techlist.io
KREN
cloudflare

Cloudflare Client-Side Security: smarter detection, now open to everyone (opens in new tab)

llmmachine-learningjavascriptabstract-syntax-treeclient-side-securitygraph-neural-networkcontent-security-policynpm-packages

Cloudflare is making its Client-Side Security Advanced product self-serve and offering domain-based threat intelligence free to users of its basic bundle. The service detects malicious browser-side JavaScript through browser reporting, AST-based behavioral analysis, and a new LLM review layer. Its goal is to catch sophisticated skimming attacks while reducing false positives and avoiding performance impacts on customer applications.

Growing Threat of Client-Side Attacks

  • Browser skimmers can steal credentials, payment data, and personal information without disrupting page loads or checkout flows.
  • Recent examples include:
    • A browser keylogger placed on a major U.S. bank’s employee merchandise store.
    • Malicious npm package releases capable of enabling browser-based crypto theft when bundled into front-end applications.
  • These attacks often exploit trusted first-party or third-party scripts rather than obvious server vulnerabilities.

Broader Access to Client-Side Security

  • Client-Side Security Advanced, formerly the Page Shield add-on, is now available to self-serve customers.
  • Domain-based threat intelligence is complimentary for customers using the free Client-Side Security bundle.
  • Advanced capabilities include:
    • Machine-learning and LLM-assisted malicious script detection.
    • Continuous code-change monitoring for compliance requirements such as PCI DSS v4.0 requirement 11.6.1.
    • Proactive positive security rules maintained through ongoing monitoring.

Browser-Based Monitoring Without Application Changes

  • Cloudflare evaluates approximately 3.5 billion scripts per day, with enterprise zones averaging about 2,200 scripts.
  • The system gathers signals through browser reporting mechanisms such as Content Security Policy.
  • Customers do not need scanners or application instrumentation.
  • Traffic must be proxied through Cloudflare.
  • The approach adds no latency to web applications.

Detecting Script Intent

  • Enterprise sites may contain thousands of scripts, and roughly one-third change within a 30-day period.
  • Manually approving every DOM interaction or outbound connection would create excessive operational overhead.
  • Cloudflare instead analyzes what scripts are attempting to do.
  • JavaScript is represented as an Abstract Syntax Tree (AST), allowing the system to identify behavioral patterns even when code is minified, renamed, or obfuscated.

Reducing False Positives

  • Client-side compromises are relatively rare but potentially severe, unlike the high-volume attacks typically handled by a WAF.
  • Because genuine incidents are uncommon, even accurate detection systems can produce more false alarms than real alerts.
  • False positives contribute to security-team fatigue and can obscure actual compromises.
  • Legitimate but heavily obfuscated code—such as bot challenges, tracking pixels, advertising bundles, and minified frameworks—can resemble malicious code structurally.

GNN and LLM Detection Pipeline

  • Cloudflare’s primary detector is a Graph Neural Network (GNN) operating on JavaScript ASTs.
  • The GNN learns structural representations of code and can recognize similar behavior despite syntactic changes.
  • It is optimized for high recall to detect novel and zero-day threats.
  • Although fewer than 0.3% of analyzed traffic is incorrectly flagged, Cloudflare’s scale makes that percentage a significant number of alerts.
  • An LLM provides semantic context, recognizing common JavaScript frameworks, domain-specific coding patterns, and benign forms of suspicious-looking obfuscation.
  • The LLM complements rather than replaces the GNN:
    • Scripts classified as benign stop after the fast GNN evaluation.
    • Scripts exceeding the GNN’s risk threshold are sent to an open-source LLM hosted on Cloudflare Workers AI for a second opinion.

Cloudflare’s approach combines low-overhead browser telemetry, structural machine learning, and semantic LLM review. For organizations handling payments or sensitive user data, enabling these controls can improve visibility into third-party scripts, detect unexpected code changes, and reduce the chance that false alarms overwhelm security teams.