The cloud uses supervised learning to train millions of samples, extracts threat detection models, and delivers the models to firewalls for detection. Cloud Sample Training (Supervised Learning).The detection models used by the intelligent detection engine come from the following: Well, what is the implementation? AI firewalls are intelligent, as evidenced by the embedded intelligent detection engine which detects advanced threats based on a threat detection model created through machine learning. AI Firewall Detection of Advanced ThreatsĪs mentioned above, AI firewalls can detect advanced threats.

The AI firewall must provide dedicated hardware for intelligent detection computing to improve threat detection performance. However, higher requirements are imposed on computing hardware in order to maximize this newly introduced intelligent detection technology. The AI firewalls not only leverage signatures to mechanically identify known threats, but also use a large number of samples and algorithms to train threat detection models, enabling detection of advanced and unknown threats. The main advantage of AI firewalls lies in intelligence. The following table lists the major differences between Huawei AI firewalls and NGFWs.Ĭapability comparison between NGFWs and AI firewalls However, there is no standard industry definition of next-generation NGFW product. As mentioned above, NGFWs need to be upgraded, and vendors are embracing new technologies to enhance firewall functions. The main NGFW capabilities defined by Gartner are application identification and IPS integration for in-depth traffic detection.

Differences Between AI Firewalls and NGFWs In addition, the automatic handling technology is introduced to automatically commission policies and analyze threat traffic, relieving the pressure on O&M. They use machine learning and in-depth learning to build threat detection models, greatly improving the accuracy and timeliness of threat detection. Huawei has launched AI firewalls that leverage intelligent detection technology. In this regard, the development of AI technologies brings new opportunities for firewalls. To sum up, NGFWs must be upgraded to cope with the continuous evolution of networks and threats. Firewalls must have automated data analysis and threat handling capabilities. However, these tasks depend on the skill level of administrators and are complex, and the effect cannot be ensured. Administrators need to continuously tune policies to cope with changing threats, analyze attack logs, promptly handle threat events, and strengthen enterprise facilities.

Threat handling is labor intensive and time consuming.Īs firewall deployment is not a one-time operation, follow-up O&M is critical.

The firewalls must be able to analyze data from all aspects without decrypting the data, so that any threats can be exposed. Using signatures to match against traffic cannot extract the features of such encrypted traffic. Most threats are hidden within encrypted channels. In addition, threats are becoming more covert. As a result, the NGFW cannot accurately mitigate attacks. The NGFW matches packet content against signatures and cannot identify the entire kill chain process. Hackers infiltrate from the outside, gain remote control, spread to the inside, steal, and destroy important data, forming a complete kill chain. According to statistics, the number of threats from the intranet increases significantly, indicating that the attacks are not limited to the external network. The popularization of IoT brings more security threats.

Multi-layer, three-dimensional, and more covert threats occur, and systems are unable to mitigate the entire kill chain through signature matching.

This leads to the high false positive rate of threat detection and delayed threat response. The signature database cannot detect unknown and variant advanced threats. Signatures in a signature database describe known threats and the database has a limited capacity. Signature-based threat detection relies on signature databases (static rule databases).

Signature-based threat detection cannot cope with advanced and unknown threats.

Facing the rapidly changing threat types, traditional NGFWs must address the following challenges: Advanced threats are more covert and spread faster, and up to 70% of network attack traffic is encrypted. As a result, attacks such as ransomware and M2M attacks are becoming increasingly diversified, due to huge economic benefits. As shown in the preceding figure, in addition to traditional threats such as viruses and Trojan horses, advanced threats, for example, advanced persistent threats (APTs), are constantly evolving.

Ai firewall builder