How the score works
The idea behind every Squirks score, without the recipe. No security background needed.
It predicts the next byte
Squirks reads data one byte at a time. A byte is a single character of text, or one small piece of any other data. Before each byte, it predicts what comes next, using only what it has learned from that data source. Think of the predictive keyboard on a phone, trained on nothing but your data.
What it has learned is the baseline: a mathematical picture of your normal. Nobody writes it down. You point Squirks at your data and it learns.
Surprise is how wrong the guess was
Each byte’s score is how surprised Squirks was to see it, counted in bits. One bit is a coin flip. Ten bits is one in a thousand. Twenty bits is one in a million. A byte Squirks was sure of scores zero.
This is a standard idea from information theory, the same math behind data compression: the less likely something is, the more information it carries. Squirks uses it as a measurement of how far each event sits from your baseline.
The short list
Add up an event’s bytes and you get its score. Squirks keeps a short list of the most surprising events. A new event gets on only if it is more surprising than the least surprising thing already there. That is the whole selection rule.
Making the list longer shows you more and costs more reading. That is a choice about caution, not a hidden dial.
Lookalikes become one line
Squirks sets aside the surprising stretches of each event and compares what is left. Events whose ordinary parts match are grouped into one line on the list, so a thousand similar attempts show up as one item with a count. Nobody writes grouping rules.
See it on a real event
The case study shows every byte of a real attack colored by its score, from blue for zero to red for the most surprising.