Telemetry That Learns: How ONX Strengthens the Class Prior
Every protected site generates operations signals. ONX uses verified ones to strengthen the prior for the same class of PHP application.
Every protected site generates operations signals. ONX turns verified ones into a stronger prior for the same class of application — hotel, municipality or shop.
Security cannot rely only on what has already been seen. The harder problem is the first appearance of a new attack — or an attacker deliberately modifying their behavior to remain just below known detection thresholds.
ONX addresses this with behavioral telemetry. Instead of relying exclusively on signatures and known attack patterns, ONX continuously analyzes behavioral characteristics of incoming traffic and generates privacy-preserving security telemetry.
The result is a feedback loop:
Traffic → Behavioral signals → Intelligence → Verified learning → Better protection
And importantly, the system is designed so that the network can improve from operations signals under a GDPR-first DPA — not from a copy of every visitor request.
Every Request Leaves a Footprint
Every ONX agent evaluates incoming requests in real time and derives an anomaly score from behavioral signals. These signals can include characteristics such as:
- header completeness
- request velocity
- path and URI characteristics
- parameter structure
- request-method patterns
- navigation rhythm
- request diversity
- behavioral consistency
The objective is not to centrally collect everything a user sends. It is to understand how the request behaves.
The telemetry leaving the protected environment is a compact security representation rather than a copy of the original request. Depending on the signal, this can include:
- a numerical anomaly score and associated detection reasons
- a normalized URL with variable identifiers replaced by placeholders
- parameter names rather than parameter values
- a privacy-preserving representation of the source address
The security system learns from the behavior of traffic without needing the contents of that traffic.
Privacy-First Is an Architectural Principle
Telemetry systems can easily become shadow logs of user behavior. ONX is designed around the opposite principle: collect the minimum information required to run protection.
That means:
- No centralized payload storage — POST bodies, cookies and authorization headers are not part of the centralized behavioral telemetry.
- No unnecessary mirroring of normal traffic — benign traffic can be statistically sampled rather than continuously replicated.
- Minimised telemetry — operations signals are reduced before they reach the EU console.
- Controlled retention — where temporary near-miss telemetry is retained for analysis, it is processed with privacy controls and subject to defined retention limits.
The goal is straightforward: the class prior should improve from attacks without becoming a database of people’s activity.
From Scores to Intelligence
Telemetry by itself is only data. Its value comes from aggregation, verification and learning.
ONX aggregates behavioral signals into security profiles that can describe characteristics such as request rates, URI diversity, HTTP method distribution, parameter structure, behavioral consistency, source reputation and anomaly patterns.
These signals can then be combined with confirmed security events and operator feedback. The learning loop is simple:
[ ONX agents analyze traffic ]
│
▼
[ Privacy-preserving telemetry ]
│
▼
[ EU console — operations review ]
│
▼
[ Verified attack / false-positive labels ]
│
▼
[ Model evaluation & retraining ]
│
▼
[ Improved detection and protection ]
Every confirmed attack provides information about what malicious behavior looks like. Every correctly identified false positive provides information about what legitimate behavior looks like. Both are valuable.
Learning Is Not Enough. It Must Be Verified.
A security model should not automatically control production traffic simply because it produces a high anomaly score. ONX therefore treats behavioral enforcement as a controlled process.
Models are evaluated against verified data before their signals are used for automated enforcement. The principle is:
Detection first. Validation second. Enforcement third.
Where behavioral enforcement is enabled, ONX can use graduated responses rather than immediately locking users out. For example, suspicious traffic can be slowed or challenged while operators retain the ability to review and recover from false positives.
This creates an important safety property: the system can become more aggressive without making false positives irreversible.
Endpoint Profiles: Normal Is Different for Every Application
There is no universal definition of normal web traffic. A booking engine behaves differently from a corporate website. An API behaves differently from an online store. A login endpoint behaves differently from a public content page.
ONX therefore builds behavioral context around the protected application and its endpoints. The system can learn characteristics such as:
- which parameters normally appear on an endpoint
- which HTTP methods are expected
- how frequently an endpoint is accessed
- how requests are distributed
- how users normally navigate between endpoints
A request that looks completely normal on one endpoint can therefore look highly unusual on another. Context matters.
ONX doesn’t only ask: “Does this request look malicious?” It can also ask: “Does this request make sense here?”
From One Reviewed Incident to a Stronger Class Prior
When a pattern is confirmed as malicious, it does not have to stay useful only on the site where it was first seen.
A reviewed signal can strengthen the prior for the same class — another hotel, municipality or shop — after an operator has labeled it. That is slower and more honest than promising instant network-wide immunity.
The network learns from operations signals under a DPA, not from a copy of every visitor request. The next site in the class starts warmer than empty.
A Continuous Security Feedback Loop
The architecture creates a continuous learning cycle:
- Observe. ONX analyzes incoming traffic and derives behavioral signals.
- Detect. Anomalous behavior is identified and correlated with other security signals.
- Verify. Security events and false positives are reviewed and labeled.
- Learn. Verified signals contribute to model evaluation and retraining.
- Improve. A verified label can strengthen the class prior for the next site.
- Repeat. Every new event becomes another opportunity to improve the system.
This means ONX is not a static rule list. The class prior can improve when operators review what the origin actually saw.
The Numbers
These numbers represent a design choice: the class prior should improve faster than the amount of visitor data you have to send.
The Takeaway
A WAF that only blocks attacks is a barrier. A WAF that learns from attacks becomes something more powerful.
ONX turns endpoint telemetry into a feedback loop: the origin decides, the EU console records what operators need, and a verified label can improve the class prior. GDPR scope is agreed in the DPA.
No copy of every visitor request. Sampled operations data. Reviewed labels. A warmer start for the next hotel, municipality or shop.
The origin decides. The class prior can learn.
ONX stays in the EU.