How It Learns

What Is How It Learns?

How It Learns reduces the current definition of the learning into a single sentence: it writes looking at which history the engine learns and whether what it learns is submitted for approval or is applied on its own. In short, it answers a single question: how is the engine working right now?

It is not a result surface; it is the summary of the settings. It does not say how many rules have been reviewed or how many recommendations are waiting, and it does not start an operation either: the numbers belong to the counters in the upper band of the Learning strip and the actions to the other two cards. On the other hand it is the door of the learning settings: when the card is clicked, the editing window opens.

The content of the sentence is produced entirely from the configuration. It does not look at the current data of the engine, at how many rules it has reviewed or at which result it has reached; for this reason the card is full even if the evaluation has never run.

The whole card is clickable

When anywhere on the card is clicked, the editing window of the learning settings opens; the pencil icon at the bottom right corner is only a mark stating this, it is not a button on its own. The same window is also opened with the AI Learning Settings → link in the upper band of the strip. Detail: AI Learning Settings.

The How It Learns Card in the Learning Strip

The card is the one on the left among the three cards in the body of the strip. At the top the title and the icon, in the middle the sentence explaining the learning, at the bottom the name of the current mode and the pencil icon are located.

The Learning Strip - The How It Learns Card

The anatomy of the card:

Section	What it shows
Title	How It Learns and the setting icon.
Sentence	The current definition of the learning. The history window (in the automatic mode the period value as well) is written highlighted; there is no highlight in the sentence in the off mode.
The name of the mode	At the bottom left of the card, the name of the selected Learning Mode value: Learning Off, Smart Advisor or Automatic.
Pencil icon	At the bottom right; it states that the card opens the editing window.

The Three States of the Sentence

Mode	Sentence
Smart Advisor	Learning from the last <window>; suggestions are offered to you, never applied on their own.
Automatic	Learning from the last <window>; what it learns is applied on its own (<period>).
Learning Off	Learning is off — no suggestions are produced for this route table.

If the learning setting has never been saved, the sentence is read in the Smart Advisor form; this is the default mode without a save as well.

The duration in the sentence may not be the same as the window the engine uses

The value written in the sentence is the value entered into the settings window. The engine rounds this value to a grid with five steps and in fact reads a window of 3 days, 1 week, 2 weeks, 1 month or 2 months.

The rounding works in two directions: behind a card that says "the last 3 weeks" the window the engine reads is 2 weeks, and behind a card that says "the last 5 days" it is 1 week. All of the steps are given on the AI Learning Settings page.

The card stays in place while learning is off

While the mode is Learning Off, the card does not disappear; only its sentence and the name of the mode change. The pencil icon and the clickability are preserved as well.

The "no suggestions are produced" expression of the sentence describes the background work. Since the screen's own evaluation runs in this mode as well, the counters on the strip and the other two cards are seen full again.

What Does the Engine Read?

The sentence of the card describes the configuration; the work the engine does in the background is more detailed. The evaluation is carried out separately for every rule and passes through the steps below:

Step	What is done
Data collection	From the measurement file of the rule, the value of the busiest source, the upper slice of the source distribution and the number of active sources are read. The number of dropped packets is taken from a separate measurement file. The limit in force, on the other hand, is read not from the measurement but from the rule's own record; thus the engine does not see the old value right after a limit is changed.
Resolution	The data is always placed into hourly buckets. Since the engine builds a model according to the hour of the week, this resolution cannot be adjusted from the interface.
Sufficiency check	If there are fewer than eight valid samples in the measurement of the rule, the rule is not taken into the evaluation. It is not taken if there is no measurement file at all either.
Maturity check	If the duration the data covers is not enough, the result is considered a preliminary evaluation and its recommendation never becomes applicable.
Attack exclusion	The parts of the traffic with an attack are separated and are not taken into account. The decision is made by looking at three criteria: the deviation of the value from the normal band, how much the busiest source separates from the crowd and the sudden increase in the number of sources. For a slice to be considered an attack, at least two criteria have to speak at the same time.
Base value	From the cleaned traffic, a base is calculated according to the hour of the week. The hours with few samples are pulled towards the average of the same hour of the day and of the general distribution; thus the noise in a single hour does not spoil the base. The highest hour of the week is taken as the basis.
Limit recommendation	The base is multiplied by a safety margin and is rounded to a readable number. The result cannot go below the lower bound of the rule defined in the catalog.
Back-test	The recommended value is tested against the clean traffic learned. If the limit is being pulled down and the new value is going to block more than what is accepted from the legitimate traffic, the recommendation is withdrawn.

The downward and the upward directions look at different criteria

The narrowing of the limit depends on the back-test: if the recommendation cuts more of the clean traffic learned than what is accepted, it is rejected. If there is no traffic at all in the window, the narrowing is withheld anyway; the engine does not draw the conclusion "it came out clean" from an empty window.

The loosening of the limit, on the other hand, is evaluated not with the back-test but with evidence. The evidence the engine looks for is as follows: the window not having been polluted too much with an attack, a real growth being seen in the clean traffic, the limit in force cutting the legitimate traffic or the gap remaining below the limit having actually been filled.

The engine does not recommend a big change in a single step

While there is a limit in force, the value is moved only a limited step in every evaluation; the recommendations close to the current value, on the other hand, are not produced at all, the rule is considered "does not need to be changed". In the loosening direction the step is not a fixed percentage but a fraction of the difference remaining to the target: as the difference grows the step grows as well, but it does not exceed the value learned.

If the rule does not have a limit yet, the step limit does not operate; the first value is recommended directly as the value learned.

The only exception of the step limit is an evident congestion: if the limit in force blocks a large part of the clean traffic and there is no notable attack in the window, the engine goes up to the value learned in a single step.

The attack exclusion checks itself as well

If more than half of the window is marked as an attack as a result of the exclusion, the engine considers this result unreliable: it preserves the labeling of the previous round and, marking the rule as uncertain, rejects its recommendation. When the normal traffic and the attack traffic cannot be separated, instead of guessing a number the decision is left to the administrator.

If the counter contradicts the measurement, the engine freezes the value

If the observation series reads a flat zero while the drop counter of a rule is running, the engine considers this contradiction a measurement problem: it does not change the limit and marks its recommendation as inapplicable.

A rule not taken into the evaluation does not fall off the list

A rule that has no measurement or that has not accumulated enough samples is not removed from the result list. For these rules the engine puts the default value in the catalog as an informational starting recommendation and considers the result a preliminary evaluation: the rule is seen on the cards and in the badges, but its recommendation does not become applicable.

The Screen the Card Opens

When the card is clicked, the Learning Settings window opens. The window carries only the learning settings; the data the engine reads, the calculation steps or the graphs are not found in this window.

The Screen the How It Learns Card Opens

All of the fields are explained on the AI Learning Settings page.

How the calculation of a rule is made is read not from this card but from the evaluation window opened by clicking the badge in the row of that rule; there the justifications and the derivation steps are written item by item.

Scope and Limits

INFO

• The card does not show a measurement. Its content is produced entirely from the configuration.
• The duration in the sentence is the value entered, not the window the engine reads.
• The card is seen in every mode, while learning is off as well.
• The whole card is clickable and it opens a single window.
• The engine works with an hourly resolution and this cannot be adjusted from the interface.
• A rule that has fewer than eight valid samples in its measurement is not taken into the evaluation; a rule that has no measurement file is not taken either. These rules do not fall off the list, they continue to be seen with an informational starting recommendation.
• A result that has not matured enough is a preliminary evaluation and its recommendation is inapplicable.
• The limit in force is read from the configuration record, not from the measurement file.
• A rule closed to learning is nevertheless evaluated. The engine produces a result for it as well and shows its badge; only, no application path can write that rule.
• The evaluation is read-only; this card does not change any setting.