EncGuard Pro 加密通信恶意行为检测平台

event_id

runtime-d5c8fa0f-7e04-4b81-a220-317612a098d0

flow_id

safe-lab-20260704092453-e82171-007-benign_ssh

src_ip

10.24.8.217

dst_ip

203.0.113.64

protocol

ssh

timestamp

2026-07-04T09:24:55.493068+00:00

风险等级

normal

检测类型

benign

detectors

rule_engine, anomaly_detector

source

mixed_scenario_lab

chain_related

False

final_risk_score

20

severity

normal

security_alert

False

rule_score

20

supervised_risk_score

19

calibrated_risk_score

65

anomaly_risk_score

91

final_risk_score

20

fusion_policy

max(rule_score, calibrated_risk_score, anomaly_risk_score)

gate_formula

risk=(1-g)*supervised_risk+g*anomaly_risk

该事件不属于弱覆盖场景，或无需额外补强说明。

predicted_label

benign

malicious_probability

0.1944

model_score

19

calibrated_risk_score

65

uncertainty_gate

0.640799

probability_entropy

0.580156

top2_margin

0.59284

js_divergence

0.125875

unknown_decision

False

model_supported_label

True

anomaly_score

81.171835

anomaly_risk_score

91

is_anomaly

True

• uploaded_file=mixed_scenario_features.csv
• input_label=benign
• uploaded feature row evaluated by EncGuard scenario rule engine
• anomaly_score=81.171835
• anomaly_risk_score=90.0
• anomaly treated as audit signal because rule and classifier context are benign
• uncertainty_gate=0.640799
• safe_lab_batch=safe-lab-20260704092453-e82171
• scenario=benign_ssh
• ground_truth_label=benign
• safe synthetic metadata only; no payload and no real attack execution

recommendation：Review uploaded feature context and validate whether this communication is authorized.

暂无攻击链关联。

• EncGuard 不解密 SSH/TLS/HTTPS/SFTP/SCP payload。
• 当前检测依据为连接元数据、流量统计、规则 evidence、模型预测、异常检测和攻击链聚合。
• post_bruteforce_action、encrypted_tunnel、data_exfiltration 主要由规则、攻击链或异常检测补强。

flow_id

safe-lab-20260704092453-e82171-007-benign_ssh

src_ip

10.24.8.217

dst_ip

203.0.113.64

src_port

45481

dst_port

22

protocol

ssh

start_time

2026-07-04T09:30:06Z

duration

174.7605

total_packets

473

total_bytes

4361664

fwd_packets

281

bwd_packets

192

fwd_bytes

2951844

bwd_bytes

1409820

upload_download_ratio

2.093774

packets_per_second

2.706561

bytes_per_second

24957.948288

packet_size_mean

9221.276956

packet_size_std

202.814926

iat_mean

0.680985

iat_std

0.116509

same_src_conn_count_1min

1

same_src_conn_count_5min

1

short_connection_count_5min

3

long_session_flag

False

large_upload_flag

False

unknown_destination_flag

False

non_working_hour_flag

False

packet_direction_sequence_summary

balanced_bidirectional

packet_size_sequence_summary

stable_interactive

burst_count

1

interactive_gap_mean

0.680985

interactive_gap_std

0.116509

post_login_long_session_flag

False

command_like_burst_flag

False

failed_login_then_long_session_flag

False

scenario

benign_ssh

label

benign