Mlinzi — Campus Network Intrusion Detection

Threat level: ELEVATED

2 critical · 6 high · auto-mitigation engaged on 3 endpoints

ZONE: CAMPUS-WIDERULES: 1,284ML MODEL: v7.3

Active Sessions

12,847

▲ +312 / 5m

Packets / sec

184.2K

▲ +4.1% / 5m

Open Alerts

▲ +8 / 5m

Blocked Today

2,394

▲ +187 / 5m

Network Traffic / Anomaly Score

Throughput AnomalyLast 60s · live

AVG

69 Mbps

PEAK

89 Mbps

ANOMALIES

BASELINE σ

2.31

Active Alerts

LIVE

Malware Beacon
high
Periodic C2 callback signature match
54.97.89.129→dorm-eastwing-sw25m ago
Brute Force
high
47 failed SSH auth attempts in 60s
47.21.197.134→lib-wifi-ap-0424s ago
Suspicious DNS
low
DGA-style domain lookup detected
18.102.10.152→auth.sso.univ.edu3m ago
Port Scan
medium
Sequential SYN probes across 1024 ports
74.234.44.151→auth.sso.univ.edu1m ago
SQL Injection
high
Payload matches sqlmap fingerprint
98.78.90.28→auth.sso.univ.edu8m ago
Suspicious DNS
low
DGA-style domain lookup detected
169.191.127.9→cs-lab-router-015m ago
Data Exfiltration
critical
Outbound 2.4GB to unknown host
36.115.25.231→lib-wifi-ap-044m ago
SQL Injection
high
Payload matches sqlmap fingerprint
46.133.104.242→auth.sso.univ.edu5m ago
SQL Injection
high
Payload matches sqlmap fingerprint
142.172.48.128→moodle-app-019m ago
Malware Beacon
high
Periodic C2 callback signature match
196.179.90.18→physics-cluster-033m ago

auto-triage ONshowing 10 of 14

Global Threat Origin

attacks → campus

Nigeria3

Iran2

Russia2

Vietnam1

China1

Germany1

Protocol Mix

tcp/udp

HTTPS54%
DNS18%
SSH9%
SMB7%
Other12%

⚠ SSH traffic 38% above weekly baseline — see "Brute Force" alerts

Top Offending IPs

last 30m

54.97.89.129Vietnam1
47.21.197.134Iran1
18.102.10.152China1
74.234.44.151Germany1
98.78.90.28Russia1
169.191.127.9Brazil1
36.115.25.231Nigeria1

Packet Inspector — live tail

/var/log/sentinel/ids.log

13:56:06[EVT-CR.9R-1]MALWARE_BEACONsrc=54.97.89.129dst=10.42.27.199host=dorm-eastwing-sw2pkts=18072

14:00:42[EVT-V.ISH-2]BRUTE_FORCEsrc=47.21.197.134dst=10.42.103.217host=lib-wifi-ap-04pkts=37759

13:57:20[EVT-2.QSF-3]SUSPICIOUS_DNSsrc=18.102.10.152dst=10.42.150.109host=auth.sso.univ.edupkts=48399

13:59:19[EVT-G.UAC-4]PORT_SCANsrc=74.234.44.151dst=10.42.131.148host=auth.sso.univ.edupkts=30206

13:52:59[EVT-1W.W3-5]SQL_INJECTIONsrc=98.78.90.28dst=10.42.43.101host=auth.sso.univ.edupkts=15505

13:55:22[EVT-V9.FA-6]SUSPICIOUS_DNSsrc=169.191.127.9dst=10.42.220.223host=cs-lab-router-01pkts=7857

13:56:20[EVT-I.QXH-7]DATA_EXFILTRATIONsrc=36.115.25.231dst=10.42.61.2host=lib-wifi-ap-04pkts=13780

13:55:49[EVT-GU.VI-8]SQL_INJECTIONsrc=46.133.104.242dst=10.42.139.64host=auth.sso.univ.edupkts=25896

13:51:46[EVT-C.X2N-9]SQL_INJECTIONsrc=142.172.48.128dst=10.42.71.154host=moodle-app-01pkts=9371

13:57:42[EVT-N.H0K-10]MALWARE_BEACONsrc=196.179.90.18dst=10.42.112.99host=physics-cluster-03pkts=34074

13:57:19[EVT-0VT.A-11]ANOMALOUS_LOGINsrc=52.40.227.250dst=10.42.211.61host=dorm-eastwing-sw2pkts=4585

13:55:26[EVT-E.6DQ-12]DATA_EXFILTRATIONsrc=121.103.175.164dst=10.42.26.103host=registrar-db-prodpkts=21666

13:57:43[EVT-2.I9I-13]SUSPICIOUS_DNSsrc=22.125.108.89dst=10.42.208.209host=guest-portal-02pkts=8053

13:59:25[EVT-WT.TB-14]SUSPICIOUS_DNSsrc=100.214.46.91dst=10.42.182.115host=cs-lab-router-01pkts=29741