Anomaly Scoring

Behavioral model that scores every request 0-100 based on 14 signals — TLS fingerprint, request cadence, header order, payload shape. Block above a threshold you control.

What it is

Anomaly Scoring is Sectora's "something feels off about this request" signal. Unlike the other Shield layers which look for specific known-bad patterns, this layer evaluates each request against a behavioral baseline learned from your legitimate traffic, then produces a 0–100 score.

High scores correlate with attacks the other layers miss — credential stuffing, scraping, low-and-slow probing, and bots that mimic browser fingerprints well enough to fool the bot detector.

The 14 signals

1. JA4 TLS fingerprint vs baseline
2. HTTP/2 SETTINGS frame order
3. Header order + casing
4. Accept-Language vs Geo-IP language
5. User-Agent age vs current version distribution
6. Request cadence (regular intervals = bot)
7. Mouse movement / scroll telemetry (when JS is enabled)
8. Cookie age / cycling pattern
9. Referer chain plausibility
10. URL path entropy (random-looking paths)
11. Query parameter cardinality
12. Body content-type vs declared
13. Time-of-day vs traffic baseline (3am bursts)
14. Geographic-IP plausibility (residential ASN from a server farm subnet)

Each signal contributes a weighted partial score. Total = sum, normalized to 0–100. Weights are pre-tuned per customer based on the Log-mode baseline period.

Score distribution

After 24h of Log-mode baseline, the Shield dashboard shows the score distribution for your traffic. Typical shape:

  • 0–20 (~70% of traffic) — Real users behaving normally.
  • 20–50 (~25%) — Real users on unusual paths (corporate VPN, mobile carrier IP, etc.). Don't block.
  • 50–70 (~3%) — Suspicious but ambiguous. Challenge (CAPTCHA) instead of block.
  • 70–100 (~2%) — Almost certainly automated or hostile. Block.

Configuration

Shield → site → Anomaly Scoring. Three thresholds:

  • Block threshold (default 75) — score ≥ this returns 403.
  • Challenge threshold (default 55) — score in this band gets a Turnstile challenge.
  • Log-only threshold (default 35) — score ≥ this is logged for review but allowed.

Whitelist patterns

Known-good automated traffic (your own monitoring, partner integrations, search engine crawlers) should be excluded. Whitelist by:

  • User-Agent regex
  • IP / CIDR
  • ASN (e.g. AS15169 Googlebot, AS8075 Bingbot)
  • Header presence (e.g. X-Partner-Token: known-value)

Adapting to traffic shifts

The baseline is recomputed weekly. If you launch a new feature (e.g. a public webhook endpoint that's called 1000x/min from server farms — a normal anomaly-scoring kill-pattern), retrain immediately via Shield → Anomaly Scoring → Retrain baseline. Takes ~10 min; you can keep using the previous baseline until it's ready.

Comparison to plain bot detection

Bot Detectionlooks for known-bot signatures. Anomaly Scoring is broader — it catches bots that have specifically tuned themselves to LOOK like humans (residential IPs, real browser fingerprints, scripted mouse movements), as well as misconfigured legitimate clients that happen to look bot-like. Use both together; Anomaly Scoring fills the gap when bot detection's confidence is low.

What's next