EncGuard Pro 加密通信恶意行为检测平台

event_id

runtime-4b0df711-0c69-4042-b3a2-662dc947aff6

flow_id

safe-lab-20260704092453-e82171-011-ssh_failed_login_burst_like

src_ip

10.20.18.149

dst_ip

203.0.113.189

protocol

ssh

timestamp

2026-07-04T09:24:55.493068+00:00

风险等级

high

检测类型

ssh_bruteforce

detectors

rule_engine

source

mixed_scenario_lab

chain_related

False

final_risk_score

88

severity

high

security_alert

True

rule_score

88

supervised_risk_score

2

calibrated_risk_score

2

anomaly_risk_score

11

final_risk_score

88

fusion_policy

max(rule_score, calibrated_risk_score, anomaly_risk_score)

gate_formula

risk=(1-g)*supervised_risk+g*anomaly_risk

该事件不属于弱覆盖场景，或无需额外补强说明。

predicted_label

benign

malicious_probability

0.0246

model_score

2

calibrated_risk_score

2

uncertainty_gate

0.033835

probability_entropy

0.164379

top2_margin

0.942273

js_divergence

0.009963

unknown_decision

False

model_supported_label

True

anomaly_score

10.800013

anomaly_risk_score

11

is_anomaly

False

• uploaded_file=mixed_scenario_features.csv
• input_label=ssh_bruteforce
• uploaded feature row evaluated by EncGuard scenario rule engine
• uncertainty_gate=0.033835
• safe_lab_batch=safe-lab-20260704092453-e82171
• scenario=ssh_failed_login_burst_like
• ground_truth_label=ssh_bruteforce
• safe synthetic metadata only; no payload and no real attack execution

recommendation：Review uploaded feature context and validate whether this communication is authorized.

暂无攻击链关联。

• EncGuard 不解密 SSH/TLS/HTTPS/SFTP/SCP payload。
• 当前检测依据为连接元数据、流量统计、规则 evidence、模型预测、异常检测和攻击链聚合。
• post_bruteforce_action、encrypted_tunnel、data_exfiltration 主要由规则、攻击链或异常检测补强。

flow_id

safe-lab-20260704092453-e82171-011-ssh_failed_login_burst_like

src_ip

10.20.18.149

dst_ip

203.0.113.189

src_port

52115

dst_port

22

protocol

ssh

start_time

2026-07-04T09:34:36Z

duration

1.2835

total_packets

10

total_bytes

558

fwd_packets

9

bwd_packets

1

fwd_bytes

398

bwd_bytes

160

upload_download_ratio

2.4875

packets_per_second

7.791248

bytes_per_second

434.751611

packet_size_mean

55.8

packet_size_std

4.369831

iat_mean

0.069465

iat_std

0.015554

same_src_conn_count_1min

33

same_src_conn_count_5min

80

short_connection_count_5min

49

long_session_flag

False

large_upload_flag

False

unknown_destination_flag

False

non_working_hour_flag

True

packet_direction_sequence_summary

short_client_initiated_bursts

packet_size_sequence_summary

small_repeated_handshake_like

burst_count

14

interactive_gap_mean

0.069465

interactive_gap_std

0.015554

post_login_long_session_flag

False

command_like_burst_flag

True

failed_login_then_long_session_flag

False

scenario

ssh_failed_login_burst_like

label

ssh_bruteforce