XSS payload from Reddit used against OWASP ModSecurity Core Rules


Chaim Sanders of Trustwave shared a link to a blogpost with XSS extracted from Reddit’s XSS subreddit. I sat in the train the other day and thought I could kill time by taking a look at the traffic and how ModSecurity and the Core Rules would handle it.

Here is the traffic in question. Apparently, this is only the query-strings containing the attacks. First, I needed to transfer it into usable traffic. For simplicity, I created a bash script with curl calls. Naturally, the quotes and brackets are a bit of a hassle, but I finally got it working with the following loop:

$> N=0;cat reddit_xss_get.txt | while read LINE; do \
  N=$((N+1)); \
  MYLINE=$(echo "$LINE" | \
    sed -e 's/\\"/\\\\\\"/g' -e 's/\([^\\]\)"/\1\\"/g' -e "s/{/\\\{/g" \
        -e "s/}/\\\}/g" -e "s/\[/\\\[/g" -e "s/]/\\\]/g"); \
  echo "echo -n \"N=$N : \""; \
  echo "curl --silent \"http://localhost/index.html?a=1$MYLINE\""; \
  echo "echo"; \
done > run-reddit-css.sh

There are 572 different payloads in the file. When I first ran the resulting script run-reddit-css.sh against my server, I would get about 450 requests in the access log. I tuned the escaping in the loop above a bit and after a few iterations, I got all 572 requests correctly. The script would then look as follows:

echo -n "N=1 : "
curl --silent "http://localhost/index.html?a=1&artistName=and%20courtesy%20of%20Apple%3C/strong%3E%3F%3Ciframe%20src%3D%22http%3A//www.reddit.com/r/xss/new/%22%20width%3D%22643%22%20height%3D%22239%22%20frameborder%3D%220%22%3E%3C/iframe%3E%3Cbr/%3EGood%20job,%20Apple&thumbnailUrl=http%3A//www.fireblog.com/wp-content/uploads/2009/04/xss-threat3.jpg&albumName=XSS%20Exploits"
echo
echo -n "N=2 : "
curl --silent "http://localhost/index.html?a=1&ErrMsg=%3Cimg%20src=%22http://imgur.com/bTkSe.png%22%20/%3E%3CSCRIPT%3Ealert%28%22xss%22%29%3C/SCRIPT%3E"
echo
echo -n "N=3 : "
curl --silent "http://localhost/index.html?a=1&res=');%3C/script%3E%3Ciframe%20width=500%20height=500%20src=//bit.ly/1628nB%3E%3C!--"
...

In order to get useful results, I ran this script against three different setups:

  • ModSec CRS 2.2.9
  • ModSec CRS 3.0.0 (dev) Paranoia Level 1
  • ModSec CRS 3.0.0 (dev) Paranoia Level 2

I usually disable a few rules so the IP repudiation is not taken into account (as I do not want to be locked out of the server after the first couple of requests) and User-Agent curl does not raise any eyebrowes. Here are the Ignore-Rules in question:

# No Blocking via IP repudiation, based on previous requests
SecRuleRemoveById 949100
SecRuleRemoveById 981140
SecRuleRemoveById 981175

# No blocking of scanners based on UA
SecRuleRemoveById 990002
SecRuleRemoveById 913300

With that, I was ready to launch the payloads against my three setups. All went smooth.

We have previously seen CRS 3.0.0 resulting in lower average anomaly scores usually. Here are the averages:

modsec-positive-stats.txt-2.2.9:     51.0979
modsec-positive-stats.txt-3.0.0-pl1: 16.9668
modsec-positive-stats.txt-3.0.0-pl2: 37.2325

If you compare the distribution of CRS 3.0.0 PL1 and PL2, you see that PL2 generally shifts most of the requests to higher anomaly scores. This is clearly visible in the following graph (the detailed stats are attached at the end of the post):

incoming-anomaly-scores-reddit-xss-vs-modsec-3.0.0-pl1and2

So the upcoming Paranoia Mode in the development version of the Core Rules does what it is meant to do: It is more paranoid and brings more alerts.

With CRS 2.2.9, 22 requests (of 572) passed without any alerts. With CRS 3.0.0 on Paranoia Level 1 (default), this number was 65, on PL 2 again 22 requests (which is by hazard the same number as with 2.2.9). So while it is good to see, that around 95% of the attacks were detected, it is not so cool that 5% went undetected.

Which payload was undetected in 3.0.0 PL2?

Format:Line-Number Payload
36 &Ntk=All&Ntx=mode+matchallpartial
112 &as2n32vujas83bn2932g=645492598632
328 &q=xss
333 &utm_source=twitterfeed&utm_medium=twitter
343 &template=en_search_error&postalCode=\\';alert(0)//
345 &blogid=120
366 &p=37
384 &utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+zdnet%2Fsecurity+%28ZDNet+Zero+Day%29&utm_content=Google+Reader
421 &t=2444
423 &source=20121104_final_push_video
426 &v=zTD4CYnm34c
427 &kid=TTB2
430 &v=s_78bk3dZcc
434 &md5=8780800e375e1ec86cb11a076dffcb61
443 &id=11
445 &sDNSLookup=ANY&fDNSLookup=davealger.info
507 &error=catalogue.asp
538 &l-id=gb_category_search
556 &i=WmYmMm28
557 &q=foobar&after=fizzbuzz
559 &gws_rd=ssl
560 &list=PLpr-xdpM8wG-ZTcHhFfAeBthNVZVEtkg9

Looking through this list, it looks that these attacks are not overly aggressive. To say the least. The author of the said list might have looked it through before publishing. There is one exception though, payload on line 343, which is in fact an XSS and I think it should be detected.
If we look at 2.2.9, there is a single difference: The payload #343 was detected (but #446 was not).

Which rules did detect #343 in 2.2.9?

958052 Cross-site Scripting (XSS) Attack
973307 XSS Attack Detected
973335 IE XSS Filters - Attack Detected.

Apparently, these Anti-XSS rules were all evicted from 3.0.0 likely because of too many false positives. Maybe they had some merits after all. I did not look into the rules which passed ModSec 3.0.0 with paranoia level 1, but the idea of that setting is to have less false positives and accept some false negatives instead. So it is likely some XSS payloads went unnoticed.

Let’s return to the rules that triggered alerts:

Rule Summary for CRS 2.2.9

Format:Number-of-Alerts Rule-ID Rule-Message
1 950007 Blind SQL Injection Attack
1 958004 Cross-site Scripting (XSS) Attack
1 958006 Cross-site Scripting (XSS) Attack
1 960209 Argument name too long
1 981241 Detects conditional SQL injection attempts
1 981260 SQL Hex Encoding Identified
2 950107 URL Encoding Abuse Attack Attempt
3 960901 Invalid character in request
3 973301 XSS Attack Detected
3 973317 IE XSS Filters - Attack Detected.
3 973324 IE XSS Filters - Attack Detected.
3 981257 Detects MySQL comment-/space-obfuscated injections and backtick termination
4 958407 Cross-site Scripting (XSS) Attack
4 981248 Detects chained SQL injection attempts 1/2
5 950120 Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link
6 950001 SQL Injection Attack
6 958039 Cross-site Scripting (XSS) Attack
6 958056 Cross-site Scripting (XSS) Attack
6 973316 IE XSS Filters - Attack Detected.
6 973327 IE XSS Filters - Attack Detected.
7 950109 Multiple URL Encoding Detected
7 959073 SQL Injection Attack
8 958057 Cross-site Scripting (XSS) Attack
9 973302 XSS Attack Detected
9 981240 Detects MySQL comments, conditions and ch(a)r injections
10 973306 XSS Attack Detected
10 973313 XSS Attack Detected
11 973305 XSS Attack Detected
11 973346 IE XSS Filters - Attack Detected.
12 958409 Cross-site Scripting (XSS) Attack
13 958417 Cross-site Scripting (XSS) Attack
13 973332 IE XSS Filters - Attack Detected.
18 958404 Cross-site Scripting (XSS) Attack
19 973330 IE XSS Filters - Attack Detected.
19 973333 IE XSS Filters - Attack Detected.
23 981246 Detects basic SQL authentication bypass attempts 3/3
26 958007 Cross-site Scripting (XSS) Attack
26 981231 SQL Comment Sequence Detected.
26 981242 Detects classic SQL injection probings 1/2
27 960034 HTTP protocol version is not allowed by policy
27 960911 Invalid HTTP Request Line
31 958001 Cross-site Scripting (XSS) Attack
37 981244 Detects basic SQL authentication bypass attempts 1/3
38 958413 Cross-site Scripting (XSS) Attack
38 981319 SQL Injection Attack: SQL Operator Detected
39 958030 Cross-site Scripting (XSS) Attack
56 973304 XSS Attack Detected
58 973311 XSS Attack Detected
68 958003 Cross-site Scripting (XSS) Attack
70 973338 XSS Filter - Category 3: Javascript URI Vector
78 973303 XSS Attack Detected
82 973334 IE XSS Filters - Attack Detected.
85 973337 XSS Filter - Category 2: Event Handler Vector
188 973310 XSS Attack Detected
218 981243 Detects classic SQL injection probings 2/2
321 981245 Detects basic SQL authentication bypass attempts 2/3
330 981318 SQL Injection Attack: Common Injection Testing Detected
351 973335 IE XSS Filters - Attack Detected.
353 973331 IE XSS Filters - Attack Detected.
353 973336 XSS Filter - Category 1: Script Tag Vector
358 958051 Cross-site Scripting (XSS) Attack
370 950901 SQL Injection Attack: SQL Tautology Detected.
422 960024 Meta-Character Anomaly Detection Alert - Repetative Non-Word Characters
434 973300 Possible XSS Attack Detected - HTML Tag Handler
482 973307 XSS Attack Detected
485 958052 Cross-site Scripting (XSS) Attack
545 981173 Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded

Rule Summary for CRS 3.0.0 (dev) Paranoia Level 1 (=default)

1 920360 Argument name too long
1 942230 Detects conditional SQL injection attempts
2 920220 URL Encoding Abuse Attack Attempt
3 920270 Invalid character in request
3 941230 IE XSS Filters - Attack Detected.
3 941300 IE XSS Filters - Attack Detected.
6 941140 XSS Filter - Category 4: Javascript URI Vector
8 933120 PHP Injection Attack: Configuration Directive Found
11 941170 NoScript XSS InjectionChecker: Attribute Injection
11 941210 IE XSS Filters - Attack Detected.
19 921150 HTTP Header Injection Attack via payload (CR/LF deteced)
27 920100 Invalid HTTP Request Line
27 920430 HTTP protocol version is not allowed by policy
85 941120 XSS Filter - Category 2: Event Handler Vector
92 941180 Node-Validator Blacklist Keywords
149 942100 SQL Injection Attack Detected via LibInjection
165 932100 Remote Command Execution (RCE) Attempt
356 941110 XSS Filter - Category 1: Script Tag Vector
460 941100 XSS Attack Detected via Libinjection
479 941160 NoScript XSS InjectionChecker: HTML Injection

Rule Summary for CRS 3.0.0 (dev) Paranoia Level 2

1 920360 Argument name too long
1 942230 Detects conditional SQL injection attempts
1 942450 SQL Hex Encoding Identified
2 920220 URL Encoding Abuse Attack Attempt
3 920270 Invalid character in request
3 941230 IE XSS Filters - Attack Detected.
3 941300 IE XSS Filters - Attack Detected.
3 942200 Detects MySQL comment-/space-obfuscated injections and backtick termination
4 942210 Detects chained SQL injection attempts 1/2
5 931130 Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link
6 941140 XSS Filter - Category 4: Javascript URI Vector
6 942150 SQL Injection Attack
7 920230 Multiple URL Encoding Detected
7 942410 SQL Injection Attack
8 933120 PHP Injection Attack: Configuration Directive Found
9 942300 Detects MySQL comments, conditions and ch(a)r injections
11 941170 NoScript XSS InjectionChecker: Attribute Injection
11 941210 IE XSS Filters - Attack Detected.
13 941330 IE XSS Filters - Attack Detected.
19 921150 HTTP Header Injection Attack via payload (CR/LF deteced)
19 941340 IE XSS Filters - Attack Detected.
23 942340 Detects basic SQL authentication bypass attempts 3/3
26 942330 Detects classic SQL injection probings 1/2
26 942440 SQL Comment Sequence Detected.
27 920100 Invalid HTTP Request Line
27 920430 HTTP protocol version is not allowed by policy
37 942180 Detects basic SQL authentication bypass attempts 1/3
38 942120 SQL Injection Attack: SQL Operator Detected
85 941120 XSS Filter - Category 2: Event Handler Vector
92 941180 Node-Validator Blacklist Keywords
149 942100 SQL Injection Attack Detected via LibInjection
164 932100 Remote Command Execution (RCE) Attempt
218 942370 Detects classic SQL injection probings 2/2
321 942260 Detects basic SQL authentication bypass attempts 2/3
328 942110 SQL Injection Attack: Common Injection Testing Detected
356 941110 XSS Filter - Category 1: Script Tag Vector
371 942130 SQL Injection Attack: SQL Tautology Detected.
422 942460 Meta-Character Anomaly Detection Alert - Repetative Non-Word Characters
434 941320 Possible XSS Attack Detected - HTML Tag Handler
460 941100 XSS Attack Detected via Libinjection
479 941160 NoScript XSS InjectionChecker: HTML Injection
545 942430 Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded

It’s nice to see that libinject is doing a good job here for the 3.0.0 rules (it’s not active in CRS 2.2.9; here it is active in rule 941100).

As usual, the workhorse of anomaly detection 942430 (in 2.2.9, this rule was 981173) is adding many, many alerts for Paranoia Level 2. Unfortunately, this is also the case with legitimate traffic. There are still discussions on what to do with this rule, but the most likely outcome is, that we are going to raise the limits a bit (and add a stricter sibling at higher Paranoia Level 3 and on and PL 4).

So what do all these stats tell us? ModSecurity does a decent job with detecting XSS. There is a small hole with 3.0.0, that we should look into. But otherwise, things look neat.

If you think, this is interesting research and if you would like to discuss the results, then please join the OWASP ModSecurity Core Rules Mailinglist, where we try to improve the ruleset in an open process.

 

Christian Folini

 

 

 

 

 

P.S. before I forget, these are the detailed anomaly scores for the various setups:

Anomaly Score Stats for 2.2.9

INCOMING Num of req. | % of req. | Sum of % | Missing %
Number of incoming req. (total) | 572 | 100.0000% | 100.0000% | 0.0000%

Empty or miss. incoming score | 0 | 0.0000% | 0.0000% | 100.0000%
Reqs with incoming score of 0 | 22 | 3.8461% | 3.8461% | 96.1539%
Reqs with incoming score of 1 | 0 | 0.0000% | 3.8461% | 96.1539%
Reqs with incoming score of 2 | 0 | 0.0000% | 3.8461% | 96.1539%
Reqs with incoming score of 3 | 0 | 0.0000% | 3.8461% | 96.1539%
Reqs with incoming score of 4 | 0 | 0.0000% | 3.8461% | 96.1539%
Reqs with incoming score of 5 | 8 | 1.3986% | 5.2447% | 94.7553%
Reqs with incoming score of 6 | 0 | 0.0000% | 5.2447% | 94.7553%
Reqs with incoming score of 7 | 0 | 0.0000% | 5.2447% | 94.7553%
Reqs with incoming score of 8 | 2 | 0.3496% | 5.5944% | 94.4056%
Reqs with incoming score of 9 | 0 | 0.0000% | 5.5944% | 94.4056%
Reqs with incoming score of 10 | 5 | 0.8741% | 6.4685% | 93.5315%
Reqs with incoming score of 11 | 0 | 0.0000% | 6.4685% | 93.5315%
Reqs with incoming score of 12 | 0 | 0.0000% | 6.4685% | 93.5315%
Reqs with incoming score of 13 | 1 | 0.1748% | 6.6433% | 93.3567%
Reqs with incoming score of 14 | 0 | 0.0000% | 6.6433% | 93.3567%
Reqs with incoming score of 15 | 5 | 0.8741% | 7.5174% | 92.4826%
Reqs with incoming score of 16 | 0 | 0.0000% | 7.5174% | 92.4826%
Reqs with incoming score of 17 | 0 | 0.0000% | 7.5174% | 92.4826%
Reqs with incoming score of 18 | 4 | 0.6993% | 8.2167% | 91.7833%
Reqs with incoming score of 19 | 0 | 0.0000% | 8.2167% | 91.7833%
Reqs with incoming score of 20 | 14 | 2.4475% | 10.6643% | 89.3357%
Reqs with incoming score of 21 | 2 | 0.3496% | 11.0139% | 88.9861%
Reqs with incoming score of 22 | 0 | 0.0000% | 11.0139% | 88.9861%
Reqs with incoming score of 23 | 8 | 1.3986% | 12.4125% | 87.5875%
Reqs with incoming score of 24 | 0 | 0.0000% | 12.4125% | 87.5875%
Reqs with incoming score of 25 | 1 | 0.1748% | 12.5874% | 87.4126%
Reqs with incoming score of 26 | 9 | 1.5734% | 14.1608% | 85.8392%
Reqs with incoming score of 27 | 0 | 0.0000% | 14.1608% | 85.8392%
Reqs with incoming score of 28 | 2 | 0.3496% | 14.5104% | 85.4896%
Reqs with incoming score of 29 | 0 | 0.0000% | 14.5104% | 85.4896%
Reqs with incoming score of 30 | 0 | 0.0000% | 14.5104% | 85.4896%
Reqs with incoming score of 31 | 21 | 3.6713% | 18.1818% | 81.8182%
Reqs with incoming score of 32 | 0 | 0.0000% | 18.1818% | 81.8182%
Reqs with incoming score of 33 | 15 | 2.6223% | 20.8041% | 79.1959%
Reqs with incoming score of 34 | 1 | 0.1748% | 20.9790% | 79.0210%
Reqs with incoming score of 35 | 0 | 0.0000% | 20.9790% | 79.0210%
Reqs with incoming score of 36 | 19 | 3.3216% | 24.3006% | 75.6994%
Reqs with incoming score of 37 | 0 | 0.0000% | 24.3006% | 75.6994%
Reqs with incoming score of 38 | 9 | 1.5734% | 25.8741% | 74.1259%
Reqs with incoming score of 39 | 0 | 0.0000% | 25.8741% | 74.1259%
Reqs with incoming score of 40 | 0 | 0.0000% | 25.8741% | 74.1259%
Reqs with incoming score of 41 | 17 | 2.9720% | 28.8461% | 71.1539%
Reqs with incoming score of 42 | 0 | 0.0000% | 28.8461% | 71.1539%
Reqs with incoming score of 43 | 24 | 4.1958% | 33.0419% | 66.9581%
Reqs with incoming score of 44 | 1 | 0.1748% | 33.2167% | 66.7833%
Reqs with incoming score of 45 | 4 | 0.6993% | 33.9160% | 66.0840%
Reqs with incoming score of 46 | 49 | 8.5664% | 42.4825% | 57.5175%
Reqs with incoming score of 47 | 0 | 0.0000% | 42.4825% | 57.5175%
Reqs with incoming score of 48 | 15 | 2.6223% | 45.1048% | 54.8952%
Reqs with incoming score of 49 | 1 | 0.1748% | 45.2797% | 54.7203%
Reqs with incoming score of 50 | 0 | 0.0000% | 45.2797% | 54.7203%
Reqs with incoming score of 51 | 60 | 10.4895% | 55.7692% | 44.2308%
Reqs with incoming score of 52 | 0 | 0.0000% | 55.7692% | 44.2308%
Reqs with incoming score of 53 | 12 | 2.0979% | 57.8671% | 42.1329%
Reqs with incoming score of 54 | 1 | 0.1748% | 58.0419% | 41.9581%
Reqs with incoming score of 55 | 1 | 0.1748% | 58.2167% | 41.7833%
Reqs with incoming score of 56 | 17 | 2.9720% | 61.1888% | 38.8112%
Reqs with incoming score of 57 | 1 | 0.1748% | 61.3636% | 38.6364%
Reqs with incoming score of 58 | 19 | 3.3216% | 64.6853% | 35.3147%
Reqs with incoming score of 59 | 1 | 0.1748% | 64.8601% | 35.1399%
Reqs with incoming score of 60 | 0 | 0.0000% | 64.8601% | 35.1399%
Reqs with incoming score of 61 | 47 | 8.2167% | 73.0769% | 26.9231%
Reqs with incoming score of 62 | 1 | 0.1748% | 73.2517% | 26.7483%
Reqs with incoming score of 63 | 3 | 0.5244% | 73.7762% | 26.2238%
Reqs with incoming score of 64 | 0 | 0.0000% | 73.7762% | 26.2238%
Reqs with incoming score of 65 | 0 | 0.0000% | 73.7762% | 26.2238%
Reqs with incoming score of 66 | 97 | 16.9580% | 90.7342% | 9.2658%
Reqs with incoming score of 67 | 0 | 0.0000% | 90.7342% | 9.2658%
Reqs with incoming score of 68 | 2 | 0.3496% | 91.0839% | 8.9161%
Reqs with incoming score of 69 | 0 | 0.0000% | 91.0839% | 8.9161%
Reqs with incoming score of 70 | 0 | 0.0000% | 91.0839% | 8.9161%
Reqs with incoming score of 71 | 7 | 1.2237% | 92.3076% | 7.6924%
Reqs with incoming score of 72 | 0 | 0.0000% | 92.3076% | 7.6924%
Reqs with incoming score of 73 | 1 | 0.1748% | 92.4825% | 7.5175%
Reqs with incoming score of 74 | 0 | 0.0000% | 92.4825% | 7.5175%
Reqs with incoming score of 75 | 0 | 0.0000% | 92.4825% | 7.5175%
Reqs with incoming score of 76 | 13 | 2.2727% | 94.7552% | 5.2448%
Reqs with incoming score of 77 | 0 | 0.0000% | 94.7552% | 5.2448%
Reqs with incoming score of 78 | 1 | 0.1748% | 94.9300% | 5.0700%
Reqs with incoming score of 79 | 0 | 0.0000% | 94.9300% | 5.0700%
Reqs with incoming score of 80 | 0 | 0.0000% | 94.9300% | 5.0700%
Reqs with incoming score of 81 | 3 | 0.5244% | 95.4545% | 4.5455%
Reqs with incoming score of 82 | 0 | 0.0000% | 95.4545% | 4.5455%
Reqs with incoming score of 83 | 1 | 0.1748% | 95.6293% | 4.3707%
Reqs with incoming score of 84 | 0 | 0.0000% | 95.6293% | 4.3707%
Reqs with incoming score of 85 | 0 | 0.0000% | 95.6293% | 4.3707%
Reqs with incoming score of 86 | 3 | 0.5244% | 96.1538% | 3.8462%
Reqs with incoming score of 87 | 0 | 0.0000% | 96.1538% | 3.8462%
Reqs with incoming score of 88 | 0 | 0.0000% | 96.1538% | 3.8462%
Reqs with incoming score of 89 | 0 | 0.0000% | 96.1538% | 3.8462%
Reqs with incoming score of 90 | 0 | 0.0000% | 96.1538% | 3.8462%
Reqs with incoming score of 91 | 2 | 0.3496% | 96.5034% | 3.4966%
Reqs with incoming score of 92 | 0 | 0.0000% | 96.5034% | 3.4966%
Reqs with incoming score of 93 | 0 | 0.0000% | 96.5034% | 3.4966%
Reqs with incoming score of 94 | 0 | 0.0000% | 96.5034% | 3.4966%
Reqs with incoming score of 95 | 0 | 0.0000% | 96.5034% | 3.4966%
Reqs with incoming score of 96 | 1 | 0.1748% | 96.6783% | 3.3217%
Reqs with incoming score of 97 | 0 | 0.0000% | 96.6783% | 3.3217%
Reqs with incoming score of 98 | 8 | 1.3986% | 98.0769% | 1.9231%
Reqs with incoming score of 99 | 0 | 0.0000% | 98.0769% | 1.9231%
Reqs with incoming score of 100 | 0 | 0.0000% | 98.0769% | 1.9231%
Reqs with incoming score of 101 | 0 | 0.0000% | 98.0769% | 1.9231%
Reqs with incoming score of 102 | 0 | 0.0000% | 98.0769% | 1.9231%
Reqs with incoming score of 103 | 0 | 0.0000% | 98.0769% | 1.9231%
Reqs with incoming score of 104 | 0 | 0.0000% | 98.0769% | 1.9231%
Reqs with incoming score of 105 | 0 | 0.0000% | 98.0769% | 1.9231%
Reqs with incoming score of 106 | 1 | 0.1748% | 98.2517% | 1.7483%
Reqs with incoming score of 107 | 0 | 0.0000% | 98.2517% | 1.7483%
Reqs with incoming score of 108 | 0 | 0.0000% | 98.2517% | 1.7483%
Reqs with incoming score of 109 | 0 | 0.0000% | 98.2517% | 1.7483%
Reqs with incoming score of 110 | 0 | 0.0000% | 98.2517% | 1.7483%
Reqs with incoming score of 111 | 1 | 0.1748% | 98.4265% | 1.5735%
Reqs with incoming score of 112 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 113 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 114 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 115 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 116 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 117 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 118 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 119 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 120 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 121 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 122 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 123 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 124 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 125 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 126 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 127 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 128 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 129 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 130 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 131 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 132 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 133 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 134 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 135 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 136 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 137 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 138 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 139 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 140 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 141 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 142 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 143 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 144 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 145 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 146 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 147 | 0 | 0.0000% | 98.4265% | 1.5735%
Reqs with incoming score of 148 | 1 | 0.1748% | 98.6013% | 1.3987%
Reqs with incoming score of 149 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 150 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 151 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 152 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 153 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 154 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 155 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 156 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 157 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 158 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 159 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 160 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 161 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 162 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 163 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 164 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 165 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 166 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 167 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 168 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 169 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 170 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 171 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 172 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 173 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 174 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 175 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 176 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 177 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 178 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 179 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 180 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 181 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 182 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 183 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 184 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 185 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 186 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 187 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 188 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 189 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 190 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 191 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 192 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 193 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 194 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 195 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 196 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 197 | 0 | 0.0000% | 98.6013% | 1.3987%
Reqs with incoming score of 198 | 1 | 0.1748% | 98.7762% | 1.2238%
Reqs with incoming score of 199 | 0 | 0.0000% | 98.7762% | 1.2238%
Reqs with incoming score of 200 | 0 | 0.0000% | 98.7762% | 1.2238%
Reqs with incoming score of 201 | 0 | 0.0000% | 98.7762% | 1.2238%
Reqs with incoming score of 202 | 6 | 1.0489% | 99.8251% | 0.1749%
Reqs with incoming score of 203 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 204 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 205 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 206 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 207 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 208 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 209 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 210 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 211 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 212 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 213 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 214 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 215 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 216 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 217 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 218 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 219 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 220 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 221 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 222 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 223 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 224 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 225 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 226 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 227 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 228 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 229 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 230 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 231 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 232 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 233 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 234 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 235 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 236 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 237 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 238 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 239 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 240 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 241 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 242 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 243 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 244 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 245 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 246 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 247 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 248 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 249 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 250 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 251 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 252 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 253 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 254 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 255 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 256 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 257 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 258 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 259 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 260 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 261 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 262 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 263 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 264 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 265 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 266 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 267 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 268 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 269 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 270 | 0 | 0.0000% | 99.8251% | 0.1749%
Reqs with incoming score of 271 | 1 | 0.1748% | 99.9999% | 0.0001%

Incoming average: 51.0979 Median 51.0000 Standard deviation 27.9241

Anomaly Score Stats for 3.0.0 (dev) Paranoia Level 1(default)

INCOMING                     Num of req. | % of req. |  Sum of % | Missing %
Number of incoming req. (total) |    572 | 100.0000% | 100.0000% |   0.0000%

Empty or miss. incoming score   |      0 |   0.0000% |   0.0000% | 100.0000%
Reqs with incoming score of   0 |     65 |  11.3636% |  11.3636% |  88.6364%
Reqs with incoming score of   1 |      0 |   0.0000% |  11.3636% |  88.6364%
Reqs with incoming score of   2 |      0 |   0.0000% |  11.3636% |  88.6364%
Reqs with incoming score of   3 |      0 |   0.0000% |  11.3636% |  88.6364%
Reqs with incoming score of   4 |      0 |   0.0000% |  11.3636% |  88.6364%
Reqs with incoming score of   5 |     21 |   3.6713% |  15.0349% |  84.9651%
Reqs with incoming score of   6 |      0 |   0.0000% |  15.0349% |  84.9651%
Reqs with incoming score of   7 |      0 |   0.0000% |  15.0349% |  84.9651%
Reqs with incoming score of   8 |      0 |   0.0000% |  15.0349% |  84.9651%
Reqs with incoming score of   9 |      0 |   0.0000% |  15.0349% |  84.9651%
Reqs with incoming score of  10 |     27 |   4.7202% |  19.7552% |  80.2448%
Reqs with incoming score of  11 |      0 |   0.0000% |  19.7552% |  80.2448%
Reqs with incoming score of  12 |      1 |   0.1748% |  19.9300% |  80.0700%
Reqs with incoming score of  13 |      0 |   0.0000% |  19.9300% |  80.0700%
Reqs with incoming score of  14 |      0 |   0.0000% |  19.9300% |  80.0700%
Reqs with incoming score of  15 |    220 |  38.4615% |  58.3916% |  41.6084%
Reqs with incoming score of  16 |      0 |   0.0000% |  58.3916% |  41.6084%
Reqs with incoming score of  17 |      0 |   0.0000% |  58.3916% |  41.6084%
Reqs with incoming score of  18 |      0 |   0.0000% |  58.3916% |  41.6084%
Reqs with incoming score of  19 |      0 |   0.0000% |  58.3916% |  41.6084%
Reqs with incoming score of  20 |    125 |  21.8531% |  80.2447% |  19.7553%
Reqs with incoming score of  21 |      0 |   0.0000% |  80.2447% |  19.7553%
Reqs with incoming score of  22 |      0 |   0.0000% |  80.2447% |  19.7553%
Reqs with incoming score of  23 |      1 |   0.1748% |  80.4195% |  19.5805%
Reqs with incoming score of  24 |      0 |   0.0000% |  80.4195% |  19.5805%
Reqs with incoming score of  25 |     63 |  11.0139% |  91.4335% |   8.5665%
Reqs with incoming score of  26 |      0 |   0.0000% |  91.4335% |   8.5665%
Reqs with incoming score of  27 |      0 |   0.0000% |  91.4335% |   8.5665%
Reqs with incoming score of  28 |      1 |   0.1748% |  91.6083% |   8.3917%
Reqs with incoming score of  29 |      0 |   0.0000% |  91.6083% |   8.3917%
Reqs with incoming score of  30 |     19 |   3.3216% |  94.9300% |   5.0700%
Reqs with incoming score of  31 |      0 |   0.0000% |  94.9300% |   5.0700%
Reqs with incoming score of  32 |      0 |   0.0000% |  94.9300% |   5.0700%
Reqs with incoming score of  33 |      0 |   0.0000% |  94.9300% |   5.0700%
Reqs with incoming score of  34 |      0 |   0.0000% |  94.9300% |   5.0700%
Reqs with incoming score of  35 |     15 |   2.6223% |  97.5524% |   2.4476%
Reqs with incoming score of  36 |      0 |   0.0000% |  97.5524% |   2.4476%
Reqs with incoming score of  37 |      0 |   0.0000% |  97.5524% |   2.4476%
Reqs with incoming score of  38 |      0 |   0.0000% |  97.5524% |   2.4476%
Reqs with incoming score of  39 |      0 |   0.0000% |  97.5524% |   2.4476%
Reqs with incoming score of  40 |      2 |   0.3496% |  97.9020% |   2.0980%
Reqs with incoming score of  41 |      0 |   0.0000% |  97.9020% |   2.0980%
Reqs with incoming score of  42 |      0 |   0.0000% |  97.9020% |   2.0980%
Reqs with incoming score of  43 |      0 |   0.0000% |  97.9020% |   2.0980%
Reqs with incoming score of  44 |      0 |   0.0000% |  97.9020% |   2.0980%
Reqs with incoming score of  45 |      2 |   0.3496% |  98.2517% |   1.7483%
Reqs with incoming score of  46 |      0 |   0.0000% |  98.2517% |   1.7483%
Reqs with incoming score of  47 |      0 |   0.0000% |  98.2517% |   1.7483%
Reqs with incoming score of  48 |      0 |   0.0000% |  98.2517% |   1.7483%
Reqs with incoming score of  49 |      0 |   0.0000% |  98.2517% |   1.7483%
Reqs with incoming score of  50 |      1 |   0.1748% |  98.4265% |   1.5735%
Reqs with incoming score of  51 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  52 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  53 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  54 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  55 |      1 |   0.1748% |  98.6013% |   1.3987%
Reqs with incoming score of  56 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of  57 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of  58 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of  59 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of  60 |      7 |   1.2237% |  99.8251% |   0.1749%
Reqs with incoming score of  61 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  62 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  63 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  64 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  65 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  66 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  67 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  68 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  69 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  70 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  71 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  72 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  73 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  74 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  75 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  76 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  77 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  78 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  79 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  80 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  81 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  82 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  83 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  84 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  85 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  86 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  87 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  88 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  89 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  90 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  91 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  92 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  93 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  94 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  95 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  96 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  97 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  98 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of  99 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 100 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 101 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 102 |      1 |   0.1748% | 100.0000% |   0.0000%

Incoming average:  16.9668    Median  15.0000    Standard deviation  10.4738

Anomaly Score Stats for 3.0.0 (dev) Paranoia Level 2

INCOMING                     Num of req. | % of req. |  Sum of % | Missing %
Number of incoming req. (total) |    572 | 100.0000% | 100.0000% |   0.0000%

Empty or miss. incoming score   |      0 |   0.0000% |   0.0000% | 100.0000%
Reqs with incoming score of   0 |     22 |   3.8461% |   3.8461% |  96.1539%
Reqs with incoming score of   1 |      0 |   0.0000% |   3.8461% |  96.1539%
Reqs with incoming score of   2 |      0 |   0.0000% |   3.8461% |  96.1539%
Reqs with incoming score of   3 |      7 |   1.2237% |   5.0699% |  94.9301%
Reqs with incoming score of   4 |      0 |   0.0000% |   5.0699% |  94.9301%
Reqs with incoming score of   5 |      9 |   1.5734% |   6.6433% |  93.3567%
Reqs with incoming score of   6 |      7 |   1.2237% |   7.8671% |  92.1329%
Reqs with incoming score of   7 |      0 |   0.0000% |   7.8671% |  92.1329%
Reqs with incoming score of   8 |      1 |   0.1748% |   8.0419% |  91.9581%
Reqs with incoming score of   9 |     18 |   3.1468% |  11.1888% |  88.8112%
Reqs with incoming score of  10 |      8 |   1.3986% |  12.5874% |  87.4126%
Reqs with incoming score of  11 |      4 |   0.6993% |  13.2867% |  86.7133%
Reqs with incoming score of  12 |      0 |   0.0000% |  13.2867% |  86.7133%
Reqs with incoming score of  13 |      3 |   0.5244% |  13.8111% |  86.1889%
Reqs with incoming score of  14 |      6 |   1.0489% |  14.8601% |  85.1399%
Reqs with incoming score of  15 |      4 |   0.6993% |  15.5594% |  84.4406%
Reqs with incoming score of  16 |      4 |   0.6993% |  16.2587% |  83.7413%
Reqs with incoming score of  17 |      0 |   0.0000% |  16.2587% |  83.7413%
Reqs with incoming score of  18 |      9 |   1.5734% |  17.8321% |  82.1679%
Reqs with incoming score of  19 |      6 |   1.0489% |  18.8811% |  81.1189%
Reqs with incoming score of  20 |      0 |   0.0000% |  18.8811% |  81.1189%
Reqs with incoming score of  21 |      1 |   0.1748% |  19.0559% |  80.9441%
Reqs with incoming score of  22 |      0 |   0.0000% |  19.0559% |  80.9441%
Reqs with incoming score of  23 |     17 |   2.9720% |  22.0279% |  77.9721%
Reqs with incoming score of  24 |      2 |   0.3496% |  22.3776% |  77.6224%
Reqs with incoming score of  25 |      0 |   0.0000% |  22.3776% |  77.6224%
Reqs with incoming score of  26 |     10 |   1.7482% |  24.1258% |  75.8742%
Reqs with incoming score of  27 |      0 |   0.0000% |  24.1258% |  75.8742%
Reqs with incoming score of  28 |     17 |   2.9720% |  27.0979% |  72.9021%
Reqs with incoming score of  29 |      5 |   0.8741% |  27.9720% |  72.0280%
Reqs with incoming score of  30 |      0 |   0.0000% |  27.9720% |  72.0280%
Reqs with incoming score of  31 |     26 |   4.5454% |  32.5174% |  67.4826%
Reqs with incoming score of  32 |      0 |   0.0000% |  32.5174% |  67.4826%
Reqs with incoming score of  33 |     15 |   2.6223% |  35.1398% |  64.8602%
Reqs with incoming score of  34 |     10 |   1.7482% |  36.8881% |  63.1119%
Reqs with incoming score of  35 |      4 |   0.6993% |  37.5874% |  62.4126%
Reqs with incoming score of  36 |     58 |  10.1398% |  47.7272% |  52.2728%
Reqs with incoming score of  37 |      0 |   0.0000% |  47.7272% |  52.2728%
Reqs with incoming score of  38 |      2 |   0.3496% |  48.0769% |  51.9231%
Reqs with incoming score of  39 |     60 |  10.4895% |  58.5664% |  41.4336%
Reqs with incoming score of  40 |      0 |   0.0000% |  58.5664% |  41.4336%
Reqs with incoming score of  41 |     55 |   9.6153% |  68.1818% |  31.8182%
Reqs with incoming score of  42 |      0 |   0.0000% |  68.1818% |  31.8182%
Reqs with incoming score of  43 |      0 |   0.0000% |  68.1818% |  31.8182%
Reqs with incoming score of  44 |     50 |   8.7412% |  76.9230% |  23.0770%
Reqs with incoming score of  45 |      0 |   0.0000% |  76.9230% |  23.0770%
Reqs with incoming score of  46 |     19 |   3.3216% |  80.2447% |  19.7553%
Reqs with incoming score of  47 |      1 |   0.1748% |  80.4195% |  19.5805%
Reqs with incoming score of  48 |      1 |   0.1748% |  80.5944% |  19.4056%
Reqs with incoming score of  49 |     26 |   4.5454% |  85.1398% |  14.8602%
Reqs with incoming score of  50 |      0 |   0.0000% |  85.1398% |  14.8602%
Reqs with incoming score of  51 |      7 |   1.2237% |  86.3636% |  13.6364%
Reqs with incoming score of  52 |      1 |   0.1748% |  86.5384% |  13.4616%
Reqs with incoming score of  53 |      1 |   0.1748% |  86.7132% |  13.2868%
Reqs with incoming score of  54 |     13 |   2.2727% |  88.9860% |  11.0140%
Reqs with incoming score of  55 |      0 |   0.0000% |  88.9860% |  11.0140%
Reqs with incoming score of  56 |      6 |   1.0489% |  90.0349% |   9.9651%
Reqs with incoming score of  57 |      1 |   0.1748% |  90.2097% |   9.7903%
Reqs with incoming score of  58 |      1 |   0.1748% |  90.3846% |   9.6154%
Reqs with incoming score of  59 |     14 |   2.4475% |  92.8321% |   7.1679%
Reqs with incoming score of  60 |      0 |   0.0000% |  92.8321% |   7.1679%
Reqs with incoming score of  61 |      2 |   0.3496% |  93.1818% |   6.8182%
Reqs with incoming score of  62 |      1 |   0.1748% |  93.3566% |   6.6434%
Reqs with incoming score of  63 |      0 |   0.0000% |  93.3566% |   6.6434%
Reqs with incoming score of  64 |      9 |   1.5734% |  94.9300% |   5.0700%
Reqs with incoming score of  65 |      0 |   0.0000% |  94.9300% |   5.0700%
Reqs with incoming score of  66 |      4 |   0.6993% |  95.6293% |   4.3707%
Reqs with incoming score of  67 |      1 |   0.1748% |  95.8041% |   4.1959%
Reqs with incoming score of  68 |      0 |   0.0000% |  95.8041% |   4.1959%
Reqs with incoming score of  69 |      2 |   0.3496% |  96.1538% |   3.8462%
Reqs with incoming score of  70 |      0 |   0.0000% |  96.1538% |   3.8462%
Reqs with incoming score of  71 |      0 |   0.0000% |  96.1538% |   3.8462%
Reqs with incoming score of  72 |      1 |   0.1748% |  96.3286% |   3.6714%
Reqs with incoming score of  73 |      1 |   0.1748% |  96.5034% |   3.4966%
Reqs with incoming score of  74 |      2 |   0.3496% |  96.8531% |   3.1469%
Reqs with incoming score of  75 |      0 |   0.0000% |  96.8531% |   3.1469%
Reqs with incoming score of  76 |      0 |   0.0000% |  96.8531% |   3.1469%
Reqs with incoming score of  77 |      0 |   0.0000% |  96.8531% |   3.1469%
Reqs with incoming score of  78 |      0 |   0.0000% |  96.8531% |   3.1469%
Reqs with incoming score of  79 |      0 |   0.0000% |  96.8531% |   3.1469%
Reqs with incoming score of  80 |      0 |   0.0000% |  96.8531% |   3.1469%
Reqs with incoming score of  81 |      8 |   1.3986% |  98.2517% |   1.7483%
Reqs with incoming score of  82 |      1 |   0.1748% |  98.4265% |   1.5735%
Reqs with incoming score of  83 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  84 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  85 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  86 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  87 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  88 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  89 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  90 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  91 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  92 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  93 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  94 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  95 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  96 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  97 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  98 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of  99 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 100 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 101 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 102 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 103 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 104 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 105 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 106 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 107 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 108 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 109 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 110 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 111 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 112 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 113 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 114 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 115 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 116 |      0 |   0.0000% |  98.4265% |   1.5735%
Reqs with incoming score of 117 |      1 |   0.1748% |  98.6013% |   1.3987%
Reqs with incoming score of 118 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 119 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 120 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 121 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 122 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 123 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 124 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 125 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 126 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 127 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 128 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 129 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 130 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 131 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 132 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 133 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 134 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 135 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 136 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 137 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 138 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 139 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 140 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 141 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 142 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 143 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 144 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 145 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 146 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 147 |      0 |   0.0000% |  98.6013% |   1.3987%
Reqs with incoming score of 148 |      6 |   1.0489% |  99.6503% |   0.3497%
Reqs with incoming score of 149 |      0 |   0.0000% |  99.6503% |   0.3497%
Reqs with incoming score of 150 |      0 |   0.0000% |  99.6503% |   0.3497%
Reqs with incoming score of 151 |      0 |   0.0000% |  99.6503% |   0.3497%
Reqs with incoming score of 152 |      0 |   0.0000% |  99.6503% |   0.3497%
Reqs with incoming score of 153 |      0 |   0.0000% |  99.6503% |   0.3497%
Reqs with incoming score of 154 |      1 |   0.1748% |  99.8251% |   0.1749%
Reqs with incoming score of 155 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 156 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 157 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 158 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 159 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 160 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 161 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 162 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 163 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 164 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 165 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 166 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 167 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 168 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 169 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 170 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 171 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 172 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 173 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 174 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 175 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 176 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 177 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 178 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 179 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 180 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 181 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 182 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 183 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 184 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 185 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 186 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 187 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 188 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 189 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 190 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 191 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 192 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 193 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 194 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 195 |      0 |   0.0000% |  99.8251% |   0.1749%
Reqs with incoming score of 196 |      1 |   0.1748% |  99.9999% |   0.0001%

Incoming average:  37.2325    Median  39.0000    Standard deviation  22.1551