CloudflareJuan Miguel Cejuela21 min readintermediate
When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
Summary
Cloudflare’s Page Shield uses a graph‑neural‑network (GNN) to model JavaScript as a syntax‑tree graph, followed by a lightweight LLM for second‑opinion triage and an ensemble of frontier models for deep analysis. This pipeline caught eight malicious payloads across four distinct affiliate‑theft and backdoor techniques that traditional scanners missed, demonstrating the need for runtime, behavior‑…
- The GNN treats JavaScript as a graph of AST nodes, enabling detection despite minification, renaming, or light obfuscation.
- Only ~0.3 % of traffic is flagged by the GNN; flagged scripts are then vetted by an LLM on Workers AI to keep false positives low while preserving recall.
- A “teacher” ensemble of frontier models runs each suspicious script in isolated sessions, can execute small snippets, and votes on a label weighted by an AI‑model leaderboard score.
- Detected campaigns included after‑hours affiliate hijacking, clickless iframe theft, a backdoor that loads remote code, and a mobile cloaker that disables analytics – all evading VirusTotal and URLScan.
Traditional static scanners miss many client‑side attacks because they rely on known hashes or signatures. By modeling code intent and behavior at scale, Cloudflare’s approach can surface novel, targeted threats in live traffic, protecting e‑commerce revenue and user privacy before the malicious co…
6/10
