diff --git a/.replit b/.replit
index 8eace38..3dc4618 100644
--- a/.replit
+++ b/.replit
@@ -18,10 +18,6 @@ externalPort = 80
 localPort = 41303
 externalPort = 3002
 
-[[ports]]
-localPort = 41797
-externalPort = 3001
-
 [[ports]]
 localPort = 43471
 externalPort = 3003
diff --git a/python_ml/compare_models.py b/python_ml/compare_models.py
index 3429ff5..46f0cf5 100644
--- a/python_ml/compare_models.py
+++ b/python_ml/compare_models.py
@@ -116,6 +116,13 @@ def reanalyze_with_hybrid(detector, ip_address, old_detection):
     new_detection = result[0]
     
     # Confronto
+    new_score = new_detection.get('risk_score', 0)
+    new_type = new_detection.get('anomaly_type', 'unknown')
+    new_confidence = new_detection.get('confidence_level', 'unknown')
+    
+    # Determina se è anomalia (score >= 80 = critical threshold)
+    new_is_anomaly = new_score >= 80
+    
     comparison = {
         'ip_address': ip_address,
         'logs_count': len(logs),
@@ -126,14 +133,14 @@ def reanalyze_with_hybrid(detector, ip_address, old_detection):
         'old_blocked': old_detection['blocked'],
         
         # Nuovo modello Hybrid (rianalisi)
-        'new_score': new_detection.get('anomaly_score', 0),
-        'new_anomaly_type': new_detection.get('anomaly_type', 'unknown'),
-        'new_confidence': new_detection.get('confidence', 'unknown'),
-        'new_is_anomaly': new_detection.get('is_anomaly', False),
+        'new_score': new_score,
+        'new_anomaly_type': new_type,
+        'new_confidence': new_confidence,
+        'new_is_anomaly': new_is_anomaly,
         
         # Delta
-        'score_delta': new_detection.get('anomaly_score', 0) - float(old_detection['risk_score']),
-        'type_changed': old_detection['anomaly_type'] != new_detection.get('anomaly_type', 'unknown'),
+        'score_delta': new_score - float(old_detection['risk_score']),
+        'type_changed': old_detection['anomaly_type'] != new_type,
     }
     
     return comparison