inc-1789760783-1aab
AUDIT LOGGED
Detected Threat: PortScan from 198.51.100.77
Detected at: 2026-09-18 19:46:23 • Model Confidence: 93.4% • Last Updated: 2026-09-18 19:47:02
SHAP Feature Attribution Chart
Quantifies the positive/negative marginal contributions of network features toward this detection
+ Red: Drove Threat Classification
− Blue/Green: Pushed Toward Normal
Plain-Language Detection Rationale
Flagged as PortScan (100.0% confidence) due to unusually high count of contacted destination ports, elevated ratio of REJECT-action firewall/NACL drops, and unusual connection duration. The source IP is probing numerous destination ports in rapid succession with elevated connection rejects.
Autoencoder Reconstruction Profile
Flow Reconstruction Error (MSE)
1.1120
Baseline Anomaly Threshold
0.2488
Anomaly Confirmed: The Autoencoder's reconstruction loss exceeded the 95th-percentile baseline normal threshold, confirming unfamiliar traffic behavior.
Flow Log Extracted Telemetry
Flow Duration
1.20s
Total Packets (Fwd / Bwd)
3 / 0
Total Bytes Transferred
180 B
Throughput (Bytes/s)
150.0
Packet Rate (Packets/s)
2.5
Target Destination Port
80
Distinct Contacted Ports
45
Firewall Reject Ratio
92.0%