加密流量元数据与行为分析

EncGuard Pro 加密通信恶意行为检测平台

检测模式：规则检测 + 分类模型 + 异常检测 + 攻击链融合 模型状态：已启用

Alert Detail

告警详情

runtime-567a7e23-d8ca-4f7d-8d27-da1523df5806

模型预测与异常检测已拆分为 model_prediction 与 anomaly_result 两个解释区。

风险评分 88 high
Basic Info

基础信息

event_id
runtime-567a7e23-d8ca-4f7d-8d27-da1523df5806
flow_id
safe-lab-20260704092453-e82171-013-ssh_failed_login_burst_like
src_ip
10.18.8.201
dst_ip
198.51.100.57
protocol
ssh
timestamp
2026-07-04T09:24:55.493068+00:00
风险等级
high
检测类型
ssh_bruteforce
detectors
rule_engine
source
mixed_scenario_lab
chain_related
False
Risk Score

风险评分

final_risk_score
88
severity
high
security_alert
True
Risk Formation

最终风险形成

rule_score
88
supervised_risk_score
2
calibrated_risk_score
2
anomaly_risk_score
17
final_risk_score
88
fusion_policy
max(rule_score, calibrated_risk_score, anomaly_risk_score)
gate_formula
risk=(1-g)*supervised_risk+g*anomaly_risk
Weak Scenario Support

弱覆盖场景补强证据

该事件不属于弱覆盖场景，或无需额外补强说明。

Model Prediction

模型预测 model_prediction

predicted_label
benign
malicious_probability
0.0153
model_score
2
calibrated_risk_score
2
uncertainty_gate
0.031174
probability_entropy
0.090902
top2_margin
0.96775
js_divergence
0.009761
unknown_decision
False
model_supported_label
True
Anomaly Detection

异常检测 anomaly_result

anomaly_score
17.496365
anomaly_risk_score
17
is_anomaly
False
Rule Hits

规则 evidence

ssh_bruteforce scenario_rule_engine · risk_score=88
Evidence

推荐处置 recommendation

  • uploaded_file=mixed_scenario_features.csv
  • input_label=ssh_bruteforce
  • uploaded feature row evaluated by EncGuard scenario rule engine
  • uncertainty_gate=0.031174
  • safe_lab_batch=safe-lab-20260704092453-e82171
  • scenario=ssh_failed_login_burst_like
  • ground_truth_label=ssh_bruteforce
  • safe synthetic metadata only; no payload and no real attack execution

recommendation：Review uploaded feature context and validate whether this communication is authorized.

Attack Chain

攻击链关联 attack_chain

暂无攻击链关联。

Safety Boundary

安全边界说明

  • EncGuard 不解密 SSH/TLS/HTTPS/SFTP/SCP payload。
  • 当前检测依据为连接元数据、流量统计、规则 evidence、模型预测、异常检测和攻击链聚合。
  • post_bruteforce_action、encrypted_tunnel、data_exfiltration 主要由规则、攻击链或异常检测补强。
Raw Feature

原始特征详情

flow_id
safe-lab-20260704092453-e82171-013-ssh_failed_login_burst_like
src_ip
10.18.8.201
dst_ip
198.51.100.57
src_port
58829
dst_port
22
protocol
ssh
start_time
2026-07-04T09:36:05Z
duration
1.2707
total_packets
21
total_bytes
883
fwd_packets
9
bwd_packets
12
fwd_bytes
485
bwd_bytes
398
upload_download_ratio
1.218593
packets_per_second
16.525892
bytes_per_second
694.874398
packet_size_mean
42.047619
packet_size_std
4.265124
iat_mean
0.076033
iat_std
0.015073
same_src_conn_count_1min
33
same_src_conn_count_5min
85
short_connection_count_5min
43
long_session_flag
False
large_upload_flag
False
unknown_destination_flag
False
non_working_hour_flag
True
packet_direction_sequence_summary
short_client_initiated_bursts
packet_size_sequence_summary
small_repeated_handshake_like
burst_count
18
interactive_gap_mean
0.076033
interactive_gap_std
0.015073
post_login_long_session_flag
False
command_like_burst_flag
True
failed_login_then_long_session_flag
False
scenario
ssh_failed_login_burst_like
label
ssh_bruteforce
Related Events

相关事件

同源 IP 相关事件

暂无同源相关事件。

同目的 IP 相关事件

暂无同目的相关事件。