Request size anomaly (request_size)

Request size anomaly

Requests are unusually large or shaped in a way that suggests abuse or automation.

Attack family · Fuzzing, stress, and malformed payload staging Phase · Reconnaissance and exploit staging Risk · Medium

What This Annotator Watches

This explanation is derived from the live annotator implementation, not hand-waved catalog copy.

Focus

Very large or abnormally small requests and responses
Payload shape mismatches across method, status, and URL context
Outlier response sizes that hint at abuse or malformed clients

Logic

Known media assets can be exempted so large normal files do not pollute the signal.
The annotator scores oversized, undersized, and contextually odd response shapes differently.
It is strongest when paired with endpoint context and recurrence.

Attack Family

Fuzzing, stress, and malformed payload staging

Phase · Reconnaissance and exploit staging Risk · Medium

Abnormal size is often how attackers learn what the application will tolerate. Oversized parameters, undersized weird replies, and repeated outliers are the shape of probing before the exploit is fully understood.

Damage Patterns

Attackers use payload size variation to discover parser limits, buffer assumptions, and application stress points.
Large or oddly shaped requests can also drive up compute cost, trigger edge-case errors, and preview denial-of-service behavior.

Incident Lore

A lot of high-impact exploit chains began with seemingly boring malformed inputs that taught the attacker where the boundaries really were.
Defenders often dismiss size anomalies as noise until they line up with crashes, resets, or later exploit attempts.

How To Read It

This is a shape-of-traffic annotator. It helps explain why the request or response footprint looks unlike normal usage.

Defender Takeaway

Treat shape anomalies as experimentation. Someone may be measuring the envelope before they commit to a stronger move.

Catalog Definition

Flags abnormal request sizes such as unusually large query strings, oversized headers, or repeated large payload attempts. This can indicate fuzzing, stress attempts, malformed clients, or automation. False positives can occur (large cookies, tracking parameters, legitimate API usage), so interpret with endpoint context and recurrence.

Request size anomaly

What This Annotator Watches

10 Most Recent Real Samples

Confirm Action