NIDRAdemo console
Back to site
Earliest warning
—

No host projected to cross the threshold

Above threshold
0/ 4 hosts

Risk at or above 0.75 this window

Forecast horizon
3min

K=6 windows of 30s

State per host
45features

Context L=30 · stub pipeline

Host watch

Predicted stage mix

14:21:30 UTC · risk 0.087 [0.00–0.22]

  • benign87%
  • recon12%
  • initial_access0%
  • lateral0%
  • c20%
  • exfil0%

Forecast · 192.168.10.50

stage benignrisk 0.062origin 14:20:00 UTClead time —
0.000.501.00riskrisk threshold 0.75nowK = 6 windows · 3-minute horizon1 observed windows
14:20:00 UTC1/48 · 30s

Attack lifecycle

  1. benign
    87%
  2. recon
    12%
  3. initial_access
    0%
  4. lateral
    0%
  5. c2
    0%
  6. exfil
    0%

Observed benign. At k=3 the mass sits on benign (87.0%).

What is driving it

  • destination-port entropy steady+0.310
  • SYN ratio steady+0.167
  • new peers contacted steady+0.011
  • fan-out change steady+0.000

Saliency across 1 context windows (L=30). Window 0 drove it.

Synthesised CIC-IDS2017-Wednesday-shaped telemetry driven through the backend's own StubPredictor; stage narrative for the escalating host is scripted (the stub never claims late stages). Every forecast is validated by nidra_common.schemas.Forecast. Values illustrative of the pipeline's shape, not measurements.