Analyze Request Traffic

Reading time: About 5 minutes

When an attack successfully bypasses your existing defenses, the Request Traffic module provides the key data you need for retrospective analysis. This module keeps a complete real-time and historical view of all HTTP requests — including requests that were not detected by your current security policies — helping you accurately identify abnormal access patterns, analyze suspicious traffic sources and behavior in depth, and use these findings as the basis for creating new protection policies.

Path: Analysis & Logs > Security Analysis > Request Traffic

Attack Analysis Workflow

Step 1: Select Your Analysis Target

1. Locate the Attacked Hostname

When you need to quickly confirm which hostname is under attack, you can locate it as follows:

• Check real-time alerts: Security alert notifications directly identify the attacked hostname. Go to Analysis & Logs > Alert Management, and configure system-defined or custom alert rules based on your business needs
• Check Web Security Trends: Go to Analysis & Logs > Web Security Trends and check the Top Attack Targets ranking to quickly identify where attacks are concentrated

2. Select a Hostname to Analyze

Security Analysis focuses on in-depth analysis of a single hostname. After opening the page, first select the hostname you want to analyze. Once selected, the page displays that hostname’s traffic for the past 24 hours by default.

Step 2: Analyze Traffic and Threats

1. Review Overall Traffic via Statistical Trends

Traffic Handling and Flow Analysis

The statistical trend chart displays the handling results and trend of the following three traffic types by default:

Multi-Dimensional Traffic Trend Analysis

You can switch statistical dimensions to view the trend for the top five items under the selected dimension, helping you quickly understand traffic distribution and fluctuations along key dimensions:

• Request Info: Host, client IP, country/region, etc.
• Protection Status: security handling action, security policy type

2. Identify Attack Characteristics via Top Statistics

Attack requests typically show identifiable abnormal patterns, such as:

• A high frequency of requests to a specific endpoint (such as a login page or API interface) in a short period of time
• Attack requests originating from a highly concentrated source (clustered IP ranges)
• Requests containing malicious signature strings

The Top Statistics section shows the most frequently occurring values for each dimension, helping you quickly pinpoint anomalies.

3. Adjust the Analysis Scope with Filters

Manually adding filter conditions:

1. Select the time range you want to focus on
2. Click the filter icon, then select a field, an operator, and a condition value to customize which data you Filter or Exclude
   • For example, to filter by client IP: select the field “Client IP”, select the operator “Equals”, and enter the IP address

Quickly filtering via chart legends:
Hover over a data legend in the chart to reveal Filter and Exclude buttons — click one to quickly filter based on that legend’s value.

Tip: Multiple values for the same query field are combined with OR logic; multiple different fields are combined with AND logic.
Example: Adding "Client IP equals 127.0.0.1" AND "Status Code equals 403;404" returns data where the IP is 127.0.0.1 AND the status code is 403 OR 404.

Step 3: Verify Your Analysis Results

Review Sample Logs

After completing your high-level trend analysis, use the Sample Logs section to review the detailed field values of individual requests and further confirm whether a given request is anomalous.

About Log Sampling

To balance data volume with query performance, Security Analysis uses log sampling technology:

If the request volume within the query range is too large, the logs shown are sampled results. You can narrow the scope using filters to display more complete event data.