EncGuard Pro 加密通信恶意行为检测平台

event_id

runtime-2a5bad81-f604-44aa-ace9-1a3cd276e861

flow_id

safe-lab-20260704092453-e82171-006-benign_ssh

src_ip

10.25.3.228

dst_ip

198.51.100.135

protocol

ssh

timestamp

2026-07-04T09:24:55.493068+00:00

风险等级

normal

检测类型

benign

detectors

rule_engine, anomaly_detector

source

mixed_scenario_lab

chain_related

False

final_risk_score

20

severity

normal

security_alert

False

rule_score

20

supervised_risk_score

8

calibrated_risk_score

38

anomaly_risk_score

89

final_risk_score

20

fusion_policy

max(rule_score, calibrated_risk_score, anomaly_risk_score)

gate_formula

risk=(1-g)*supervised_risk+g*anomaly_risk

该事件不属于弱覆盖场景，或无需额外补强说明。

predicted_label

benign

malicious_probability

0.0784

model_score

8

calibrated_risk_score

38

uncertainty_gate

0.371069

probability_entropy

0.354627

top2_margin

0.827382

js_divergence

0.049912

unknown_decision

False

model_supported_label

True

anomaly_score

71.223334

anomaly_risk_score

89

is_anomaly

True

• uploaded_file=mixed_scenario_features.csv
• input_label=benign
• uploaded feature row evaluated by EncGuard scenario rule engine
• anomaly_score=71.223334
• anomaly_risk_score=90.0
• anomaly treated as audit signal because rule and classifier context are benign
• uncertainty_gate=0.371069
• safe_lab_batch=safe-lab-20260704092453-e82171
• scenario=benign_ssh
• ground_truth_label=benign
• safe synthetic metadata only; no payload and no real attack execution

recommendation：Review uploaded feature context and validate whether this communication is authorized.

暂无攻击链关联。

• EncGuard 不解密 SSH/TLS/HTTPS/SFTP/SCP payload。
• 当前检测依据为连接元数据、流量统计、规则 evidence、模型预测、异常检测和攻击链聚合。
• post_bruteforce_action、encrypted_tunnel、data_exfiltration 主要由规则、攻击链或异常检测补强。

flow_id

safe-lab-20260704092453-e82171-006-benign_ssh

src_ip

10.25.3.228

dst_ip

198.51.100.135

src_port

56789

dst_port

22

protocol

ssh

start_time

2026-07-04T09:29:07Z

duration

17.5706

total_packets

52

total_bytes

3257947

fwd_packets

24

bwd_packets

28

fwd_bytes

1002705

bwd_bytes

2255242

upload_download_ratio

0.444611

packets_per_second

2.959489

bytes_per_second

185420.363673

packet_size_mean

62652.826923

packet_size_std

114.030163

iat_mean

0.598174

iat_std

0.098907

same_src_conn_count_1min

3

same_src_conn_count_5min

3

short_connection_count_5min

0

long_session_flag

False

large_upload_flag

False

unknown_destination_flag

False

non_working_hour_flag

False

packet_direction_sequence_summary

balanced_bidirectional

packet_size_sequence_summary

stable_interactive

burst_count

0

interactive_gap_mean

0.598174

interactive_gap_std

0.098907

post_login_long_session_flag

False

command_like_burst_flag

False

failed_login_then_long_session_flag

False

scenario

benign_ssh

label

benign