues