第 1 层 · SENSE · 四层架构
在推理开始之前,必须有真实的观测。我们的蜜罐传感器伪装成互联网上的脆弱服务,接收真实的攻击流量。这里没有任何合成数据:以下每个数字都是对生产遥测的实时查询。
Vulnerable-looking services exposed on purpose. Attackers find them the same way they find anything: scanning.
Each probe is logged as an event — source, timing, protocol, payload shape. Individually noise; in aggregate, a live map of adversarial behaviour.
IPs, credential patterns, fingerprints — indicators of compromise ready for correlation in layer 02.
Arrivals follow $P(k) = (\lambda t)^k e^{-\lambda t}/k!$ per window. λ is estimated live from the last hour; the homepage overlays observed counts on this model. Deviation from the model is itself signal.