Scoring Model Overview

netbobr uses a four-factor additive scoring model. Each factor measures a different dimension of risk exposure and contributes a bounded number of points to the final score.

The four factors

Factor	Default Max	What it measures
Source Breadth	25	How wide the source address range is
Destination Breadth	30	How wide the destination address range is (blast radius)
Port Exposure	25	How many ports are open and how risky those services are
Zone Policy	20	Whether the zone matrix allows, reviews, or denies the flow

The default caps sum to 100, which is also the maximum possible score.

Fixed weights in the web app

The web app always scores flows with the default caps above, so scores are directly comparable across sessions and teams. If your pipeline needs a different weighting, the CLI accepts a flat weights object (srcMax, dstMax, portMax, zoneMax) in its --config file.

Custom caps scale every factor proportionally. Each factor's point table is defined against its default cap, and a custom cap rescales it:

contribution = round(points x customCap / defaultCap)    (never above customCap)

For example, with srcMax: 50 a /8 source scores round(20 x 50 / 25) = 40 instead of 20, and with srcMax: 0 the source factor is always 0. "Any" addresses, "all ports" and a Deny zone policy score the full cap.

Weight rules:

Each value must be an integer from 0 to 100 (for example 30, not 30.5); anything else is a configuration error such as weights.srcMax must be an integer between 0 and 100 (got 25.5). Missing keys keep their defaults. Integer caps keep every score a whole number.
Unknown keys are ignored with a warning.
If the four caps do not sum to 100 you get a warning; the final score is still clamped to 0-100.

Score calculation

The final score is computed in three stages:

Factor scoring - each factor independently produces a contribution between 0 and its cap (scaled as above when custom caps are used).
Summation - the four factor contributions are added together.
Floors and penalties - post-processing rules enforce minimum scores for dangerous patterns (zone policy violations, plaintext protocols, any-any combos) and add penalties where appropriate. See Floors & Penalties for details.

flowchart TD A[Input Flow] --> B[Parse IPs / Ports] B --> C[Score Source Breadth] C --> D[Score Destination Breadth] D --> E[Score Port Exposure] E --> F[Score Zone Policy] F --> G[Sum Raw Score] G --> H[Apply Zone Policy Floor] H --> I[Apply Plaintext Floor / Penalty] I --> J[Apply Any-Any Floor] J --> K[Final Score + Label]

Risk labels

The final numeric score maps to a label via thresholds (configurable in the CLI). The defaults are:

Rating	Score Range
Low	0 - 25
Medium	26 - 50
High	51 - 75
Critical	76 - 100

These labels appear on risk score badges throughout the UI and in exported results.

Source Breadth