Web Security Trends

Reading time: About 4 minutes

The Web Security Trends page shows a hostname’s overall traffic distribution, attack trends, and commonly used security analysis statistics, helping you quickly understand its current security status and protection effectiveness.

On this page, you can obtain the following key information:

• View the overall traffic distribution to understand how the protection platform detects and blocks each type of traffic
• View Top statistics for requests that triggered a security policy, to identify frequently triggered access behavior
• View the security policies and rules with the highest hit counts, to help pinpoint the main sources of protection and risk types

Path: Analysis & Logs > Web Security Trends

Metrics

Request Trends

Shows how the hostname’s traffic changed over the selected time range. You can view it by either Requests or Average Request Rate, allowing you to analyze traffic changes from both a total-volume and a rate perspective. The chart is divided into two sections:

The upper section shows overall request metrics, including:

• Total Requests: The number of all requests that passed through a protection node
• Attack Requests: The number of requests identified as attacks, including requests currently being mitigated or monitored
• Whitelisted Requests: The number of requests that matched the whitelist and were allowed through

The lower section shows the distribution of attack requests triggered by each type of security policy, including:

• IP/Geo Firewall
• DDoS Protection
• WAF
• Bot Management
• API Security
• Threat Intelligence
• Rate Limiting
• Custom Rules

Top Attack Targets

Quickly pinpoint which specific hostname or path was under attack.

Top Policies Triggered

Shows the number of requests detected by each type of security policy.

Top Attack Sources

Shows the client IPs and source countries/regions that sent the most attack requests.

Top Rules Triggered

Shows the specific rules with the highest hit counts, so you can quickly identify which rules play the biggest role in your current protection and evaluate their effectiveness.

We recommend paying particular attention to rules with an unusually high proportion of monitored requests: this means the rule is set to Log mode but has a high hit count, which could result in insufficient protection. Click the View Logs button next to the corresponding rule to analyze the request characteristics in the logs, then further evaluate whether the related security policy needs adjustment.

User-Agent / Referer Top 10

Helps identify the characteristics of attacking clients.

We recommend paying particular attention to feature values with an unusually high request proportion, since this usually indicates that a particular type of client or behavior pattern is abnormal, providing an important basis for further investigation.