A WAF that operates based on a blacklist (negative security model) protects against known attacks. Conversely, a WAF based on a whitelist (positive security model) only admits traffic that has been pre-approved. Both blacklists and whitelists have their advantages and drawbacks, which is why many WAFs offer a hybrid security model, which implements both. \r