Airlock Anomaly Shield

As of release 7.6, Airlock Gateway includes Airlock Anomaly Shield (AAS), an unsupervised machine-learning-based anomaly-detection capability. AAS is a licensed feature that detects anomalies in the web traffic of applications protected by Airlock Gateway.

The Airlock Anomaly Shield is configured and trained individually for each protected application to ensure precise, application-specific detection. During training, it builds a behavioral baseline of normal web session traffic. Once active, it continuously analyzes incoming requests to identify deviations from this baseline in real time. These anomaly insights are evaluated by the enforcement logic in combination with configured detection patterns, enabling targeted and context-aware responses at the session level.

Airlock Anomaly Shield provides session-level behavioral analysis to complement the request-level inspection of the Security Gate core process, enhancing overall detection capabilities.

Airlock Anomaly Shield is based on unsupervised machine learning models that learn normal application behavior directly from historical web session traffic. This approach allows the system to establish a behavioral baseline without requiring predefined rules or labeled data.

Recent enhancements include support for automatic retraining, enabling the models to continuously adapt to evolving application behavior over time.

For initial model setup, a training phase is required:

Once the baseline is established, Airlock Anomaly Shield continuously evaluates session behavior, identifies anomalies, and enables appropriate actions based on detected deviations.

Because anomaly detection is based on aggregated session behavior, assessments become available only after a sufficient number of requests have been observed. This results in a short, inherent delay at the start of a session. In practice, this delay has minimal impact, as evaluation is performed at the session level rather than per request.

To ensure optimal performance, anomaly evaluation is executed asynchronously from request processing. This design allows the Security Gate core process to handle incoming traffic without waiting for assessment results, maintaining high throughput even under heavy load.

Anomaly evaluation is computationally intensive and may continue while new requests are being processed. Incoming request data is automatically incorporated into subsequent evaluation cycles, ensuring continuous and up-to-date analysis of session behavior.

Airlock Anomaly Shield is configured and managed per Anomaly Shield application. An application definition can be reused across multiple mappings, while each mapping is associated with at most one application definition. For details, refer to Assigning mappings to Anomaly Shield applications.