Stop updating the thresholds if training mode is turned off - #34
Stop updating the thresholds if training mode is turned off#34symstu-tempesta wants to merge 1 commit into
Conversation
While the training_mode is 'off' the thresholds still updates and could generate false positives because of the lack of the data #16
krizhanovsky
left a comment
krizhanovsky
left a comment
There was a problem hiding this comment.
The patch fixes off mode, but not historic mode
| @@ -213,10 +213,6 @@ async def _update_threshold_and_block_users(self): | |||
| Periodically run the detectors, identify risky users, and update | |||
There was a problem hiding this comment.
Please update the copyrights of all the changed files
| detector.update_threshold(users_before) | ||
|
|
||
| if self.context.app_config.training_mode != 'off': | ||
| detector.update_threshold(users_before) |
There was a problem hiding this comment.
This switched off thresholds update only for TRAINING_MODE="off", but historical mode being trained for a period in the past, still updates the thresholds with moving window. This actually almost fully remove the difference between historical and real modes.
Also the documentation also still has issues:
WebShield can learn your normal traffic in historical or real modes or just use predefined thresholds in no training mode.
means that off uses predefined thresholds, but immediately under the configuration sample the doc says
In this mode standard deviation and mean are determined using sliding window with time offset and duration
3 participants
While the training_mode is 'off' the thresholds still updates and could generate false positives because of the lack of the data
#16