Mlinzi — Campus Network Intrusion Detection

Threat level: ELEVATED

3 critical · 6 high · auto-mitigation engaged on 3 endpoints

ZONE: CAMPUS-WIDERULES: 1,284ML MODEL: v7.3

Active Sessions

12,847

▲ +312 / 5m

Packets / sec

184.2K

▲ +4.1% / 5m

Open Alerts

▲ +9 / 5m

Blocked Today

2,394

▲ +187 / 5m

Network Traffic / Anomaly Score

Throughput AnomalyLast 60s · live

AVG

69 Mbps

PEAK

91 Mbps

ANOMALIES

BASELINE σ

2.31

Active Alerts

LIVE

DDoS Attempt
critical
Volumetric UDP flood detected
75.192.102.136→lib-wifi-ap-049m ago
Brute Force
high
47 failed SSH auth attempts in 60s
116.82.52.191→moodle-app-016m ago
Suspicious DNS
low
DGA-style domain lookup detected
15.165.152.122→physics-cluster-0318s ago
Anomalous Login
medium
Login from unusual geo + new device
52.78.51.148→physics-cluster-037m ago
SQL Injection
high
Payload matches sqlmap fingerprint
142.121.49.172→dorm-eastwing-sw21m ago
Brute Force
high
47 failed SSH auth attempts in 60s
40.138.239.41→registrar-db-prod2m ago
Malware Beacon
high
Periodic C2 callback signature match
15.41.106.68→registrar-db-prod4m ago
Suspicious DNS
low
DGA-style domain lookup detected
16.131.124.4→auth.sso.univ.edu4m ago
Data Exfiltration
critical
Outbound 2.4GB to unknown host
121.100.224.226→physics-cluster-033m ago
Port Scan
medium
Sequential SYN probes across 1024 ports
27.157.121.16→dorm-eastwing-sw29m ago

auto-triage ONshowing 10 of 14

Global Threat Origin

attacks → campus

Germany3

China3

Brazil2

Canada2

United States1

Iran1

Protocol Mix

tcp/udp

HTTPS54%
DNS18%
SSH9%
SMB7%
Other12%

⚠ SSH traffic 38% above weekly baseline — see "Brute Force" alerts

Top Offending IPs

last 30m

75.192.102.136United States1
116.82.52.191Germany1
15.165.152.122China1
52.78.51.148Brazil1
142.121.49.172Iran1
40.138.239.41Brazil1
15.41.106.68Germany1

Packet Inspector — live tail

/var/log/sentinel/ids.log

13:42:20[EVT-5YY.2-1]DDOS_ATTEMPTsrc=75.192.102.136dst=10.42.246.140host=lib-wifi-ap-04pkts=48336

13:45:14[EVT-M.REK-2]BRUTE_FORCEsrc=116.82.52.191dst=10.42.35.21host=moodle-app-01pkts=28121

13:51:50[EVT-Q.SAI-3]SUSPICIOUS_DNSsrc=15.165.152.122dst=10.42.244.28host=physics-cluster-03pkts=14346

13:44:17[EVT-3F.JU-4]ANOMALOUS_LOGINsrc=52.78.51.148dst=10.42.41.42host=physics-cluster-03pkts=21007

13:50:09[EVT-E.HRS-5]SQL_INJECTIONsrc=142.121.49.172dst=10.42.188.181host=dorm-eastwing-sw2pkts=10408

13:49:58[EVT-8F.EF-6]BRUTE_FORCEsrc=40.138.239.41dst=10.42.51.11host=registrar-db-prodpkts=41652

13:47:30[EVT-W.I36-7]MALWARE_BEACONsrc=15.41.106.68dst=10.42.225.201host=registrar-db-prodpkts=31878

13:48:04[EVT-Z.RZG-8]SUSPICIOUS_DNSsrc=16.131.124.4dst=10.42.135.12host=auth.sso.univ.edupkts=38488

13:48:36[EVT-T4.IU-9]DATA_EXFILTRATIONsrc=121.100.224.226dst=10.42.22.239host=physics-cluster-03pkts=21652

13:42:22[EVT-I.8DJ-10]PORT_SCANsrc=27.157.121.16dst=10.42.140.58host=dorm-eastwing-sw2pkts=18792

13:49:22[EVT-F.95P-11]DATA_EXFILTRATIONsrc=134.93.154.164dst=10.42.152.50host=physics-cluster-03pkts=22765

13:42:41[EVT-T.JZI-12]ANOMALOUS_LOGINsrc=202.158.242.228dst=10.42.144.138host=cs-lab-router-01pkts=34515

13:45:14[EVT-I.XDE-13]SQL_INJECTIONsrc=63.139.25.153dst=10.42.5.77host=moodle-app-01pkts=28847

13:51:44[EVT-9.A4I-14]SQL_INJECTIONsrc=31.198.32.230dst=10.42.182.238host=dorm-eastwing-sw2pkts=19073