Behavioural signals vs static rules: what a firewall can actually observe

A static rule is a sentence written in advance: “Slack may reach slack.com”, “nothing may reach this address”. Rules are precise and predictable, and they are the backbone of any firewall. Their weakness is that they only know what their author thought of. A trusted app that is updated with a malicious library, or starts talking to a new server at 3 a.m., still matches “allow Slack”.

Behavioural detection adds a second question: is this normal for this app? NIST’s guide to intrusion detection and prevention (SP 800-94) calls this anomaly-based detection, and contrasts it with signature-based detection, which looks for known-bad patterns. Both have a place. Signatures catch what is already known with few false alarms; anomalies can catch the new, at the cost of more false alarms.

What a network firewall can observe

A firewall sits on the connection, so it sees who connects, where, when, and how much. From that it can derive useful behavioural signals:

• A destination this app has never contacted before, or a country it has never talked to.
• Connections at unusual hours, or to unusual ports.
• An unusually large upload, the pattern of data being sent out (MITRE ATT&CK T1041).
• An app with no valid code signature, or one whose signature is broken.
• A destination on a threat list, a Tor exit, an open proxy, or a name that looks machine-generated or imitates a known brand.
• Timing coincidences, such as a first connection seconds after the clipboard changed, the moment clipboard stealers wait for (MITRE ATT&CK T1115).

What it cannot observe

Just as important is knowing the boundary. A network firewall does not watch files, so it cannot see an app encrypting documents on disk, the classic sign of ransomware; that is the job of endpoint detection and response tools and backups. It does not see what an app does in memory, which processes it launches, or what it reads from the clipboard. It also cannot read inside an encrypted connection without decrypting it, which brings its own risks. A firewall that claimed otherwise would be promising something it cannot deliver.

How FireAI combines weak signals

FireAI adds these signals up in a correlated risk score out of 100, shown in Investigate with every reason listed. Each factor carries a weight: a confirmed threat-list hit or a broken signature counts heavily, a first connection to a new place or night-time activity counts lightly, and some facts lower the score, such as a destination that belongs to a well-known company or an Apple system binary. The total maps to a level (low, elevated, high, critical), so one weak signal stays low while a real combination stands out.

Two design choices keep this honest. First, the score is explained: every factor is listed, so you can disagree with it. Second, the score on its own is advice, not a hidden verdict: FireAI blocks automatically only what your rules and security mode say, what a threat list you turned on actually confirms, or what Autopilot decides when it is confident, and every one of those Autopilot decisions becomes a visible rule you can undo (lesson 4). The score helps you decide; you keep the last word.

A worked example

Imagine two connections at 3 a.m. The first comes from a signed web browser, reaching a well-known company it contacts every day. The second comes from a small unsigned program that has never connected before, reaching a name that looks machine-generated in a country the Mac has never talked to, and uploading far more than it downloads. Each fact about the second connection could be innocent on its own: developers run unsigned tools, people travel, backups upload. Together they tell a very different story from the first connection.

That is the core of behavioural detection: individual signals are weak and noisy, and value comes from how they combine. It is also why an explanation matters. If a tool only said “high risk”, you could not tell whether it saw the unsigned binary, the upload or the hour. When every reason is listed, you can check the one you are unsure about, and you learn what normal looks like on your own Mac.