加密流量元数据与行为分析

EncGuard Pro 加密通信恶意行为检测平台

检测模式：规则检测 + 分类模型 + 异常检测 + 攻击链融合 模型状态：已启用

Alert Detail

告警详情

runtime-377453cb-1bb9-4d44-85cf-e001fcd565bb

模型预测与异常检测已拆分为 model_prediction 与 anomaly_result 两个解释区。

风险评分 95 critical
Basic Info

基础信息

event_id
runtime-377453cb-1bb9-4d44-85cf-e001fcd565bb
flow_id
safe-lab-20260704092453-e82171-033-encrypted_tunnel_like
src_ip
10.20.7.81
dst_ip
203.0.113.211
protocol
tls
timestamp
2026-07-04T09:24:55.493068+00:00
风险等级
critical
检测类型
encrypted_tunnel
detectors
rule_engine, anomaly_detector, attack_chain
source
mixed_scenario_lab
chain_related
True
Risk Score

风险评分

final_risk_score
95
severity
critical
security_alert
True
Risk Formation

最终风险形成

rule_score
95
supervised_risk_score
3
calibrated_risk_score
25
anomaly_risk_score
93
final_risk_score
95
fusion_policy
max(rule_score, calibrated_risk_score, anomaly_risk_score)
gate_formula
risk=(1-g)*supervised_risk+g*anomaly_risk
Weak Scenario Support

弱覆盖场景补强证据

scenarios
encrypted_tunnel
support_type
rule_anomaly_gate_attack_chain_supported
model_claim
not_strong_supervised_label
explanation
This scenario is supported by rules, anomaly detection, uncertainty gate, and chain evidence rather than claimed as a strongly supervised classifier label.
Model Prediction

模型预测 model_prediction

predicted_label
benign
malicious_probability
0.031
model_score
3
calibrated_risk_score
25
uncertainty_gate
0.240628
probability_entropy
0.14198
top2_margin
0.937601
js_divergence
0.033152
unknown_decision
False
model_supported_label
True

该场景主要由规则、攻击链或异常检测补强，不应表述为当前模型可靠覆盖。

Anomaly Detection

异常检测 anomaly_result

anomaly_score
88.335663
anomaly_risk_score
93
is_anomaly
True
Rule Hits

规则 evidence

encrypted_tunnel scenario_rule_engine · risk_score=95
Evidence

推荐处置 recommendation

  • uploaded_file=mixed_scenario_features.csv
  • input_label=encrypted_tunnel
  • uploaded feature row evaluated by EncGuard scenario rule engine
  • anomaly_score=88.335663
  • anomaly_risk_score=90.0
  • uncertainty_gate=0.240628
  • safe_lab_batch=safe-lab-20260704092453-e82171
  • scenario=encrypted_tunnel_like
  • ground_truth_label=encrypted_tunnel
  • safe synthetic metadata only; no payload and no real attack execution

recommendation：Review uploaded feature context and validate whether this communication is authorized.

Attack Chain

攻击链关联 attack_chain

post_action_to_encrypted_tunnel chain_id=inferred-2 · risk_score=95
encrypted_tunnel_to_data_exfiltration chain_id=inferred-3 · risk_score=95
Safety Boundary

安全边界说明

  • EncGuard 不解密 SSH/TLS/HTTPS/SFTP/SCP payload。
  • 当前检测依据为连接元数据、流量统计、规则 evidence、模型预测、异常检测和攻击链聚合。
  • post_bruteforce_action、encrypted_tunnel、data_exfiltration 主要由规则、攻击链或异常检测补强。
Raw Feature

原始特征详情

flow_id
safe-lab-20260704092453-e82171-033-encrypted_tunnel_like
src_ip
10.20.7.81
dst_ip
203.0.113.211
src_port
46963
dst_port
8443
protocol
tls
start_time
2026-07-04T09:52:47Z
duration
7283.0992
total_packets
229875
total_bytes
204726790
fwd_packets
121575
bwd_packets
108300
fwd_bytes
65299975
bwd_bytes
139426815
upload_download_ratio
0.468346
packets_per_second
31.562799
bytes_per_second
28109.844891
packet_size_mean
890.6005
packet_size_std
54.354206
iat_mean
0.04327
iat_std
0.006028
same_src_conn_count_1min
1
same_src_conn_count_5min
6
short_connection_count_5min
2
long_session_flag
True
large_upload_flag
False
unknown_destination_flag
True
non_working_hour_flag
True
packet_direction_sequence_summary
persistent_bidirectional_stream
packet_size_sequence_summary
low_variance_long_session_like
burst_count
23
interactive_gap_mean
0.04327
interactive_gap_std
0.006028
post_login_long_session_flag
False
command_like_burst_flag
False
failed_login_then_long_session_flag
False
scenario
encrypted_tunnel_like
label
encrypted_tunnel
Related Events

相关事件