阶段图
典型加密通信攻击路径
登录爆破
后续异常操作
异常加密隧道
数据外传风险
攻击链
加密通信攻击链分析
按源主机、目标服务、行为阶段和证据聚合异常路径，帮助安全人员从单条告警升级到完整处置线索。
攻击链数量
10
当前结果集
高频源
Top 攻击源
110.10.2.501
210.10.2.511
310.10.2.521
410.10.2.531
510.10.2.541
链路时间线
行为路径详情
严重风险
10.10.2.50 -> 10.10.1.10
95
ssh bruteforce to post action
- 事件 1
- SSH brute-force alert occurred before long SSH session
- same src_ip and dst_ip appeared in both alerts
严重风险
10.10.2.51 -> 10.10.1.10
90
ssh bruteforce to post action
- 事件 1
- long SSH session appeared after brute-force-like attempts
高风险
10.10.2.52 -> 10.10.1.11
84
ssh bruteforce to post action
- 事件 1
- SCP activity followed SSH brute-force-like attempts
高风险
10.10.2.53 -> 10.10.1.12
82
ssh bruteforce to post action
- 事件 1
- SSH long session correlated with prior short-session burst
高风险
10.10.2.54 -> 10.10.1.13
87
ssh bruteforce to post action
- 事件 1
- SFTP session followed a short SSH burst pattern
严重风险
10.10.4.60 -> 203.0.113.80
93
encrypted session to large upload
- 事件 1
- large outbound HTTPS transfer to unknown destination
严重风险
10.10.4.61 -> 203.0.113.81
96
encrypted session to large upload
- 事件 1
- large SFTP upload to unknown destination
高风险
10.10.4.62 -> 203.0.113.82
89
encrypted session to large upload
- 事件 1
- large SCP upload to unknown destination
严重风险
10.10.4.63 -> 198.51.100.80
94
encrypted session to large upload
- 事件 1
- large HTTPS upload with unknown destination
高风险
10.10.4.64 -> 198.51.100.81
88
encrypted session to large upload
- 事件 1
- large TLS upload to unknown destination