Better separation of attacks and requests that were recorded in learning mode

[zit-hb]

Currently there is almost no distinction between attack requests and learning requests. This can be confusing, especially when someone is new to the system. It should be clearly separated.