Bug #5 (CRITICAL): Attack severity calculation used '>' instead of '>=',
causing off-by-one boundary conditions:
Before fix:
- total_syn=500 → severity=0 (should be 4!)
- total_syn=300 → severity=0 (should be 3!)
- total_syn=150 → severity=0 (should be 2!)
- total_syn=75 → severity=0 (should be 1!)
This means attacks at EXACTLY these critical thresholds were misclassified
as severity=0, resulting in:
- Wrong threshold (stays at 20 instead of 3-10)
- IPs not detected that should be
- Adaptive threshold not lowered properly
Fix: Change all conditions from > to >= to include boundary values:
- total_syn >= 500 → severity=4
- total_syn >= 300 → severity=3
- total_syn >= 150 → severity=2
- total_syn >= 75 → severity=1
- else → severity=0
Impact: Large-scale attacks at exact threshold counts now properly classified.
Example: Server with exactly 500 SYN connections
- Before: severity=0, threshold=20 (no detection)
- After: severity=4, threshold=3 (proper detection)
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
cschantz
07448e1136