Skip to main content
Flarehawk’s ML detection layer runs an ensemble of models on every analysis batch for Complete tier domains. Each analysis window is scored across multiple model types, and those scores are combined into a single ensemble anomaly score with an associated confidence value. When that score exceeds the domain’s adaptive threshold, Flarehawk generates an alert that tells you not only that something is wrong, but which traffic features drove the anomaly.
ML anomaly detection is available exclusively on Complete tier domains. Basic tier domains run the 25 statistical and behavioral rules only. To enable ML detection for a domain, upgrade it to Complete in Settings → Domains.

​
What the ML layer detects

The ensemble is designed to catch threats that no single statistical rule can surface on its own:
Learns what normal traffic looks like across multiple dimensions simultaneously. When traffic deviates from the learned pattern — for example, an unusual combination of IP diversity, error rates, and path entropy — an alert is raised with attribution showing which traffic dimensions were anomalous.
Analyzes sequences of traffic over time to learn normal cadence patterns — morning ramp-ups, overnight quiet periods, weekly rhythms. Flags sequences that break these patterns, catching attacks that unfold gradually such as slow-rate credential stuffing or low-and-slow DDoS ramp-ups.
Models relationships between traffic entities (IPs, paths) to detect coordinated attacks from distributed sources that would look innocuous on a per-IP basis — such as bot networks or scanning campaigns where multiple IPs probe the same set of paths.

​
Ensemble scoring

Individual model scores are combined by a meta-learner that applies adaptive weights and produces a single ensemble anomaly score between 0 and 1. The meta-learner weights each model’s contribution based on its recent performance for your specific domain. An ensemble alert fires only when the combined score crosses the adaptive threshold — requiring corroborating signals before raising a high-confidence alert.
The ensemble alert (ensemble_meta_anomaly) is the highest-confidence ML detection signal. If you receive one, treat it as a strong indicator of a real anomaly and investigate promptly.

​
How ML and statistical rules work together

Statistical and ML rules run in parallel on every analysis batch:
  • Statistical rules provide fast signals on well-defined metrics (error ratio, auth failure rate), typically firing within one to two minutes.
  • ML rules provide contextual confirmation by catching broader behavioral changes that accompany attacks — even when individual metric thresholds haven’t been crossed yet.
  • Correlated alerts from both layers on the same domain within a short time window are a strong indicator of a significant event.

​
Confidence scores

Every ML alert includes a confidence value from 0 to 1 representing how strongly the ensemble agrees on the anomaly. Higher scores indicate stronger model agreement and warrant more immediate attention.

​
Model adaptation

Models update continuously as your traffic evolves — no manual retraining or redeployment needed. If you make a major change to your application or infrastructure, you can manually reset the ML baseline in Settings → Detection → Reset ML Baseline, which restarts the calibration period.