Using the Advanced Machine Learning Model
Last updated
Was this helpful?
Last updated
Was this helpful?
open-appsec uses two machine learning models:
A "Supervised Model" that was trained offline based on millions of requests, both malicious and benign.
An "Unsupervised Model" that is being built in real time in the protected environment. This model uses traffic patterns specific to the environment.
For the supervised model (see above) there are two alternative options you can chose from:
A "Basic Model" is provided as part of the and the default installations. This is recommended for use in Monitor-Only and Test environments.
An "Advanced Model" can be downloaded from . This is more accurate and recommended for Production use.
To download and extract the open-appsec advanced machine learning model follow these steps:
Login to the open-appsec portal at .
Download the advanced machine learning model by going to: User Menu -> Download Advanced ML Model.
To deploy and use open-appsec's advanced machine learning model follow the instructions below to install this Advanced Model in your specific environment:
Create a folder called open-appsec-advanced-model
Copy the tgz file into the folder.
Map this .tgz file into the appsec container to "/advanced-model/open-appsec-advanced-model.tgz" file inside the container.
If you are using docker run
command to run the agent container add a volume mount to the command as follows:
-v=./open-appsec-advance-model/open-appsec-advanced-model.tgz:/advanced-model/open-appsec-advanced-model.tgz:rw
See also the following example docker run
command for the agent to which the additional volume mount was added accordingly.
Run the agent container (if you already have a running agent container make sure to redeploy it)
Create a config map from the tgz file in the relevant namespace: kubectl create configmap advanced-model-config --from-file open-appsec-advanced-model.tgz -n <namespace>
Restart all open-appsec agent pods in the namespace of your open-appsec deployment, you can restart the pods by following the steps below:
get open-appsec deployment name
kubectl get deployment -n <open-appsec deployment namespace>
Restart pods
kubectl rollout restart deployment <open-appsec deployment name> -n <open-appsec deployment namespace>
Create a folder under the following path in the root directory: /advanced-model
mkdir -p /advanced-model
Copy the .tgz file into the folder you created
cp ./open-appsec-advanced-model.tgz /advanced-model/open-appsec-advanced-model.tgz
.
Deploy the embedded agent
if you already have an open-appsec agent.
Complete steps 1-3
Run open-appsec-ctl --stop-agent
Extract the model to the relevant folder by running tar -xzf /advanced-model/open-appsec-advanced-model.tgz -C /etc/cp/conf/waap
Run open-appsec-ctl --start-agent
Clone the open-appsec agent GitHub repository (https://github.com/openappsec/openappsec).
Extract the open-appsec-advanced-model.tgz
file.
On Linux you can do this by using the following command:
tar -xvf open-appsec-advanced-model.tgz
Copy the extracted files to the components/security_apps/waap/resources
folder.
Build the agent package or Docker by following the instructions in the GitHub repository README (https://github.com/openappsec/openappsec/blob/main/README.md).
The machine learning AI model type and version being used can be validated using the command:
The model being used by each agent can also be validated using the Agents tab in the web UI: