Learning

What Is Learning?

Learning is the learning strip on the Bot/DDoS Management screen and the engine behind it. The engine monitors the traffic coming to the vService according to the source, the country, the network type and the bot behavior; it calculates the correct threshold and the correct rule structure for every protection itself and presents every change as a recommendation. The strip summarizes the result of this work in three cards: what the engine learns and how, what it decides when it finishes its examination, and the steps that can be applied with a single click.

This strip is not a protection layer

The strip does not intervene in the traffic; it judges the settings of the protections. The numbers here are the numbers of the recommendations and the verified settings, not of the requests blocked. Applying the recommendations changes the own configuration of the protections: L7 DDoS Protection, IP Reputation Protection and Bot Protection.

Off

"Learning is off — no suggestions are produced for this pool."

The periodic evaluation of the engine is not made at all for this vService: no recommendation notification is produced and no calculation cost arises by itself. When the screen is opened, an instant evaluation is still made over the settings in force.

Smart Advisor

It learns, it recommends, it applies nothing by itself

It is the default mode. The engine learns regularly and submits every change for approval; the last word belongs to the operator.

Automatic

It applies itself what it has learned

The engine learns in the defined period and puts the changes that mature into force itself: it adjusts the thresholds, writes the rule rows and enables the protections that are ready.

The Learning Strip in Bot/DDoS Management

The strip is the second band of the screen: it stands right below the status band and above the protection cards. In its upper band there are two counters and a link that goes to the settings screen; below it the introduction sentence that tells what the engine does; and in its body three cards.

The Bot/DDoS Learning Strip

The anatomy of the band:

Section	What it shows
Settings Reviewed	The number of settings that the engine has judged in this evaluation. Every setting carries a result mark on its own card or in its own row.
Suggestions Waiting	For how many of these settings there is a recommendation waiting for approval. The number is the total of the marks that require action and carries the same value as the badge on the What It Can Do for You card.
AI Learning Settings →	The link at the bottom right corner of the upper band; it opens the editing window of the learning settings.
The introduction sentence	The fixed text that begins with the AI Learning badge and tells what the engine monitors and that nothing is applied without approval.
The cards	How It Learns, What It Concluded and What It Can Do for You.

The strip is seen in every mode

When learning is turned off, the band does not disappear: the How It Learns card writes that learning is off and the mode name below the card becomes Off. Since the evaluation is still made when the screen is opened, the counters can come full; if a result has not been formed yet, the What It Concluded card writes Preparing suggestions… and the Verified number below is not printed.

How Are the Counters Calculated?

The counters are the result of an evaluation: the engine evaluates all the settings of the protections in order and gives each one a result mark. Settings Reviewed is the number of the settings evaluated and Suggestions Waiting is the number of the ones among them that require action.

Outcome	Meaning
Verified	The setting has been checked against the traffic learned and nothing to be changed has been found.
Suggestion	There is a recommendation that can be applied with a single click. Four situations share this single word: a value that fits the traffic better being learned, a starting value being prepared for the first time, rule rows being derived from the traffic and a protection that only monitors becoming ready to be enabled. All four carry the same light bulb badge; in this way the Suggestions Waiting number is exactly equal to the number of badges to be looked for on the screen.
Advice	The engine has learned a value but it cannot apply it itself: since the waiting room takes the visitors into a queue, the decision belongs to the operator, and the engine does not compete with rule lists written manually either. The value is read and, if necessary, written manually; it does not enter the counter.
Attention	A finding related to the rule structure that has no threshold recommendation but that needs to be looked at.
Learning	The engine has not reached a result yet. It covers two situations at once: not enough data having accumulated for the setting, or the normal traffic not being separable from the attack traffic in that period. In the second one, instead of guessing a number, the engine leaves the decision to the operator; which one it is is written in the detail window.

Suggestions Waiting counts only the Suggestion marks; Verified, Advice and Learning do not enter this number. The Attention findings are also kept separate: they are listed not in the counter but with their own badge on the What It Can Do for You card.

When Does Learning Run?

• In the Smart Advisor mode the evaluation on the server side is repeated every hour. It is not waited for the configuration to change: the records made one after another are gathered in a 20-second window and reduced to a single evaluation, and the count is refreshed. While the screen is open, the update is instant; when any field of the record changes, the strip repeats the evaluation immediately.
• In the Automatic mode the evaluation runs in the period in the Learning Interval setting and applies the changes that mature itself. The evaluations are aligned to the clock wall (such as midnight for daily and Monday 00:00 for weekly) and, whatever period is selected, it does not run more often than once an hour. A restart does not trigger an evaluation, it only anchors the rhythm.
• In the Off mode no periodic evaluation is made at all; the instant evaluation made when the screen is opened is independent of this.
• In a cluster installation only the first device carries out the learning; the result is carried to the second device with the configuration synchronization.
• If the recommendation notifications have been muted (Mute Suggestion Notifications), the Smart Advisor evaluation is not run at all: neither a notification is produced nor a learning cost arises. Since this setting is a notification setting, it is not in the learning window but on the Notifications card.

The Default Settings

Setting	Default	Limit
Learning Mode	Smart Advisor	Off · Smart Advisor · Automatic
Learning Lookback	1 month	At least 7 days, at most 3 months (days, weeks, months)
Learning Interval	Daily	Only in the Automatic mode; hourly (observation/debugging), once every 6 hours, once every 12 hours, daily and weekly
Tune Limits Only	Off	Only in the Automatic mode
Trusted Countries and Trusted Network Groups	Empty	It only shapes the rule structure, it does not touch the numbers learned

A vService that has not been touched also learns

If Learning Mode has not been written at all, the effective value is Smart Advisor. That is, a vService whose protection has been enabled but whose learning setting has never been entered learns and produces recommendations from the first moment; no starting step is required for this.

AI Learning Settings

How learning will work is managed from a single editing window. The window gathers the working mode, which history learning will look at, the period and the brake of the automatic mode, and the countries and network groups accepted as trusted. The fields are seen according to the mode: while Off is selected, the history, the trusted lists, the period and the brake are removed from the form completely; the period and the brake are seen only in the Automatic mode.

The text of the link and the title of the window are not the same: the link is AI Learning Settings and the title of the window that opens is Smart Advisor. Mute Suggestion Notifications is not located in this window; since it is a notification setting, it is edited on the Notifications card.

Entry point	Its place
AI Learning Settings →	The link at the bottom right corner of the upper band.
The How It Learns card	When anywhere on the card is clicked, the same window opens; the pencil icon at the bottom right corner states this.

Details: AI Learning Settings.

Reset to Factory cannot be undone

The last step on the What It Can Do for You card returns the whole Bot/DDoS configuration of the vService to its default state: every protection goes down to the Monitoring mode (including the ones that have been turned off manually), all the blocks pass to monitoring with their default limits, and the rules and the learned values are deleted. The engine starts to learn from scratch. The operation asks for confirmation; the confirmation text states with a number how many fields will be deleted and the fields deleted are written to the user log. A reset cannot be run while an evaluation is in progress. Beforehand, backing up the configuration with Export is recommended.

The Cards on the Strip

The three cards in the body of the band answer three separate questions of the engine: how it is learning, what conclusion it has reached and what can be done now.

Card	The question it answers
How It Learns	In which mode and looking at which history is learning working?
What It Concluded	In the last evaluation, how many settings were judged and for how many of them is there a recommendation?
What It Can Do for You	How are the waiting jobs applied with a single click?

The cards read the same evaluation

All three cards show the result of a single evaluation; they do not collect data separately. The same evaluation also feeds the result badges on the protection cards and the review window opened through What It Can Do for You. For this reason no surface can show an older answer than another.

How It Learns

Summarizes the definition of learning in force in a single sentence: which history is looked at and whether the result is presented as a recommendation or applied by itself is written. In the automatic mode the sentence also contains the period. At the bottom right of the card there are the name of the mode in force and a pencil icon; when anywhere on the card is clicked, the editing window of the learning settings opens.

Details: How It Learns.

What It Concluded

Gives the result of the last evaluation in a single sentence: how many settings were judged, for how many of them there is a recommendation and that the rest were found suitable as they are. If there are findings related to the rule structure, they are also added to the sentence. Below the card, the number of settings for which no touch is seen as necessary is shown with the Verified label.

The Re-assess button on the right of the title runs the engine again over the settings in force and the traffic learned up to that moment; while the evaluation is in progress, the icon turns and the button does not take clicks.

Details: What It Concluded.

What It Can Do for You

Lists the waiting jobs as steps that can be applied with a single click. The list rises up to three rows according to the situation: the findings that need to be looked at, the recommendations that can be reviewed and applied together, and the reset step that returns the configuration to its default state. The first two rows are seen only while there is something that corresponds to them; the reset step is always located in the list.

The finding row carries a clickable sentence while there is a single finding and leads directly to that finding; if there is more than one finding, only the badge that gives the number remains and the findings are opened from their own rows on the page.

Details: What It Can Do for You.

Scope and Limits

INFO

• The strip only judges the settings. It does not intervene in the traffic; the counters are the numbers of recommendations and verifications, not the numbers of requests blocked.
• The default mode is Smart Advisor. A vService on which no setting has been written also learns and produces recommendations; no change is applied without approval.
• Application is made only in the Automatic mode. In the automatic mode the engine adjusts the thresholds, writes the rule rows that mature and enables the protections that are ready; when Tune Limits Only is turned on, it touches only the numeric settings, and writing rules and enabling are left to approval.
• The automatic mode is not hasty. For a rule structure to be able to be applied, the same structure must be recommended in two consecutive evaluations; the numeric settings are also brought closer to the target not in a single step but with a limited step per evaluation. The evaluation triggered from the screen, on the other hand, recommends the whole of the distance at once.
• There is a row-based learning lock. If Allow Learning is not checked in a rule row, the value of that row is not changed in the automatic mode; the recommendation is still seen and can be applied manually.
• The automatic applications are also written to the user log. The record states that the operation has been done by the system and is in the same form as a manual application.
• Learning runs on a single device in a cluster. While the cluster is active, only the first device carries out the learning and the application; the result is carried to the other one with the synchronization.
• When the recommendation notifications are muted, no evaluation is made at all. The muting does not only turn off the notification, it also stops the Smart Advisor evaluation.
• The three cards read a single evaluation. The strip, the badges on the protection cards and the review window share the same result.
• The reset cannot be undone. Reset to Factory brings the protections down to the monitor mode and deletes every value learned.