When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Cloudflare's Client-Side Security employs machine learning to identify malicious JavaScript operations that traditional security scanners are likely to overlook. This model successfully flagged eight malicious payloads that went undetected by other tools like VirusTotal and URLScan. The ability to detect these threats in real-time is crucial for storefronts, where any delay can result in financial losses.

The approach utilizes a graph neural network (GNN) to analyze JavaScript code structure, which allows it to identify suspicious patterns even when the code is obfuscated or minified. This deep analysis is critical, as it enables the detection of attacks that may not have a universal signature. Traditional scanners typically rely on known signatures, which limits their effectiveness against novel or evolving threats.

Cloudflare's model incorporates a feedback loop where human reviewers can contribute to training the GNN, enhancing its ability to discern increasingly complex threats. The use of a lightweight large language model (LLM) provides a second opinion on flagged scripts, which helps minimize false positives while maintaining high detection rates. This dual-layer approach improves overall security and confidence in the alerts generated.

While this technology significantly strengthens security measures, it may not be foolproof against all forms of attack, particularly if attackers adapt their methods. Continuous updates and refinements to the machine learning algorithms will be necessary to keep pace with emerging threats. Additionally, the reliance on automated systems may introduce challenges in interpreting results and managing alerts effectively.