Featured · WAF Tuning
WAF Paranoia Level Evaluation
PL1 → PL2: detection unchanged (TPR 97.0%), false positives doubled (1.0% → 2.0%)
Tested ModSecurity CRS 3.3.8 at Paranoia Level 1 vs PL2 against structured SQLi and XSS payloads in a Docker-based reverse-proxy testbed. Every observed difference traced back to threshold arithmetic rather than additional rule logic: a practical argument against blindly raising paranoia levels in production. Built as my MSc dissertation (Distinction).