Semantic WAF vs Regex Signatures: Why Pattern-Only Detection Misses Modern Attacks
Regex signatures match strings; semantic analysis understands structure. Here is why signature-only WAFs both over-block and under-detect, and what to do instead.
Picture a customer searching your store for "O'Brien's 1-for-1 deal." A classic regex WAF takes one look at that apostrophe and the 1s and throws a 403 — it's seen enough SQL injection to get twitchy. Meanwhile a real attacker, who rewrote their payload with comments and odd encoding so the exact bytes no longer match any signature, sails straight through.
That's the signature-only WAF in a nutshell: it blocks the shopper and waves through the attacker. It fails in both directions at once, and it's been doing it for about twenty years.
Why strings aren't enough
A signature asks one question: does this text contain these characters? Attackers have had two decades to answer "not anymore." Swap the casing, inject comments, re-encode, pad with whitespace — the meaning of the payload is untouched but the bytes have moved, and the pattern never understood the meaning in the first place. It couldn't tell your customer's apostrophe from an injection, because to a regex they're just characters.
What "semantic" buys you
Semantic analysis asks a better question: what is this input? Does it parse as a SQL expression? A shell command? A template? A path that climbs out of its directory? Once you're reasoning about structure instead of substrings, an obfuscated payload still looks like the injection it is, and a quoted sentence looks like a sentence.
WAFio leans into that with 20 semantic engines — SQL, XSS, command and PHP/Python injection, LFI, SSRF, Java, LDAP, NoSQL, prototype pollution, SSTI, XXE, deserialization, open redirect, header injection, prompt injection, GraphQL and JWT abuse. None of them gets to rule on its own; each one contributes evidence.
And no, regex isn't dead
Let's be fair: this isn't "signatures bad." The OWASP Core Rule Set is a genuinely great body of knowledge, and some attacks really are best described as a pattern. The trick is not choosing one camp. Use both — semantic engines for structure and intent, CRS for the known stuff — and feed them into a single decision.
That's how WAFio is wired. Coraza runs CRS in detection-only mode, and a central decision engine is the only thing that says Block, Log or Allow, based on score thresholds you set per project. Signatures get a vote. They don't get the final word.
Fewer false positives, and you stay in control
Because the verdict comes from weighing evidence against a threshold, tuning means turning dials, not playing whack-a-mole with individual rules. Dial a project's sensitivity up or down, move the block and log thresholds, or scope an exception to one path — all without going blind to an entire class of attack. That last bit matters: the usual way people "fix" false positives is to delete the rule that fired, and then quietly lose coverage they'll miss later.
What it adds up to
You catch obfuscation that string matching sleeps through, because you're reading structure. You block less legitimate traffic, because intent drives the score instead of coincidence. And every decision keeps the signals that fired and the context around them, so when someone asks "why did we block this?", you have an answer instead of a shrug.
Want the full argument? Read Why Semantic Scan, dig into the Semantic WAF feature, or just watch it make calls in the live demo.