EncGuard Pro 加密通信恶意行为检测平台

event_id

runtime-97137509-e1aa-409e-8424-7f6af9f79a0c

flow_id

safe-lab-20260704092453-e82171-005-benign_ssh

src_ip

10.20.13.109

dst_ip

198.51.100.116

protocol

ssh

timestamp

2026-07-04T09:24:55.493068+00:00

风险等级

normal

检测类型

benign

detectors

rule_engine, anomaly_detector

source

mixed_scenario_lab

chain_related

False

final_risk_score

20

severity

normal

security_alert

False

rule_score

20

supervised_risk_score

19

calibrated_risk_score

67

anomaly_risk_score

91

final_risk_score

20

fusion_policy

max(rule_score, calibrated_risk_score, anomaly_risk_score)

gate_formula

risk=(1-g)*supervised_risk+g*anomaly_risk

该事件不属于弱覆盖场景，或无需额外补强说明。

predicted_label

benign

malicious_probability

0.1884

model_score

19

calibrated_risk_score

67

uncertainty_gate

0.671554

probability_entropy

0.644969

top2_margin

0.582697

js_divergence

0.125196

unknown_decision

False

model_supported_label

True

anomaly_score

77.545985

anomaly_risk_score

91

is_anomaly

True

• uploaded_file=mixed_scenario_features.csv
• input_label=benign
• uploaded feature row evaluated by EncGuard scenario rule engine
• anomaly_score=77.545985
• anomaly_risk_score=90.0
• anomaly treated as audit signal because rule and classifier context are benign
• uncertainty_gate=0.671554
• safe_lab_batch=safe-lab-20260704092453-e82171
• scenario=benign_ssh
• ground_truth_label=benign
• safe synthetic metadata only; no payload and no real attack execution

recommendation：Review uploaded feature context and validate whether this communication is authorized.

暂无攻击链关联。

• EncGuard 不解密 SSH/TLS/HTTPS/SFTP/SCP payload。
• 当前检测依据为连接元数据、流量统计、规则 evidence、模型预测、异常检测和攻击链聚合。
• post_bruteforce_action、encrypted_tunnel、data_exfiltration 主要由规则、攻击链或异常检测补强。

flow_id

safe-lab-20260704092453-e82171-005-benign_ssh

src_ip

10.20.13.109

dst_ip

198.51.100.116

src_port

55991

dst_port

22

protocol

ssh

start_time

2026-07-04T09:28:32Z

duration

16.5228

total_packets

261

total_bytes

1900787

fwd_packets

158

bwd_packets

103

fwd_bytes

1883090

bwd_bytes

17697

upload_download_ratio

106.407301

packets_per_second

15.796364

bytes_per_second

115040.319546

packet_size_mean

7282.708812

packet_size_std

190.521338

iat_mean

0.177174

iat_std

0.039459

same_src_conn_count_1min

2

same_src_conn_count_5min

1

short_connection_count_5min

2

long_session_flag

False

large_upload_flag

False

unknown_destination_flag

False

non_working_hour_flag

False

packet_direction_sequence_summary

balanced_bidirectional

packet_size_sequence_summary

stable_interactive

burst_count

1

interactive_gap_mean

0.177174

interactive_gap_std

0.039459

post_login_long_session_flag

False

command_like_burst_flag

False

failed_login_then_long_session_flag

False

scenario

benign_ssh

label

benign