Этот сайт использует файлы cookies. Продолжая просмотр страниц сайта, вы соглашаетесь с использованием файлов cookies. Если вам нужна дополнительная информация, пожалуйста, посетите страницу Политика файлов Cookie

Прямой эфир

Русский

English

Войти / Регистрация

Cryptocurrencies: 8192 / Markets: 112938

Market Cap: $ 2 061 433 945 644 / 24h Vol: $ 94 435 845 989 / BTC Dominance: 58.073579585229%

Н Новости

От сигнатур к ML IDS: чему IDS Suricata может научить модель?

В настоящее время для противодействия компьютерным атакам применяются разнообразные средства защиты информации:

межсетевые экраны;
системы обнаружения вторжений уровня сети;
системы обнаружения вторжений уровня хоста;
межсетевые экраны нового поколения (NGFW);
SIEM системы (также называемые – событийные системы обнаружения компьютерных атак);
криптографические средства защиты сетей связи;
и другие классы средств.

Каждое из перечисленных выше средств обладает своими достоинствами и недостатками, а выбор в применяемых средствах конкретной компанией зависит от разных причин: финансовых, инфраструктурных или других.

Системы обнаружения атак уровня сети

Основным способом выявления компьютерных атак остается применение сигнатурного анализа. Главным его недостатком является практически нулевая вероятность обнаружения новых или модифицированных деструктивных сетевых воздействий.

Следовательно, решение задачи обнаружения модифицированных и, желательно, новых компьютерных атак с использованием эвристических или интеллектуальных методов (ML IDS) является актуальной и перспективной.

Формулировки задачи построения ML IDS уровня сети:

Провести классификацию сетевого трафика, разделив его на 2 (или более) класса: «чистый» сетевой трафик и компьютерная атака (деструктивное воздействие). Если есть возможность, то класс компьютерных атак разбивают на подклассы и тогда можно говорить о много классовой классификации.
выявить аномалию (аномальное сетевое соединение / сетевую сессию / сетевой пакет) в сети связи.

Принципиальные отличия в формулировках задач построения ML IDS:

при построении классификатора сетевого трафика для обучения ML IDS требуется размеченный датасет, содержащий образцы (вектора признаков), принадлежащие всем распознаваемым классам, что в «реальной» жизни может быть затруднительно.
Некоторые причины затруднений формирования датасетов: владелец защищаемого ресурса может быть против того, чтобы атаковали его ресурс; невозможно создать точную модель защищаемого ресурса с необходимой инфраструктурой создать затруднительно; множество инструментов атак открытое и «хороший» датасет собрать сложно и другие причины;
при построении системы выявления аномалий исследователю известен только один вид трафика: "чистый" сетевой трафик, не содержащий признаков деструктивных воздействий.

Подробнее про процесс разработки ML IDS, а также атаках на ML IDS можно прочитать в статье "Состязательные атаки против системы обнаружения вторжений, основанной на применении методов машинного обучения".

В данной публикации пойдет речь о построении системы обнаружения вторжений уровня сети с использованием методов машинного обучения (далее ML IDS).

Попыток построить ML IDS уровня сети с использованием классификаторов достаточно много и в статьях результаты зачастую очень хорошие (например, "Синтез модели машинного обучения для обнаружения компьютерных атак на основе набора данных CICIDS2017").

Однако сами авторы признаются, что высокое качество классификации наблюдается исключительно на их стендах (инфраструктуре), там, где происходило обучение моделей, а их перенос на другие сети связи показывает более низкие результаты. Это связано с тем, что наиболее известные инструменты сбора и разметки сетевого трафика для ML IDS уровня сети формируют вектора признаков, содержащих признаки, непосредственно зависящие от физической структуры сети, в которой производился сбор сетевого трафика, настроек сетевого оборудования, а также конкретных реализаций сетевых сервисов. Отличия же в них приводят к возникновению ошибок классификатора и снижению точности модели.

О чем же эта статья?

В связи с вышесказанным у авторов статьи возникли вопросы:

можно ли построить ML IDS уровня сети на уже эксплуатируемой сети связи?
можно ли обучить ML IDS не атакуя защищаемый ресурс намеренно? Другими словами: можно ли обучить ML IDS опираясь на зарегистрированные классическими средствами обнаружения вторжений события (например, IDS Suricata)?
какие возникают при этом трудности?
какое при этом ожидать качество классификации?
какие при этом будут ограничения?

Для ответа на эти вопросы была выдвинута гипотеза о возможности построения ML IDS уровня сети с применением событий безопасности, зарегистрированных IDS Suricata, для разметки датасетов.

Для формирования векторов признаков сетевого трафика был разработан собственный инструмент расчета значений вектора признаков сетевого трафика для каждого сетевого соединения session_analyzer (в проведенном нами исследовании использовался только протокол TCP, в общем случае инструмент позволяет проводить анализ и других протоколов).

Необходимо отметить, что утилита session_analyzer – это аналог инструмента разметки сетевого трафика NTLFlowLyzer (https://github.com/ahlashkari/CICFlowMeter).

Описание процесса функционирования инструмента session_analyzer

Принципы формирования векторов признаков сетевого трафика, реализованный в утилите session_analyzer

Анализу подлежат все сетевые пакеты следующих сетевых протоколов: Ethernet II, MPLS, VLAN, IPv4, TCP, UDP, ICMPv4. Сетевые пакеты других протоколов канального, сетевого и транспортного уровня отбрасываются.
Идентификатором сетевой сессии (Flow ID) является символьная последовательность, состоящая из 5 компонент (5-Tuple): Destination IP-Source IP-Destination Port-Source Port-Proto.
Под сетевой сессией понимается последовательность сетевых пакетов принадлежащих одному TCP соединению, UDP потоку или последовательности ICMP пакетов (ICMP поток).
Идентификация принадлежности пакета к определенной сессии осуществляется по совпадению адресной информации 5-Tuple:
или Destination IP-Source IP-Destination Port-Source Port-Proto;
или Source IP- Destination IP- Source Port-Destination Port-Proto.
Критерий начала сетевой сессии:
– TCP сессия (соединение) регистрируется и для нее производится расчет вектора признаков только в том случае, если в наблюдаемой сессии первым пакетом был сетевой пакет с установленным флагом SYN=1 и флагом ACK = 0 в TCP пакете. По данному пакету определяется направление передачи данных (т.е. какой IP адрес считается источником (отправителем / клиентом) и какой IP адрес считается адресом назначения (сервером);
– UDP / ICMP сессия (поток) регистрируется при появлении первого сетевого пакета с новым идентификатором пакета. По первому пакету определяется направление (инициатор) передачи данных. При таком подходе возможна ошибка определения направления передачи данных (например, session_analyzer в начальный момент времени, сразу после своего запуска может увидеть первым и единственным пакетом DNS ответ, и данный пакет будет проанализирован).
Критерий окончания сетевой сессии:
– для любых сетевых сессий встроен таймаут, таймаут отсчитывается от последнего принятого пакета в сетевой сессии. В конфигурационных файлах задаются 3 таймаута, выраженных в миллисекундах.
Значения по умолчанию:
tcp_session_timeout = 60000 – для TCP сессий;
udp_session_timeout = 60000 – для UDP сессий;
icmp_session_timeout = 60000 – для ICMP пакетов, относящихся к одной сессии.
– дополнительно для TCP сессий отслеживаются пакеты разрыва TCP соединений, предусмотрены ожидание следующих сценариев разрыва соединений:
сценарий 1: клиент или сервер присылает пакет с установленным флагом RST, после такого пакета сессия считается закрытой;
сценарий 2: клиент является инициатором разрыва соединения и посылает пакет с установленным флагом FIN, тогда возможны 2 варианта ответа от сервера:
– если сервер присылает пакет с установленным флагом RST, то сессия считается закрытой;
– если анализатор получает пакет от клиента или сервера с установленным флагом FIN, то анализатор запускает стандартный механизм отслеживания подтверждения получения данных (SeqNumber и AсkNumber) для двух сторон взаимодействия, после подтверждения (установленный файл ACK) обоими сторонами получения пакетов с установленными флагами FIN сессия считается закрытой.
Поток (в названиях признаков – Flow) сетевых пакетов – это строгая (т.е. важен порядок следования) последовательность сетевых пакетов, которые принимает анализатор в рамках одной сетевой сессии. Очевидно, что в данном случае направление передачи данных не учитывается.
Поток сетевых пакетов в направлении Forward (в названиях признаков – Fwd) – это строгая последовательность сетевых пакетов, передаваемых от клиента к серверу, в рамках одной сетевой сессии.
Поток сетевых пакетов в направлении Backward (в названиях признаков – Bwd) – это строгая последовательность сетевых пакетов, передаваемых от сервера к клиенту, в рамках одной сетевой сессии.
Длительность сетевой сессии может быть рассчитана 2 способами:
– от времени первого пакета в сетевой сессии до времени поступления последнего пакета в сетевой сессии (параметр в конфигурационном файле: is_need_calc_duration_by_last_payload = false);
– от времени первого пакета в сетевой сессии до времени поступления последнего пакета с полезными данными (где длина payload > 0) в сетевой сессии (параметр в конфигурационном файле: is_need_calc_duration_by_last_payload = true).
Для оценки «единственности / независимости» текущей сетевой сессии было введено понятие потока сетевых сессий от заданного источника сессий на заданный сетевой ресурс – это множество сетевых сессий созданных между одним хостом (Source IP) и заданным сетевым сервисом (Destination IP + Destination Port + Proto). Т.е. идентификатором потока сетевых сессии является число сформированная конкатенацией четырех чисел:
stream_id = IP-Source | IP-Destination | Port- Destination | Proto.
Для описания «единственности / независимости» текущей сетевой сессии используются различные признаки, которые характеризуют:
– наличие параллельных сетевых сессии для текущего потока сетевых сессии;
– время возникновения текущей сетевой сессии по сравнению с параллельными сетевыми сессиями для данного потока сессий;
– время между появлениями сетевых сессии для данного потока сессий.
Множество признаки данной группы в названиях содержат слово Stream.
Сетевые сессии в потоке считаются «независимыми» – это время между созданием сетевых сессий в потоке превышает заданный порог session_simple_timeout.
По умолчанию, session_simple_timeout = 60000000 микросекунд.
Временной интервал между текущей сессий и предыдущей сессией в потоке сетевых сессий ограничен порогом session_time_prev_absent, если текущая сессия является первой в потоке сессий или время ее создания превышает session_time_prev_absent, то значение соответствующего признака выставляется равным session_time_prev_absent.
По умолчанию, session_time_prev_absent = 60000000 микросекунд.
Временной интервал между текущей сессий и следующей сессией (если такое время можно измерить, т.е. новая сессия создана раньше времени окончания текущей в потоке сессий) в потоке сетевых сессий также ограничен порогом session_time_next_absent, если текущая сессия является последней в потоке сессий или время создания следующей сессии превышает session_time_next_absent, то значение соответствующего признака выставляется равным session_time_next_absent.
По умолчанию, session_time_next_absent = 60000000 микросекунд.
Значения признаков, характеризующих последовательность сетевых пакетов относящихся к одной сетевой сессии, могут быть рассмотрены как случайная величина. Для такой случайной величины рассчитываются следующие характеристики: количество значений в последовательности, минимальной и максимальное значение случайной величины, оценка математического ожидания, несмещенная оценка дисперсии случайной величины и несмещенная оценка среднеквадратичного отклонения случайной величины (таблица 1).
Для описания каждой сетевой сессии формируется вектор из 118 признаков (ниже представлено их описание). Названия ряда нижеперечисленных признаков взяты из перечня признаков инструмента CICFlowMeter, при расчете значений признаков были учтены недостатки, выявленные нами и указанные в статье: "Я больше не верю публичным датасетам".

Расчет значений вектора признаков сетевого трафика, реализованный в утилите session_analyzer

Для расчета некоторых характеристик случайной величины, при классическом способе расчета, необходимо хранить все значения последовательности, для же экономии памяти можно использовать алгоритмы online математики (метод Уэлфорда для расчета оценок математического ожидания, несмещенной оценки дисперсии и несмещенной оценки среднеквадратичного отклонения случайной величины).

Перечень характеристик случайной величины и выражения для из расчета.

Количество значений в последовательности. Сокращение (префикс) добавляемый к названию признака – Count.
Минимальное значение случайной величины в последовательности. Сокращение (префикс) добавляемый к названию признака – Min.
Максимальное значение случайной величины в последовательности. Сокращение (префикс) добавляемый к названию признака – Max.
Оценка математического ожидания случайной величины. Сокращение (префикс) добавляемый к названию признака – Mean.
Классический способ расчета:
$Mean={1\over n}*\displaystyle\sum_{i=1}^n{x_i}$
Online способ расчета:
$Mean_0=0; Mean_i = Mean_{i-1}+{(x_i-Mean_{i-1})\over Count}$
Несмещенная оценка дисперсии случайной величины. Сокращение (префикс) добавляемый к названию признака – Variance.
Классический способ расчета:
$Variance={1\over {n-1}}*\displaystyle\sum_{i=1}^n{{(x_i-Mean)^2}}$
Online способ расчета:
$Var_i=Var_{i-1}+(x_i-Mean_{i-1})*(x_i-Mean_i);$ $При Count>1: Variance={Var_i \over Count}$
Несмещенная оценка среднеквадратичного отклонения случайной величины. Сокращение (префикс) добавляемый к названию признака – Std.

$Std=\sqrt{Variance}$

Описание признаков, характеризующих сетевые сессии

№ п/п	Обозначение признака в наборе данных	Описание	Тип данных, пример
1.	Session Index	Индекс сессии	Целое число, 0
2.	SNI	Server Name Indication. Имя сервера, указанное в пакете ClientHello протокола TLS/SSL	Символьная строка, dvwa.isp
3.	Flow ID	Идентификатор сессии	Символьная строка, 172.18.0.2-85.249.84.244-443-41782-6
4.	Source IP	IP адрес источника сетевой сессии	Символьная строка, 85.249.84.244
5.	Source Port	Port транспортного уровня источника сетевой сессии	Целое 16-битное число, 41782
6.	Destination IP	IP адрес назначения сетевой сессии	Символьная строка, 172.18.0.2
7.	Destination Port	Port транспортного уровня назначения сетевой сессии	Целое 16-битное число, 443
8.	Protocol	Протокол транспортного уровня, может принимать следующие значения: 1 – ICMP, 6 – TCP, 17 – UDP	Целое 8 битное число, 6
9.	Timestamp	Метка времени, формат метки: число.месяц.год час:мин.микросекунды	Символьная строка, 16.11.2021 11:41
10.	Flow Duration	Длительность сессии в микросекундах	Целое 64-битное число, 9772334
11.	Total Fwd Packets	Количество сетевых пакетов, переданных в направлении от клиента к серверу	Целое 64-битное число, 13
12.	Total Backward Packets	Количество сетевых пакетов, переданных в направлении от сервера к клиенту	Целое 64-битное число, 11
13.	Total Length of Fwd Packets	Суммарная длина полезных данных (payload) в байтах, переданных от клиента к серверу	Целое 64-битное число, 1929
14.	Total Length of Bwd Packets	Суммарная длина полезных данных (payload) в байтах, переданных от сервера к клиенту	Целое 64-битное число, 3695
Статистические характеристики длин передаваемых полезных данных (payload) в направлении Forward (от клиента к серверу), в байтах
15.	Fwd Packet Length Max	Максимальная длина пакета	Целое 64-битное число, 672
16.	Fwd Packet Length Min	Минимальная длина пакета	Целое 64-битное число, 0
17.	Fwd Packet Length Mean	Оценка математического ожидания длин пакетов (средняя длина пакета)	Вещественное число, 148.38461538
18.	Fwd Packet Length Std	Несмещенная оценка среднеквадратичного отклонения длин пакетов	Вещественное число, 262.28341492
Статистические характеристики длин передаваемых полезных данных (payload) в направлении Backward (от сервера к клиенту), в байтах
19.	Bwd Packet Length Max	Максимальная длина пакета	Целое 64-битное число, 1415
20.	Bwd Packet Length Min	Минимальная длина пакета	Целое 64-битное число, 0
21.	Bwd Packet Length Mean	Оценка математического ожидания длин пакетов (средняя длина пакета)	Вещественное число, 335.90909091
22.	Bwd Packet Length Std	Несмещенная оценка среднеквадратичного отклонения длин пакетов	Вещественное число, 539.65793880
23.	Flow Bytes/s	Отношение суммарной длины переданных полезных данных (payload) (в байтах) к длительности сетевой сессии (в секундах). Длительность сетевой сессии может быть рассчитана 2 способами см. п. 10	Вещественное число, 575.50222905
24.	Flow Packets/s	Отношение общего количества сетевых пакетов в сетевой сессии к длительности сетевой сессии (в секундах). Длительность сетевой сессии может быть рассчитана 2 способами см. п. 10.	Вещественное число, 2.45591278
Статистические характеристики межпакетных интервалов в потоке сетевых пакетов Flow (без учета направления передачи данных), первый пакет сетевой сессии считается началом отсчета времени, первое значение межпакетного интервала рассчитывается при получении второго пакета (не зависимо от направления передачи данных). Межпакетные интервалы измеряются в микросекундах
25.	Flow IAT Mean	Оценка математического ожидания межпакетных интервалов	Вещественное число, 424884.0869565
26.	Flow IAT Std	Несмещенная оценка среднеквадратичного отклонения межпакетных интервалов	Вещественное число, 1349427.122279
27.	Flow IAT Max	Максимальное значение межпакетного интервала	Целое 64-битное число, 4952858
28.	Flow IAT Min	Минимальное значение межпакетного интервала	Целое 64-битное число, 17
Статистические характеристики межпакетных интервалов в потоке сетевых пакетов Forward (от клиента к серверу), первый пакет в направлении Forward считается началом отсчета времени, первое значение межпакетного интервала рассчитывается при получении второго пакета в направлении Forward. Межпакетные интервалы измеряются в микросекундах
29.	Fwd IAT Total	Суммарное значение всех межпакетных интервалов в направлении Forward	Целое 64-битное число, 9772334
30.	Fwd IAT Mean	Оценка математического ожидания межпакетных интервалов в направлении Forward	Вещественное число, 814361.166667
31.	Fwd IAT Std	Несмещенная оценка среднеквадратичного отклонения межпакетных интервалов в направлении Forward	Вещественное число, 1827899.8492
32.	Fwd IAT Max	Максимальное значение межпакетного интервала в направлении Forward	Целое 64-битное число, 5003029
33.	Fwd IAT Min	Минимальное значение межпакетного интервала в направлении Forward	Целое 64-битное число, 255
Статистические характеристики межпакетных интервалов в потоке сетевых пакетов Backward (от сервера к клиенту), первый пакет в направлении Backward считается началом отсчета времени, первое значение межпакетного интервала рассчитывается при получении второго пакета в направлении Forward
34.	Bwd IAT Total	Суммарное значение всех межпакетных интервалов в направлении Backward	Целое 64-битное число, 5247374
35.	Bwd IAT Mean	Оценка математического ожидания межпакетных интервалов в направлении Backward	Вещественное число, 524737.4
36.	Bwd IAT Std	Несмещенная оценка среднеквадратичного отклонения межпакетных интервалов в направлении Backward	Вещественное число, 1573943.9826
37.	Bwd IAT Max	Максимальное значение межпакетного интервала в направлении Backward	Целое 64-битное число, 5002839
38.	Bwd IAT Min	Минимальное значение межпакетного интервала в направлении Backward	Целое 64-битное число, 237
39.	Fwd Header Length	Суммарная длина заголовков транспортного уровня (TCP / UDP) при передаче данных в направлении Forward (от клиента к серверу)	Целое 64-битное число, 424
40.	Bwd Header Length	Суммарная длина заголовков транспортного уровня (TCP / UDP) при передаче данных в направлении Backward (от сервера к клиенту)	Целое 64-битное число, 360
41.	Fwd Packets/s	Отношение общего количества сетевых пакетов, переданных в направлении Forward (от клиента к серверу), к длительности сетевой сессии (в секундах). Длительность сетевой сессии может быть рассчитана 2 способами см. п. 10.	Вещественное число, 1.33028609
42.	Bwd Packets/s	Отношение общего количества сетевых пакетов, переданных в направлении Backward (от сервера к клиенту), к длительности сетевой сессии (в секундах). Длительность сетевой сессии может быть рассчитана 2 способами см. п. 10.	Вещественное число, 1.12562669
Статистические характеристики длин передаваемых полезных данных (payload) без учета направления передачи данных, в байтах
43.	Min Packet Length	Минимальная длина пакета	Целое 64-битное число, 0
44.	Max Packet Length	Максимальная длина пакета	Целое 64-битное число, 1415
45.	Packet Length Mean	Оценка математического ожидания длин пакетов (средняя длина пакета)	Вещественное число, 234.3333
46.	Packet Length Std	Несмещенная оценка среднеквадратичного отклонения длин пакетов	Вещественное число, 414.27492097
47.	Packet Length Variance	Несмещенная оценка дисперсии длин пакетов	Вещественное число, 171623.7101
48.	Average Packet Size	Оценка математического ожидания длин пакетов (средняя длина пакета). Данный признак повторяется и равен значению Packet Length Mean	Вещественное число, 234.3333
Количество сетевых пакетов, переданных в направлении Forward (от клиента к серверу), содержащих заданный флаг равный 1 в заголовке TCP пакета
49.	Fwd FIN Flags	FIN = 1	Целое 64-битное число, 0
50.	Fwd SYN Flags	SYN = 1	Целое 64-битное число, 1
51.	Fwd RST Flags	RST = 1	Целое 64-битное число, 1
52.	Fwd PSH Flags	PSH = 1	Целое 64-битное число, 4
53.	Fwd ACK Flags	ACK = 1	Целое 64-битное число, 12
54.	Fwd URG Flags	URG = 1	Целое 64-битное число, 0
55.	Fwd ECE Flags	ECE = 1	Целое 64-битное число, 0
56.	Fwd CWR Flags	CWR = 1	Целое 64-битное число, 0
57.	Fwd NS Flags	NS = 1	Целое 64-битное число, 0
Количество сетевых пакетов, переданных в направлении Backward (от сервера к клиенту), содержащих заданный флаг равный 1 в заголовке TCP пакета
58.	Bwd FIN Flags	FIN = 1	Целое 64-битное число, 1
59.	Bwd SYN Flags	SYN = 1	Целое 64-битное число, 1
60.	Bwd RST Flags	RST = 1	Целое 64-битное число, 0
61.	Bwd PSH Flags	PSH = 1	Целое 64-битное число, 5
62.	Bwd ACK Flags	ACK = 1	Целое 64-битное число, 11
63.	Bwd URG Flags	URG = 1	Целое 64-битное число, 0
64.	Bwd ECE Flags	ECE = 1	Целое 64-битное число, 0
65.	Bwd CWR Flags	CWR = 1	Целое 64-битное число, 0
66.	Bwd NS Flags	NS = 1	Целое 64-битное число, 0
67.	Stream Session Number	Номер сетевой сессии	Целое 64-битное число, 0
68.	Stream Was Prev Session	Есть ли предыдущая сетевая сессия в потоке?	Целое 8-битное число, 0
69.	Stream Was Next Session	Есть ли следующая сетевая сессия после текущей в потоке?	Целое 8-битное число, 1
70.	Stream Prev Session Time	Время в микросекундах между созданием текущей сетевой сессии и предыдущей сетевой сессией. Ограничение значения данного признака описано в п.12.	Целое 64-битное число, 60000000
71.	Stream Next Session Time	Время в микросекундах между созданием следующей и текущей сетевой сессии. Ограничение значения данного признака описано в п.13.	Целое 64-битное число, 218
72.	Stream Sessions On Start	Число параллельных сетевых сессий в потоке сетевых сессий на момент создания текущей сессии (значение включает текущую сессию)	Целое 64-битное число, 1
73.	Stream Sessions On Close	Число параллельных сетевых сессий в потоке сетевых сессий на момент окончания текущей сессии (значение включает текущую сессию)	Целое 64-битное число, 2
74.	Stream Sessions Max	Максимальное число параллельных сетевых сессий за время существования текущей сетевой сессии (значение включает текущую сессию)	Целое 64-битное число, 3
Статистические характеристики интервалов между созданием сетевых сессий в потоке сессий в микросекундах
75.	Stream Session Intervals Min	Минимальное значение интервала между сетевыми сессиями в потоке	Целое 64-битное число, 218
76.	Stream Session Intervals Max	Максимальное значение интервала между сетевыми сессиями в потоке	Целое 64-битное число, 9769550
77.	Stream Session Intervals Mean	Оценка математического ожидания значения интервала между сетевыми сессиями в потоке (среднее значение интервала между сетевыми сессиями в потоке)	Вещественное число, 4884884.0
78.	Stream Session Intervals Std	Несмещенная оценка среднеквадратичного отклонения значения интервала между сетевыми сессиями в потоке	Вещественное число, 6907960.905
Статистические характеристики длительностей сетевых сессий в потоке сессий в микросекундах
79.	Stream Session Durations Min	Минимальная длительность сетевой сессии в потоке	Целое 64-битное число, 9771073
80.	Stream Session Durations Max	Максимальная длительность сетевой сессии в потоке	Целое 64-битное число, 9772334
81.	Stream Session Durations Mean	Оценка математического ожидания длительностей сетевых сессии (средняя длительность сетевой сессии в потоке)	Вещественное число, 9771703.5
82.	Stream Session Durations Std	Несмещенная оценка среднеквадратичного отклонения длительностей сетевых сессии	Вещественное число, 891.66165108
83.	Stream Prev Session Time/Duration	Отношение времени в микросекундах между созданием текущей сетевой сессии и предыдущей сетевой сессией к длительности текущей сетевой сессии	Вещественное число, 6.13978196
84.	Stream Next Session Time/Duration	Отношение времени в микросекундах между созданием следующей и текущей сетевой сессии к длительности текущей сетевой сессии	Вещественное число, 0.00002231
85.	Stream Session Intervals Min/Duration	Отношение минимального значения интервала между сетевыми сессиями в потоке к длительности текущей сетевой сессии	Вещественное число, 0.00002231
86.	Stream Session Intervals Max/Duration	Отношение максимального значения интервала между сетевыми сессиями в потоке к длительности текущей сетевой сессии	Вещественное число, 0.99971511
87.	Stream Session Intervals Mean/Duration	Отношение среднего значения интервала между сетевыми сессиями в потоке к длительности текущей сетевой сессии	Вещественное число, 0.49986871
88.	Stream Session Intervals Std/Duration	Отношение среднеквадратичного отклонения значения интервала между сетевыми сессиями в потоке к длительности текущей сетевой сессии	Вещественное число, 0.70688956
89.	Stream Session Durations Min/Duration	Отношение минимальной длительности сетевой сессии в потоке к длительности текущей сетевой сессии	Вещественное число, 0.99987096
90.	Stream Session Durations Max/Duration	Отношение максимальной длительности сетевой сессии в потоке к длительности текущей сетевой сессии	Вещественное число, 1.0
91.	Stream Session Durations Mean/Duration	Отношение среднего значения длительности сетевой сессии в потоке к длительности текущей сетевой сессии	Вещественное число, 0.9999
92.	Stream Session Durations Std/Duration	Отношение среднеквадратичного отклонения длительности сетевых сессий в потоке к длительности текущей сетевой сессии	Вещественное число, 0.00009124
Статистические характеристики мгновенных значений скорости передачи данных (учитывается длина полного пакета со всеми заголовками), выраженной в байтах в сек, в направлении Forward (от клиента к серверу)
93.	Fwd Bandwidth Min	Минимальное значение мгновенной скорости	Целое 64-битное число, 13
94.	Fwd Bandwidth Max	Максимальное значение мгновенной скорости	Целое 64-битное число, 2894117
95.	Fwd Bandwidth Mean	Оценка математического ожидания значений мгновенной скорости	Вещественное число, 322671.75
96.	Fwd Bandwidth Std	Несмещенная оценка среднеквадратичного отклонения значений мгновенной скорости	Вещественное число, 845316.235
Статистические характеристики мгновенных значений скорости передачи данных (учитывается длина полного пакета со всеми заголовками), выраженной в байтах в сек, в направлении Backward (от сервера к клиенту)
97.	Bwd Bandwidth Min	Минимальное значение мгновенной скорости	Целое 64-битное число, 19
98.	Bwd Bandwidth Max	Максимальное значение мгновенной скорости	Целое 64-битное число, 929922
99.	Bwd Bandwidth Mean	Оценка математического ожидания значений мгновенной скорости	Вещественное число, 234621.6
100.	Bwd Bandwidth Std	Несмещенная оценка среднеквадратичного отклонения значений мгновенной скорости	Вещественное число, 292243.2465
101.	Fwd Total Length div Duration	Отношение суммарной длина полезных данных (payload) в байтах, переданных от клиента к серверу, к длительности сессии	Вещественное число, 0.00019739
102.	Bwd Total Length div Duration	Отношение суммарной длина полезных данных (payload) в байтах, переданных от сервера к клиенту, к длительности сессии	Вещественное число, 0.00037811
Статистические характеристики межпакетных интервалов в потоке сетевых пакетов Forward (от клиента к серверу) на этапе установления соединения TCP, первый пакет в направлении Forward считается началом отсчета времени, первое значение межпакетного интервала рассчитывается при получении второго пакета в направлении Forward
103.	Fwd IAT Total HandShake	– суммарное значение всех межпакетных интервалов в направлении Forward	Целое 64-битное число, 9130
104.	Fwd IAT Mean HandShake	– оценка математического ожидания межпакетных интервалов в направлении Forward	Вещественное число, 9130.0
105.	Fwd IAT Std HandShake	– несмещенная оценка среднеквадратичного отклонения межпакетных интервалов в направлении Forward	Вещественное число, 0.0
106.	Fwd IAT Max HandShake	– максимальное значение межпакетного интервала в направлении Forward	Целое 64-битное число, 9130
107.	Fwd IAT Min HandShake	– минимальное значение межпакетного интервала в направлении Forward	Целое 64-битное число, 9130
Статистические характеристики межпакетных интервалов в потоке сетевых пакетов Backward (от сервера к клиенту) на этапе установления соединения TCP, первый пакет в направлении Backward считается началом отсчета времени, первое значение межпакетного интервала рассчитывается при получении второго пакета в направлении Backward
108.	Bwd IAT Total HandShake	– суммарное значение всех межпакетных интервалов в направлении Backward	Целое 64-битное число, 0
109.	Bwd IAT Mean HandShake	– оценка математического ожидания межпакетных интервалов в направлении Backward	Вещественное число, 0
110.	Bwd IAT Std HandShake	– несмещенная оценка среднеквадратичного отклонения межпакетных интервалов в направлении Backward	Вещественное число, 0
111.	Bwd IAT Max HandShake	– максимальное значение межпакетного интервала в направлении Backward	Целое 64-битное число, 0
112.	Bwd IAT Min HandShake	– минимальное значение межпакетного интервала в направлении Backward	Целое 64-битное число, 0
Статистические характеристики межпакетных интервалов в сетевой сессии без учета направления передачи пакетов (от сервера к клиенту) на этапе установления соединения TCP, первый пакет в сетевой сессии считается началом отсчета времени, первое значение межпакетного интервала рассчитывается при получении второго пакета
113.	Flow IAT Total HandShake	Суммарное значение всех межпакетных интервалов	Целое 64-битное число, 9130
114.	Flow IAT Mean HandShake	Оценка математического ожидания межпакетных интервалов	Вещественное число, 4565.0
115.	Flow IAT Std HandShake	Несмещенная оценка среднеквадратичного отклонения межпакетных интервалов	Вещественное число, 6380.932
116.	Flow IAT Max HandShake	Максимальное значение межпакетного интервала	Целое 64-битное число, 9077
117.	Flow IAT Min HandShake	Минимальное значение межпакетного интервала	Целое 64-битное число, 53
118.	Http Reqest	Http запрос, который был отправлен на сервер	Символьная строка

Исходные данные исследования

Для проведения эксперимента был развернут стенд на базе одной из известных компаний РФ и проведен натурный эксперимент.

В состав стенда входят два сервера, на которые заведен один и тот же сетевой трафик компании. Данный трафик включает в себя как обмен между пользователями компании (порядка 200 пользователей, выполняющих различные задачи в рамках своих должностных функций), так и выход сотрудников в сеть Интернет.

При этом:

на первом сервере развернут сертифицированный NGFW, в состав которого входит система обнаружения вторжений уровня сети с актуальными решающими правилами (сигнатуры регулярно обновлялись, в том числе в процессе постановки эксперимента). Ядром данной системы обнаружения вторжений является модифицированная IDS Suricata (далее и будет применяться сокращение IDS Suricata);
на втором сервере развернута разработанная нами утилита session_analyzer, на вход которой поступал тот же самый сетевой трафик, что и на IDS Suricata.

Такая схема сбора и анализа сетевого трафика была выбрана по нескольким причинам:

функционирование NGFW и session_analyzer в общем случае является весьма затратной темой (повышенные требования к производительности серверов);
совмещение ML IDS c NGFW – это отдельная сложная и финансово затратная задача, требующая задействования команды разработчиков;
хотелось провести предварительные исследования «малой кровью» и ответить на вопросы, поставленные в публикации, а также выявить «подводные камни» перед внедрением ML IDS уровня сети в NGFW (в том числе, ответить на вопрос: стоит ли вообще внедрять ML IDS уровня сети в NGFW?).

Процесс преобразования данных от чтения сетевого трафика до формирования итогового датасета

Предварительное преобразование csv файла session_analyzer:

из всего множества рассчитываемых признаков извлекается только адресная информация и 10 значимых признаков: columns_x = ['Average Packet Size', 'Flow Bytes/s', 'Max Packet Length', 'Fwd Packet Length Mean', 'Fwd IAT Min', 'Total Length of Fwd Packets', 'Fwd IAT Std', 'Flow IAT Mean', 'Fwd Packet Length Max','Fwd Header Length'];
добавляются 3 колонки:
Label – метка класса (может принимать 2 значения: Benign или Attack);
Origin – источник информации о метке класса (может принимать 2 значения: «session» или «suricata»);
Sid - идентификатор события (в данном случае sid события IDS Suricata или 0, если вектор признаков «чистый» трафик).
В дальнейшем, при обучении ML IDS всем «чистым» векторам будет присвоено численное значение 0 (негативное решение классификатора), атакам – численное значение 1 (позитивное решение классификатора).
проводится сопоставление векторов признаков с зарегистрированными событиями безопасности IDS Suricata и размечается датасет.

Важно! Множество из 10 значимых признаков выбрано на основе исследования, результаты которого представлены в статье "Синтез модели машинного обучения для обнаружения компьютерных атак на основе набора данных CICIDS2017".

Особенности процесса сопоставления векторов признаков с зарегистрированными событиями безопасности IDS Suricata

В общем случае утилиты IDS Suricata и session_analyzer могут быть расположены на разных, физически разнесенных, серверах (как в нашем случае) – это означает, что:

Один и тот же трафик поступает на вход двух утилит в разное время. Эксперименты показали, что разница может составлять несколько мили секунд для двух серверов стоящих в одной стойке рядом друг с другом.
В отдельных случаях может быть такое, что трафик, поступающий на вход утилит анализа, может различаться. Например, в случае, если администратор сети решит «перестраховаться» и на вход одной из утилит попадает трафик, который принимают в двух точках: до шлюза компании и после шлюза, а на вход другой утилиты поступает трафик только с одной точки наблюдения.
В таком случае, при разметке датасета (сопоставлении векторов признаков с зарегистрированными событиями безопасности IDS Suricata), необходимо предусмотреть, что для одного и того же потока данных может быть 2 сетевых соединения (до шлюза и после шлюза). У таких «одинаковых» сетевых соединений будет различаться адресная информации (вступают в силу механизмы трансляции ip адресов и перенаправления портов транспортного уровня). В нашем случае, оказалось, что на session_analyzer поступает трафик с двух точек наблюдения – до и после шлюза компании.
Пример случая, когда одному и тому же сетевому трафику соответствуют два сетевых соединения (до и после шлюза)
Этим двум соединениям до и после шлюза соответствует событие IDS Suricata (лишние поля вырезаны):
2028762,"ET JA3 Hash - [Abuse.ch] Possible Trickbot", "2025-06-27 13:49:45.207703", "TCP", "10.180.180.6", 58557, "81.88.82.245", 443
Время регистрации событий IDS Suricata (время зарегистрированной компьютерной атаки) и время соответствующего соединения (или же даже 2-х соединений) в session_analyzer различные.
Это связано с тем, что в session_analyzer (и аналогичных утилитах) время, указанное в векторе признаков, характеризующих сетевое соединение, измеряется по первому сетевому пакету в потоке данных. В отличии от этого, в IDS Suricata (или других системах обнаружения компьютерных атак уровня сети) время компьютерной атаки обычно соответствует времени пакета, на котором произошло срабатывание анализатора. Эксперименты показали, что для некоторых сетевых атак на практике разница времени между двумя утилитами может превышать 20 секунд (гипотетически для медленной атаки – это время может быть еще больше).

Cбор сетевого трафика и предварительная обработка данных

Сбор и предварительная обработка сетевого трафика выполнялись в несколько этапов.

На 1 этапе две недели с 2025-06-26 по 2025-07-10 параллельно функционировали IDS Suricata и session_analyzer.

Результатом этого этапа стали 2 файла:

лог с зарегистрированными компьютерными атаками IDS Suricata;
лог с векторами признаков всех сетевых соединений сформированный session_analyzer за указанный период времени (каждая строчка лога представляет собой вектор значений признаков соединения и содержит 119 колонок);

На 2 этапе из лога IDS Suricata были извлечены все ip адреса, которые фигурировали в зарегистрированных событиях и из лога session_analyzer были удалены все строки, которые содержали ip адреса не встречающиеся в логах IDS Suricata (по факту в нашем случае – это примерно 25% всех соединений).

В итоге осталось 55548971 сетевых соединений (векторов, характеризующих каждое соединение).

На 3 этапе из лога session_analyzer убрали все лишние столбцы (признаки). Для этого в логе session_analyzer в каждом векторе с описанием сетевых соединений отставили только адресную информацию (время начала соединения и 5-tuple: ip адреса + порты транспортного уровня + номер протокола транспортного уровня) и 10 информативных признаков для синтеза ML модели;

На 4 этапе провели сопоставление двух логов: IDS Suricata и session_analyzer для того, чтобы каждому вектору, характеризующему сетевые соединения указать метку класса: Benign («чистый» трафик) и Attack (компьютерная атака). При этом, была разработана утилита сопоставления, учитывающая все особенности приема сетевого трафика, которые были описаны выше.

Фрагмент итогового размеченного датасета

Таким образом, после предварительной обработки данных и сопоставления 2-х логов датасет содержит 55548971 строк, при этом векторов чистого трафика (Benign) = 55491506, векторов компьютерных атак (Attack) = 57465.

Множество атак содержит 111 различных sid. В таблице ниже представлены атаки и их количество (атаки, которые за весь период наблюдения встречались 1 раз из таблицы убраны).

№ п/п	sid	Описание	Коли-чество
1.	1006217	HolaVPN detected	11988
2.	1006215	HolaVPN detected	11550
3.	1006221	HolaVPN detected	7908
4.	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	7102
5.	1003187	Anonymizer detected	7081
6.	2060504	ET INFO Observed Discord Service Domain (gateway .discord .gg) in TLS SNI	4775
7.	2050884	ET INFO Observed vk .com API Domain (api .vk .com in TLS SNI)	1373
8.	2053282	ET TA_ABUSED_SERVICES Commonly Actor Abused Online Service Domain (syncthing .net)	1296
9.	2014819	ET INFO Packed Executable Download	986
10.	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	728
11.	41560233	HackTool.Nmap.TCP.ServerRequest	547
12.	2047703	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI	341
13.	65158634	HackTool.Nmap.TCP.ServerRequest	198
14.	2035593	ET INFO DropBox User Content Domain (dl .dropboxusercontent .com in TLS SNI)	197
15.	2041933	ET INFO Observed Telegram Domain (t .me in TLS SNI)	187
16.	2022082	ET INFO External IP Lookup ip-api.com	185
17.	2402000	ET DROP Dshield Block Listed Source group 1	91
18.	28000001	(o)DoH Query for dns.google	85
19.	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	69
20.	2052581	ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)	62
21.	28000974	(o)DoH Query for httpdns-push.heytapmobile.com	61
22.	2060505	ET INFO Observed Discord Service Domain (discord .com) in TLS SNI	58
23.	2029634	ET HUNTING Suspected Malicious Telegram Communication (POST)	39
24.	2062715	ET INFO Observed UA-CPU Header	36
25.	1006213	MultiProxy Firefox Add-ons	36
26.	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	32
27.	2400009	ET DROP Spamhaus DROP Listed Traffic Inbound group 10	29
28.	1006319	PORT SCAN (NMAP -sA)	28
29.	1006585	Outbound connection to a possible C&C server	27
30.	1006554	IP blocklist	25
31.	1006556	IP blocklist	24
32.	1006555	IP blocklist	22
33.	2057746	ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)	22
34.	1006557	IP blocklist	21
35.	58565362	Trojan-PSW.Agent.HTTP.C&C	14
36.	2029322	ET HUNTING Telegram API Certificate Observed	14
37.	2400059	ET DROP Spamhaus DROP Listed Traffic Inbound group 60	12
38.	2063118	ET INFO Abused Hosting Domain (azurewebsites .net) in TLS SNI	10
39.	2027695	ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)	9
40.	1800920	IP blocklist	9
41.	1802600	IP blocklist	9
42.	28000040	(o)DoH Query for mozilla.cloudflare-dns.com	8
43.	28000196	(o)DoH Query for dns.google.com	8
44.	2050633	ET INFO Observed File Hosting Service Domain (zohopublic .eu) in TLS SNI	8
45.	1006258	PlanetVPN	7
46.	1801497	IP blocklist	6
47.	2058779	ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed .binance .org)	6
48.	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	6
49.	2013927	ET INFO HTTP traffic on port 443 (HEAD)	5
50.	2046071	ET INFO Observed Google DNS over HTTPS Domain (dns .google .com in TLS SNI)	5
51.	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	5
52.	2049202	ET INFO Observed File Hosting Service Domain (files .pythonhosted .org in TLS SNI)	5
53.	2043310	ET HUNTING DDoS-Guard Hosted Content	5
54.	28000002	(o)DoH Query for cloudflare-dns.com	4
55.	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	4
56.	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	4
57.	2021701	ET GAMES MINECRAFT Server response inbound	3
58.	1006260	VeePN	3
59.	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	3
60.	2063071	ET INFO Observed External IP Lookup Domain (l2 .io) in TLS SNI	3
61.	1803186	IP blocklist	3
62.	2047866	ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)	3
63.	36674245	HackTool.Nmap.TLS.C&C	3
64.	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	3
65.	1801678	IP blocklist	3
66.	1802605	IP blocklist	3
67.	2400035	ET DROP Spamhaus DROP Listed Traffic Inbound group 36	3
68.	2039595	ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI	2
69.	1800324	IP blocklist	2
70.	1801470	IP blocklist	2
71.	1802765	IP blocklist	2
72.	2054227	ET TA_ABUSED_SERVICES Fingerprinting Service in TLS SNI (customfingerprints .bablosoft .com)	2
73.	2047894	ET INFO Observed Online Collab Tool Domain (figma .com in TLS SNI)	2
74.	1802434	IP blocklist	2
75.	2050282	ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI	2
76.	2400004	ET DROP Spamhaus DROP Listed Traffic Inbound group 5	2
77.	1800572	IP blocklist	2
78.	1800496	IP blocklist	2
79.	1802677	IP blocklist	2
80.	2400060	ET DROP Spamhaus DROP Listed Traffic Inbound group 61	2
81.	1800742	IP blocklist	2
82.	1801285	IP blocklist	2
83.	28000957	(o)DoH Query for httpdns-push.heytapmobile.com	2

55 млн. строк – это достаточно много (с одной стороны по продолжительности сбора данных о сетевом трафике, с другой стороны по требуемому объему оперативной памяти при дальнейшем обучении моделей) и для упрощения анализа при проведении исследования все множество векторов разбиваем на файлы по 10 млн строк.

Все 55 млн. строк сортируем по меткам времени появления вектора признаков, характеризующих сетевые соединения – это позволит ответить на вопрос: сколько времени требуется наблюдать за трафиком компании для обучения и получения качественной ML модели.

Распределение всех векторов по классам и по времени появления представлены ниже в таблице.

Название файла	Количество векторов признаков по метке класса	Период наблюдения
dataset_1.csv	Benign – 9996297 Attack – 3703	2025-06-26 23:47:43 (четверг) 2025-06-29 17:31:35 (воскресенье)
dataset_2.csv	Benign – 9979487 Attack – 20513	2025-06-29 17:31:35 (воскресенье) 2025-07-02 10:55:35 (среда)
dataset_3.csv	Benign – 9983212 Attack – 16788	2025-07-02 10:55:35 (среда) 2025-07-04 22:52:20 (пятница)
dataset_4.csv	Benign – 9999896 Attack – 104	2025-07-02 22:23:49 (пятница) 2025-07-06 02:05:00 (воскресенье)
dataset_5.csv	Benign – 9999893 Attack – 107	2025-07-06 02:05:00 (воскресенье) 2025-07-07 08:10:49 (понедельник)
dataset_6.csv	Benign – 5532721 Attack – 16250	2025-07-07 08:10:49 (понедельник) 2025-07-10 08:25:40 (четверг)

Ура! Датасет готов. Можно попробовать синтезировать ML модель.

Построение ML IDS

Для построения классификатора сетевого трафика была использована библиотека catboost. Количество признаков – 10, все признаки – числовые. Эксперименты проводились на ПЭВМ: Intel(R) Core(TM) i5-3570 CPU @ 3.40GHz, 32 Gb DDR3.

Настройки классификатора при обучении (данные значения настроек использовались во всех экспериментах: значения выбраны эвристически исходя из различных рекомендаций исследователей и разработчиков):

iterations = 1000, depth = 8,
CatBoostClassifier(iterations=iterations, verbose=250, depth=depth,
task_type="CPU", eval_metric='F1').

Важно помнить! Безусловно, надо подбирать рациональные значения всех гиперпараметров ML модели, но в данном исследовании этого не делалось, а упор сделан на все «подводные» камни процесса построения ML IDS в целом!

Эксперимент 1.

Обучили модель на файле dataset_1.csv (2,5 дня наблюдения за сетью, в том числе в рабочие дни: 18 % всех чистых векторов, 6,5% всех атак).

Эксперимент 1. Оценка качества классификатора сетевого трафика

Набор данных	Матрица ошибок	Показатели качества классификации
dataset_1.csv	clear as clear (TN-true negative): 9996239 clear as attack (FP-false positive): 58 attack as clear (FN-false negative): 1612 attack as attack (TP-true positive): 2091	accuracy = 0.9998 precision = 0.9730 recall = 0.5646 f1-score = 0.7146
dataset_2.csv	clear as clear (TN-true negative): 9974887 clear as attack (FP-false positive): 4600 attack as clear (FN-false negative): 16783 attack as attack (TP-true positive): 3730	accuracy = 0.9978 precision = 0.4477 recall = 0.1818 f1-score = 0.2586
dataset_3.csv	clear as clear (TN-true negative): 9980409 clear as attack (FP-false positive): 2803 attack as clear (FN-false negative): 12279 attack as attack (TP-true positive): 4509	accuracy = 0.9984 precision = 0.6166 recall = 0.2685 f1-score = 0.3742
dataset_4.csv	clear as clear (TN-true negative): 9999888 clear as attack (FP-false positive): 8 attack as clear (FN-false negative): 47 attack as attack (TP-true positive): 57	accuracy = 0.9999 precision = 0.8769 recall = 0.5480 f1-score = 0.6745
dataset_5.csv	clear as clear (TN-true negative): 9999889 clear as attack (FP-false positive): 4 attack as clear (FN-false negative): 40 attack as attack (TP-true positive): 67	accuracy = 0.9999 precision = 0.9436 recall = 0.6261 f1-score = 0.7528
dataset_6.csv	clear as clear (TN-true negative): 5530706 clear as attack (FP-false positive): 2015 attack as clear (FN-false negative): 8488 attack as attack (TP-true positive): 7762	accuracy = 0.9981 precision = 0.7939 recall = 0.4776 f1-score = 0.5964

Выводы по эксперименту: пока что, все плохо!

Обучение произведено на файле dataset_1.csv и качество классификации на нем же плохое: слишком много «пропуска цели», а следовательно и значение recall тоже низкое. Т.е. выборки плохо разделимы с использованием выбранного математического аппарата, существующего признакового пространства и/или разметки датасета.
На остальных файлах (участках времени) всё плохо не только с попуском цели, но и достаточно высокий уровень ложных срабатываний, что обычно говорит о том, что в обучающей выборке недостаточно «чистых» векторов, т.е. обучающая выборка не репрезентативна и надо добавить векторов со следующего временного участка. Однако в нашем случае, в явном виде такой вывод сделать нельзя, т.к. на dataset_4.csv и dataset_5.csv (выходные дни и совсем небольшое количество атак) качество классификации «чистого» трафика неплохое.

Что же делать дальше?

Высокий уровень пропуска цели и в целом невозможность разделения векторов на обучающей выборке, в совокупности с применением catboost (одна из лучших в мире реализаций RandomForest) говорит о том, что скорее всего разметка датасета неправильная и есть вектора имеющие одинаковые (или очень близкие) значения признаков, но разные метки классов. Все такие вектора для простоты обозначения будем по тексту публикации называть «плохими» векторами.

Тогда на следующем этапе исследования:

найдем все вектора, расстояние между которыми равны 0, но они относятся к разным классам (это однозначно неправильная разметка датасета);
найдем все вектора, расстояние между которыми имеют «очень маленькое» значение (данное значение было подобрано экспериментально);
проведем анализ: какие именно атаки (sid правил IDS Suricata) попали во множество «плохих»?
заменим метку класса найденных векторов на Benign.

Эксперимент 2.

Для поиска векторов имеющих одинаковые значения признаков, но разные метки классов, воспользуемся расчетом Евклидова расстояния между векторами (не забываем при этом нормализовать значения каждого признака). Поиск осуществляем только на файле dataset_1.csv (он у нас обучающий).

В результате поиска векторов с одинаковыми (или очень близкими) значениями признаков, но разными метками классов было найдено 24 sid (объединим их в логические группы и представим текстовое описание семантики решающего правила).

№п/п	Sid	Короткое описание (описание взято из решающего правила IDS Suricata) и краткое описание семантики решающего правила
1	1003187	"Anonymizer detected", правило находит TLS соединения с заданным значением SNI
2	1006215, 1006217, 1006221	"HolaVPN detected", правила находят TLS соединения с заданными значениями SNI (в одном из sid, есть небольшое контекстное уточнение)
3	1006554, 1006555, 1006556, 1800330, 1800496, 1800742, 1801285, 1801673, 1802363, 1802600, 1802677	"IP blocklist", правила находят сетевые пакеты с заданными IP адресами
4	41560233, 65158634	"HackTool.Nmap.TCP.ServerRequest", правила находят сетевые пакеты с заданными флагами протокола TCP (таких признаков в нашем датасете нет!)
5	2035593	"ET INFO DropBox User Content Domain (dl.dropboxusercontent.com in TLS SNI)", правило находит TLS соединения с заданным значением SNI
6	2047703	"ET INFO External IP Address Lookup Domain (ipify.org) in TLS SNI", правило находит TLS соединения с заданным значением SNI
7	2400009, 2400035, 2400059, 2400060	"ET DROP Spamhaus DROP Listed Traffic Inbound group 10" "ET DROP Spamhaus DROP Listed Traffic Inbound group 36" "ET DROP Spamhaus DROP Listed Traffic Inbound group 60" "ET DROP Spamhaus DROP Listed Traffic Inbound group 61", правила находят сетевые пакеты с заданными IP адресами
8	2402000	"ET DROP Dshield Block Listed Source group 1", правила находят сетевые пакеты с заданными IP адресами

Для практически всех вышеперечисленных компьютерных атак имелись полностью совпадающие вектора из множества «чистых» векторов (т.е. расстояние между ними было равно 0).

Исключения составили события с sid: 1006217, 2035593 и 2047703. Для этих событий минимальное расстояние между векторами было < 0.00005. Что это означает на практике хорошо видно на рисунке ниже (dist = 0.000001).

Пример "близких" векторов

Т.е. небольшая разница была в значениях признаков, которые зависят от времени (задержек в сети, используемых сетевых технологиях и т.п.).

Дополнительным интересным результатом явилось еще и то, что некоторые атаки в принципе имеют практически 0 значения всех признаков (такое возможно при условии, что NGFW заблокировало соединение по первому пакету). Это означает, что для этих атак признаковое пространство необходимо изменять.

Так, например, атаки "HackTool.Nmap.TCP.ServerRequest" и "ET DROP Dshield Block Listed Source group 1" в заданном признаковом пространстве вообще не различимы (см. рисунок ниже). Имеются и другие примеры наблюдаемого явления.

Пример векторов, по которым становится понятным необходимости изменения признакового пространства

Ниже представлены результаты модификации набора данных (путем изменения метки класса на Benign для всех векторов, имеющих «плохие» sid), повторного обучения ML модели и оценки качества классификации. Настройки процедуры обучения ML модели, выбранные значения гиперпараметров модели и используемый набор данных остаются как и в эксперименте 1.

После модификации набора данных векторов с меткой класса Benign – 55531544, векторов с меткой Attack – 17427 (было 57465).

Обучим заново ML IDS и оценим качество полученного классификатора.

Эксперимент 2. Оценка качества классификатора сетевого трафика

Набор данных	Матрица ошибок	Показатели качества классификации
dataset_1.csv	clear as clear (TN-true negative): 9998394 clear as attack (FP-false positive): 10 attack as clear (FN-false negative): 18 attack as attack (TP-true positive): 1578	accuracy = 0.9999 precision = 0.9937 recall = 0.9887 f1-score = 0.9912
dataset_2.csv	clear as clear (TN-true negative): 9996661 clear as attack (FP-false positive): 194 attack as clear (FN-false negative): 587 attack as attack (TP-true positive): 2558	accuracy = 0.9999 precision = 0.9295 recall = 0.8133 f1-score = 0.8675
dataset_3.csv	clear as clear (TN-true negative): 9995458 clear as attack (FP-false positive): 103 attack as clear (FN-false negative): 753 attack as attack (TP-true positive): 3686	accuracy = 0.9999 precision = 0.9728 recall = 0.8303 f1-score = 0.8959
dataset_4.csv	clear as clear (TN-true negative): 9999937 clear as attack (FP-false positive): 5 attack as clear (FN-false negative): 13 attack as attack (TP-true positive): 45	accuracy = 0.9999 precision = 0.9 recall = 0.7758 f1-score = 0.8333
dataset_5.csv	clear as clear (TN-true negative): 9999923 clear as attack (FP-false positive): 3 attack as clear (FN-false negative): 18 attack as attack (TP-true positive): 56	accuracy = 0.9999 precision = 0.9491 recall = 0.7567 f1-score = 0.8421
dataset_6.csv	clear as clear (TN-true negative): 5540606 clear as attack (FP-false positive): 250 attack as clear (FN-false negative): 1549 attack as attack (TP-true positive): 6566	accuracy = 0.9996 precision = 0.9633 recall = 0.8091 f1-score = 0.8795

Время обучения модели 19 мин 36 сек, время классификации 55 млн. векторов – 7 мин 21,4 сек.

Выводы по эксперименту

Не смотря на улучшение качества классификации в целом, уровень «пропуска» цели и ложных срабатываний остается высоким.
При этом, достаточно большое значение «FN-false negative» (и как следствие значение recall) на файлах dataset_2/3/4/5/6.csv показывает, что:

необходимо исследовать: появились ли новые зарегистрированные атаки на временных интервалах, следующих за обучающим интервалом (т.е. на dataset_2/3/4/5/6.csv)?;
объем обучающей выборки с атаками явно недостаточный и требуется переобучить модель с новыми данными.

Исследование состава зарегистрированных событий безопасности IDS Suricata на разных интервалах времени

Для того, чтобы понять какие события правильно классифицируются, а какие нет, была построена таблица, в ней указано, какие атаки встречались на каждом временном участке и сколько из этих атак было НЕ обнаружено (т.е. на примере самой первой строки sid = 2028762, в файле на котором обучались (dataset_1.csv) было таких событий 688 и все обнаружены, на dataset_2 было 1424 атаки из ни не обнаружено 5 и т.д.).

Обозначения. В таблицах ошибок ниже жирным шрифтом выделено плохое качество классификации векторов с признаками.
Для наглядности можно применить раскраску таблицы цветами (к сожалению, сайт не поддерживает раскраску таблиц), становится очень хорошо видно, что отдельные события безопасности хорошо распознаются, другие не в какую не хотят правильно классифицироваться, какие события были в процессе обучения представлены, а какие - нет:
– зеленый цвет – качество классификации приемлемое;
– красный цвет – качество плохое (надо обратить внимание на это решающее правило);
– желтый цвет (только в колонке dataset_1, т.е. на обучающем наборе данных) – sid не встречался в процессе обучения (решающее правило не срабатывало).

Эксперимент 2. Таблица ошибок "пропуск" цели

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|5	1954\|10	0\|0	0\|0	3036\|11
2	2060504	ET INFO Observed Discord Service Domain (gateway .discord .gg) in TLS SNI	135\|0	534\|10	853\|7	0\|0	0\|0	3253\|669
3	2050884	ET INFO Observed vk .com API Domain (api .vk .com in TLS SNI)	231\|3	303\|261	331\|278	0\|0	0\|0	508\|361
4	2053282	ET TA_ABUSED_SERVICES Commonly Actor Abused Online Service Domain (syncthing .net)	197\|0	222\|14	459\|36	0\|0	0\|0	418\|29
5	2014819	ET INFO Packed Executable Download	145\|1	224\|44	261\|60	31\|2	47\|3	278\|59
6	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	92\|0	172\|26	220\|39	24\|8	12\|2	208\|37
7	2041933	ET INFO Observed Telegram Domain (t .me in TLS SNI)	25\|2	55\|46	53\|48	0\|0	0\|0	54\|40
8	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|46	66\|66	0\|0	0\|0	73\|73
9	28000001	(o)DoH Query for dns.google	0\|0	2\|2	82\|82	0\|0	0\|0	1\|1
10	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|1	0\|0	0\|0	5\|0
11	2052581	ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)	0\|0	3\|3	0\|0	0\|0	0\|0	59\|59
12	28000974	(o)DoH Query for httpdns-push.heytapmobile.com	0\|0	0\|0	0\|0	0\|0	0\|0	61\|61
13	2060505	ET INFO Observed Discord Service Domain (discord .com) in TLS SNI	0\|0	13\|13	21\|21	0\|0	0\|0	24\|24
14	2029634	ET HUNTING Suspected Malicious Telegram Communication (POST)	5\|0	13\|13	6\|6	0\|0	0\|0	15\|13
15	1006213	MultiProxy Firefox Add-ons	33\|0	3\|2	0\|0	0\|0	0\|0	0\|0
16	2062715	ET INFO Observed UA-CPU Header	2\|1	7\|7	12\|12	0\|0	7\|7	8\|8
17	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
18	1006319	PORT SCAN (NMAP -sA)	0\|0	8\|8	4\|4	0\|0	0\|0	16\|16
19	1006585	Outbound connection to a possible C&C server	0\|0	4\|4	1\|1	0\|0	0\|0	22\|22
20	2057746	ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)	3\|3	3\|3	7\|7	0\|0	0\|0	9\|9
21	1006557	IP blocklist	2\|2	4\|4	5\|5	1\|1	2\|2	7\|7
22	2029322	ET HUNTING Telegram API Certificate Observed	3\|0	3\|1	2\|1	1\|1	2\|1	3\|1
23	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|8	5\|5	0\|0	0\|0	1\|1
24	2063118	ET INFO Abused Hosting Domain (azurewebsites .net) in TLS SNI	1\|0	1\|1	2\|2	0\|0	0\|0	6\|6
25	2027695	ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)	0\|0	1\|0	4\|0	0\|0	0\|0	4\|0
26	1800920	IP blocklist	0\|0	0\|0	9\|9	0\|0	0\|0	0\|0
27	2050633	ET INFO Observed File Hosting Service Domain (zohopublic .eu) in TLS SNI	8\|0	0\|0	0\|0	0\|0	0\|0	0\|0
28	28000196	(o)DoH Query for dns.google.com	1\|1	3\|3	4\|4	0\|0	0\|0	0\|0
29	28000040	(o)DoH Query for mozilla.cloudflare-dns.com	1\|0	4\|0	1\|0	0\|0	1\|0	1\|0
30	1006258	PlanetVPN	0\|0	3\|1	1\|1	0\|0	0\|0	3\|1
31	1801497	IP blocklist	0\|0	3\|3	2\|2	0\|0	1\|1	0\|0
32	2058779	ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed .binance .org)	0\|0	2\|2	4\|4	0\|0	0\|0	0\|0
33	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|2	0\|0	0\|0	4\|4
34	2013927	ET INFO HTTP traffic on port 443 (HEAD)	0\|0	2\|2	2\|2	0\|0	0\|0	1\|1
35	2046071	ET INFO Observed Google DNS over HTTPS Domain (dns .google .com in TLS SNI)	0\|0	2\|2	1\|1	0\|0	0\|0	2\|2
36	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
37	2049202	ET INFO Observed File Hosting Service Domain (files .pythonhosted .org in TLS SNI)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
38	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|4	0\|0	0\|0	1\|1
39	28000002	(o)DoH Query for cloudflare-dns.com	0\|0	2\|0	1\|0	0\|0	0\|0	1\|0
40	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|2	2\|2	0\|0	0\|0	0\|0
41	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
42	1801678	IP blocklist	1\|1	1\|1	0\|0	0\|0	0\|0	1\|1
43	1802605	IP blocklist	1\|1	0\|0	1\|1	1\|1	0\|0	0\|0
44	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|3	0\|0	0\|0	0\|0	0\|0
45	1006260	VeePN	0\|0	3\|3	0\|0	0\|0	0\|0	0\|0
46	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|2	1\|1	0\|0	0\|0	0\|0
47	2063071	ET INFO Observed External IP Lookup Domain (l2 .io) in TLS SNI	0\|0	0\|0	1\|1	0\|0	0\|0	2\|2
48	1803186	IP blocklist	0\|0	0\|0	1\|1	0\|0	0\|0	2\|2
49	2047866	ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)	0\|0	0\|0	3\|3	0\|0	0\|0	0\|0
50	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
51	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
52	28000957	(o)DoH Query for httpdns-push.heytapmobile.com	2\|2	0\|0	0\|0	0\|0	0\|0	0\|0
53	1800572	IP blocklist	1\|1	0\|0	0\|0	0\|0	1\|1	0\|0
54	2039595	ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI	0\|0	2\|2	0\|0	0\|0	0\|0	0\|0
55	1800324	IP blocklist	0\|0	1\|1	0\|0	0\|0	0\|0	1\|1
56	1801470	IP blocklist	0\|0	1\|1	0\|0	0\|0	0\|0	1\|1
57	1802765	IP blocklist	0\|0	1\|1	0\|0	0\|0	0\|0	1\|1
58	2054227	ET TA_ABUSED_SERVICES Fingerprinting Service in TLS SNI (customfingerprints .bablosoft .com)	0\|0	0\|0	2\|2	0\|0	0\|0	0\|0
59	1802434	IP blocklist	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
60	2050282	ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
61	2400004	ET DROP Spamhaus DROP Listed Traffic Inbound group 5	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2

Выводы по исследованию состава зарегистрированных событий безопасности IDS Suricata на разных интервалах времени:

не все атаки хорошо распознаются на обучающем наборе данных, и необходимо провести анализ каким образом срабатывают такие правила (дальнейший анализ показал, что большинство из красных областей – это срабатывания решающих правил, основанных на адресной информации);
ряд атак на обучающем наборе данных классифицируются правильно с хорошим качеством, а на остальных участках времени – плохо. Для того, чтобы понять почему так бывает можно рассмотреть правило строка 5: sid = 2014819; краткое описание: «ET INFO Packed Executable Download», если посмотреть на него, то видно, что критерий принятия решения – это все файлы формата PE, причем откомпилирован не в Visual Studio и то с ограничениями. Очевидно, что ложных срабатываний в таком случае будет огромное количество, что и видно на практике;
плохая обобщающая способность. Библиотека catboost – это реализация RandomForest и это сказывается в случае, если ряд признаков (как в нашем случае) в датасете связаны с временем. На практике это означает, что ряд атак, в нашем случае – почти все, которые отсутствовали на обучающем наборе данных либо плохо (плохая обобщающая способность), либо вообще не распознаются и требуется переобучение модели, чтобы обучающая выборка была «репрезентативной» (строки 8, 9, 11, 13, 14 и многие другие).

Что же делать?

На следующем шаге исследования обратим внимание на правила из "красной" зоны и заново обучим модель на первом и втором временном интервале. Таким образом, с точки зрения практики, первого временного интервала для обучения не достаточно (выборка не репрезентативна, если посмотреть выше на таблицу, то первый временной интервал - это всего лишь один рабочий день - пятница и потом наступают выходные), увеличим временной интервал для сбора сетевого трафика.

Эксперимент 3.

Предварительная обработка данных: убрать все адресные решающие правила (т.е. правила, критерием срабатывания которых является обращение по конкретному ip адресу или диапазону адресов, или обращение к TLS серверам с конкретным SNI (или SNI префиксом).

Перечислим sid «плохих» для построения ML модели правил:

2060504,2050884,28000001,2041933,28000974,2052581,1006585,2060505,2057746,2053282,2033967,2063118,2046071,2049202,1006554,1006556,1006555,1006557,1800920,1802600,1801497,1803186,1801678,1802605,1800324,1801470,1802765,1802434,1800572,1800496,1802677,1800742,1801285,1801368,1802634,1801601,1800766,1801379,1802764,1800722,1802174,1802654,1800213,1803394,1803583,1801944,1801673,1802363,1800330,1006258,1006260,1006557,1800324,1800766,1801368,1801379,1801470,1801497,1801601,1801678,1802634,1802765,2029634,2033967,2050884,2062715 – это правила с адресной информацией.

После модификации набора данных векторов с меткой класса Benign – 55540391, векторов с меткой Attack – 8580 (первоначально было 57465).

При обучении объединим два временных диапазона dataset_1.csv и dataset_2.csv, т.е. обучение осуществлялось в течение 6 дней (включая трафик выходных дней).

Эксперимент 3. Оценка качества классификатора сетевого трафика.

Набор данных	Матрица ошибок	Показатели качества классификации
dataset_1.csv	clear as clear (TN-true negative): 9999094 clear as attack (FP-false positive): 6 attack as clear (FN-false negative): 13 attack as attack (TP-true positive): 887	accuracy = 0.9999 precision = 0.9932 recall = 0.9855 f1-score = 0.9894
dataset_2.csv	clear as clear (TN-true negative): 9998210 clear as attack (FP-false positive): 1 attack as clear (FN-false negative): 47 attack as attack (TP-true positive): 1742	accuracy = 0.9999 precision = 0.9994 recall = 0.9737 f1-score = 0.9864
dataset_3.csv	clear as clear (TN-true negative): 9997626 clear as attack (FP-false positive): 7 attack as clear (FN-false negative): 110 attack as attack (TP-true positive): 2257	accuracy = 0.9999 precision = 0.9969 recall = 0.9535 f1-score = 0.9747
dataset_4.csv	clear as clear (TN-true negative): 9999966 clear as attack (FP-false positive): 2 attack as clear (FN-false negative): 1 attack as attack (TP-true positive): 31	accuracy = 0.9999 precision = 0.9393 recall = 0.9687 f1-score = 0.9538
dataset_5.csv	clear as clear (TN-true negative): 9999949 clear as attack (FP-false positive): 1 attack as clear (FN-false negative): 4 attack as attack (TP-true positive): 46	accuracy = 0.9999 precision = 0.9787 recall = 0.92 f1-score = 0.9484
dataset_6.csv	clear as clear (TN-true negative): 5545503 clear as attack (FP-false positive): 26 attack as clear (FN-false negative): 92 attack as attack (TP-true positive): 3350	accuracy = 0.9999 precision = 0.9922 recall = 0.9732 f1-score = 0.9826

Время обучения модели 39 мин 49 сек, время классификации 55 млн. векторов – 8 мин 41,6 сек.

Эксперимент 3. Таблица ошибок "пропуска" цели

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|0	1954\|9	0\|0	0\|0	3036\|6
2	2014819	ET INFO Packed Executable Download	145\|0	224\|0	261\|42	31\|0	47\|1	278\|37
3	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|0	66\|5	0\|0	0\|0	73\|0
4	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|2	0\|0	0\|0	5\|0
5	1006213	MultiProxy Firefox Add-ons	33\|4	3\|0	0\|0	0\|0	0\|0	0\|0
6	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
7	1006319	PORT SCAN (NMAP -sA)	0\|0	8\|0	4\|3	0\|0	0\|0	16\|16
8	2029322	ET HUNTING Telegram API Certificate Observed	3\|0	3\|1	2\|1	1\|1	2\|2	3\|3
9	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|0	5\|0	0\|0	0\|0	1\|0
10	2027695	ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)	0\|0	1\|1	4\|4	0\|0	0\|0	4\|4
11	2050633	ET INFO Observed File Hosting Service Domain (zohopublic .eu) in TLS SNI	8\|5	0\|0	0\|0	0\|0	0\|0	0\|0
12	28000196	(o)DoH Query for dns.google.com	1\|1	3\|3	4\|4	0\|0	0\|0	0\|0
13	28000040	(o)DoH Query for mozilla.cloudflare-dns.com	1\|1	4\|4	1\|1	0\|0	1\|1	1\|1
14	2058779	ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed .binance .org)	0\|0	2\|1	4\|4	0\|0	0\|0	0\|0
15	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|2	0\|0	0\|0	4\|4
16	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
17	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|4	0\|0	0\|0	1\|1
18	28000002	(o)DoH Query for cloudflare-dns.com	0\|0	2\|2	1\|1	0\|0	0\|0	1\|1
19	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|2	2\|2	0\|0	0\|0	0\|0
20	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
21	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|0	0\|0	0\|0	0\|0	0\|0
22	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|1	1\|1	0\|0	0\|0	0\|0
23	2063071	ET INFO Observed External IP Lookup Domain (l2 .io) in TLS SNI	0\|0	0\|0	1\|1	0\|0	0\|0	2\|2
24	2047866	ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)	0\|0	0\|0	3\|3	0\|0	0\|0	0\|0
25	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
26	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
27	28000957	(o)DoH Query for httpdns-push.heytapmobile.com	2\|2	0\|0	0\|0	0\|0	0\|0	0\|0
28	2039595	ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI	0\|0	2\|2	0\|0	0\|0	0\|0	0\|0
29	2054227	ET TA_ABUSED_SERVICES Fingerprinting Service in TLS SNI (customfingerprints .bablosoft .com)	0\|0	0\|0	2\|2	0\|0	0\|0	0\|0
30	2047894	ET INFO Observed Online Collab Tool Domain (figma .com in TLS SNI)	0\|0	0\|0	1\|1	0\|0	0\|0	1\|1
31	2050282	ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
32	2400004	ET DROP Spamhaus DROP Listed Traffic Inbound group 5	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
33	2054246	ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
34	2038967	ET INFO SSH-2.0-Go version string Observed in Network Traffic	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
35	1006206	Browsec-VPN	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
36	2060251	ET INFO Go-http-client User-Agent Observed Outbound	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
37	2014788	ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
38	2017499	ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
39	1006914	Possible trojan activity, base64-encoded content	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
40	1003302	Anonymizer detected	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
41	2018383	ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
42	2012252	ET SHELLCODE Common 0a0a0a0a Heap Spray String	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
43	2048493	ET INFO ISO File Downloaded	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
44	2024833	ET INFO Observed IP Lookup Domain (l2 .io in TLS SNI)	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1

Выводы по эксперименту:

качество модели стало лучше, но с датасетом надо еще работать. «Глазами» изучить с первого раза все 111 решающих правил IDS Suricata у автора не получилось и скорее всего адресные правила удалены были не все (т.к. «пропуск» цели достаточно большой на файлах dataset_3.csv и dataset_6.csv, а на файле dataset_2.csv много ошибок обучения).

Эксперимент 4.

Предварительная обработка данных такая же как и в предыдущем эксперименте – убрать все адресные решающие правила (т.е. правила, критерием срабатывания которых является обращение по конкретному ip адресу или диапазону адресов, или обращение к TLS серверам с конкретным SNI (или SNI префиксом).

Анализ перечисленных выше в эксперименте 3 ошибок «пропуска цели» выявили следующие категории «плохих» sid:

поиск SNI: 2058779, 2039595, 2054227, 2047894, 2050282, 2024833;
поиск SNI с опцией dotprefix: 2027695, 2050633, 2063071, 2047866;
поиск сертификата с конкретными данными: 2029322, 28000196, 28000040, 28000002, 28000957;
поиск конкретных IP адресов: 2400004;
анализ TCP Flags: 1006319.

Остальные решающие правила исключать нельзя – они опираются на поиск контекстный поиск внутри данных TCP соединения (анализ заголовков http, анализ содержимого передаваемых по протоколу http файлов и т.п.).

После модификации набора данных векторов с меткой класса Benign – 55540495, векторов с меткой Attack – 8476 (первоначально было 57465).

Эксперимент 4. Оценка качества классификатора сетевого трафика.

Набор данных	Матрица ошибок	Показатели качества классификации
dataset_1.csv	clear as clear (TN-true negative): 9999112 clear as attack (FP-false positive): 3 attack as clear (FN-false negative): 5 attack as attack (TP-true positive): 880	accuracy = 0.9999 precision = 0.9966 recall = 0.9943 f1-score = 0.9954
dataset_2.csv	clear as clear (TN-true negative): 9998235 clear as attack (FP-false positive): 1 attack as clear (FN-false negative): 34 attack as attack (TP-true positive): 1730	accuracy = 0.9999 precision = 0.9994 recall = 0.9807 f1-score = 0.9899
dataset_3.csv	clear as clear (TN-true negative): 9997651 clear as attack (FP-false positive): 9 attack as clear (FN-false negative): 83 attack as attack (TP-true positive): 2257	accuracy = 0.9999 precision = 0.9960 recall = 0.9645 f1-score = 0.98
dataset_4.csv	clear as clear (TN-true negative): 9999968 clear as attack (FP-false positive): 1 attack as clear (FN-false negative): 0 attack as attack (TP-true positive): 31	accuracy = 0.9999 precision = 0.9687 recall = 1.0 f1-score = 0.9841
dataset_5.csv	clear as clear (TN-true negative): 9999952 clear as attack (FP-false positive): 1 attack as clear (FN-false negative): 1 attack as attack (TP-true positive): 46	accuracy = 0.9999 precision = 0.9787 recall = 0.9787 f1-score = 0.9787
dataset_6.csv	clear as clear (TN-true negative): 5545538 clear as attack (FP-false positive): 24 attack as clear (FN-false negative): 56 attack as attack (TP-true positive): 3353	accuracy = 0.9999 precision = 0.9928 recall = 0.9835 f1-score = 0.9882

Время обучения модели 39 мин 58 сек, время классификации 55 млн. векторов – 7 мин 56 сек.

Эксперимент 4. Таблица ошибок «пропуска» цели.

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|0	1954\|11	0\|0	0\|0	3036\|8
2	2014819	ET INFO Packed Executable Download	145\|0	224\|0	261\|37	31\|0	47\|1	278\|30
3	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|0	66\|6	0\|0	0\|0	73\|2
4	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|2	0\|0	0\|0	5\|0
5	1006213	MultiProxy Firefox Add-ons	33\|5	3\|1	0\|0	0\|0	0\|0	0\|0
6	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
7	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|0	5\|0	0\|0	0\|0	1\|0
8	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|2	0\|0	0\|0	4\|4
9	2013927	ET INFO HTTP traffic on port 443 (HEAD)	0\|0	2\|0	2\|2	0\|0	0\|0	1\|1
10	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
11	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|4	0\|0	0\|0	1\|1
12	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|2	2\|2	0\|0	0\|0	0\|0
13	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
14	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|0	0\|0	0\|0	0\|0	0\|0
15	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|0	1\|1	0\|0	0\|0	0\|0
16	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
17	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
18	2054246	ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
19	2038967	ET INFO SSH-2.0-Go version string Observed in Network Traffic	0\|0	1\|1	0\|0	0\|0	0\|0	0\|0
20	1006206	Browsec-VPN	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
21	2060251	ET INFO Go-http-client User-Agent Observed Outbound	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
22	2014788	ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
23	2017499	ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
24	1006914	Possible trojan activity (base64-encoded content)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
25	1003302	Anonymizer detected	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
26	2018383	ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
27	2012252	ET SHELLCODE Common 0a0a0a0a Heap Spray String	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
28	2048493	ET INFO ISO File Downloaded	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1

Выводы по эксперименту:

на третьем временном интервале появились новые события безопасности, на которых обучения ML IDS не проводилось и классификатор из не "видит". В качестве эксперимента попробуем переобучить систему и добавить ошибочные вектора из файла dataset_3.

Эксперимент 5.

Исходными данными для эксперимента возьмем датасеты эксперимента 4 + добавим только ошибочные вектора (вектора с "пропуском" цели) из файла dataset_3.

Эксперимент 5. Оценка качества классификатора сетевого трафика.

Набор данных	Матрица ошибок	Показатели качества классификации
dataset_1.csv	clear as clear (TN-true negative): 9999111 clear as attack (FP-false positive): 4 attack as clear (FN-false negative): 3 attack as attack (TP-true positive): 882	accuracy = 0.9999 precision = 0.9954 recall = 0.9966 f1-score = 0.9960
dataset_2.csv	clear as clear (TN-true negative): 9998235 clear as attack (FP-false positive): 1 attack as clear (FN-false negative): 32 attack as attack (TP-true positive): 1732	accuracy = 0.9999 precision = 0.9994 recall = 0.9818 f1-score = 0.9905
dataset_3.csv	clear as clear (TN-true negative): 9997641 clear as attack (FP-false positive): 19 attack as clear (FN-false negative): 24 attack as attack (TP-true positive): 2316	accuracy = 0.9999 precision = 0.9918 recall = 0.9897 f1-score = 0.9908
dataset_4.csv	clear as clear (TN-true negative): 9999967 clear as attack (FP-false positive): 2 attack as clear (FN-false negative): 0 attack as attack (TP-true positive): 31	accuracy = 0.9999 precision = 0.9393 recall = 1.0 f1-score = 0.9687
dataset_5.csv	clear as clear (TN-true negative): 9999951 clear as attack (FP-false positive): 2 attack as clear (FN-false negative): 0 attack as attack (TP-true positive): 47	accuracy = 0.9999 precision = 0.9591 recall = 1.0 f1-score = 0.9791
dataset_6.csv	clear as clear (TN-true negative): 5545527 clear as attack (FP-false positive): 35 attack as clear (FN-false negative): 45 attack as attack (TP-true positive): 3364	accuracy = 0.9999 precision = 0.9897 recall = 0.9867 f1-score = 0.9882

Время обучения модели 39 мин 38 сек, время классификации 55 млн. векторов – 8 мин 12 сек.

Эксперимент 5. Таблица ошибок «пропуска» цели.

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|0	1954\|0	0\|0	0\|0	3036\|2
2	2014819	ET INFO Packed Executable Download	145\|0	224\|1	261\|5	31\|0	47\|0	278\|29
3	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|0	66\|6	0\|0	0\|0	73\|2
4	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|1	0\|0	0\|0	5\|0
5	1006213	MultiProxy Firefox Add-ons	33\|3	3\|0	0\|0	0\|0	0\|0	0\|0
6	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
7	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|0	5\|0	0\|0	0\|0	1\|0
8	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|1	0\|0	0\|0	4\|2
9	2013927	ET INFO HTTP traffic on port 443 (HEAD)	0\|0	2\|0	2\|0	0\|0	0\|0	1\|0
10	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|1	0\|0	0\|0	2\|1
11	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|0	0\|0	0\|0	1\|1
12	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|0	2\|0	0\|0	0\|0	0\|0
13	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
14	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|0	0\|0	0\|0	0\|0	0\|0
15	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|0	1\|1	0\|0	0\|0	0\|0
16	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
17	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
18	2054246	ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
19	2038967	ET INFO SSH-2.0-Go version string Observed in Network Traffic	0\|0	1\|1	0\|0	0\|0	0\|0	0\|0
20	1006206	Browsec-VPN	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
21	2060251	ET INFO Go-http-client User-Agent Observed Outbound	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
22	2014788	ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
23	2017499	ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
24	1006914	Possible trojan activity (base64-encoded content)	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
25	1003302	Anonymizer detected	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
26	2018383	ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
27	2012252	ET SHELLCODE Common 0a0a0a0a Heap Spray String	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
28	2048493	ET INFO ISO File Downloaded	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1

Выводы по эксперименту 5:

добавление в обучающую выборку новых векторов атак, которые ранее не встречались, может приводить к положительному результату (строки 10, 11, 21, 22, 23, 24) однако могут появляться дополнительные ложные срабатывания (для выяснения причин необходимо оценить близость новых векторов до «чистых»);
иногда добавление информации об атаках не приносит ни какого результата или качество распознавания этих атак не высокое (строки 8, 20, 25, 26);
интересная для анализа строка 2 (событие «ET INFO Packed Executable Download», суть данного правила раскрыта выше). Добавление новой информации о такой атаке с одной стороны позволяет уменьшить пропуск цели на обучающей выборке, а вот обобщающая способность совсем не высокая (ошибки в последнем столбце). При этом, скорее всего, такие правила добавляют ложные срабатывания;
как бы не проходило обучение, но есть атаки, которые все равно не распознаются (например, строки 6, 8). По идеи их необходимо убирать из датасета (устанавливать метку класса Benign).

Общие выводы по проведенному исследованию

ML IDS уровня сети можно построить на уже эксплуатируемой сети связи, опираясь при этом на события безопасности, зарегистрированные с помощью IDS Suricata.
Разметка датасетов с использованием данных срабатываний сигнатурных анализаторов (IDS Suricata / Snort и т.п.) имеет преимущество – тонкая настройка решающих правил сигнатурных анализаторов позволяет убрать большое количество «ложных» срабатываний, на которые операторы систем обнаружения вторжений не «обращают» внимание.
Не все срабатывания IDS Suracata (sid зарегистрированных атак) можно использовать для разметки датасетов:
– много решающих правил сигнатурных анализаторов опираются на поиск исключительно адресной информации: SNI TLS соединений, конкретные IP адреса, обращения к конкретным веб-страницам. Если при разметке датасета будут применены такие sid очень высокая вероятность появления дополнительных «ложных» срабатываний и «пропуска» цели ML IDS;
– для качественного распознавания некоторых атак (sid) необходимо изменение признакового пространства (в проведенном выше исследовании, к таким атакам были отнесены различные способы сканирования портов).
На этапе разметки датасета важно проводить оценку близости векторов признаков сетевых соединений, имеющих разные метки классов. Появление векторов с одинаковыми, или очень близкими значениями векторов признаков, но разными метками классов приводит к существенному ухудшению точности ML моделей. Одной из причин появления одинаковых значениями признаков в векторах, но разными метками классов является несовершенство самого признаковое пространства (т.е. требуется изменения признаков).
Обучающая выборка должна была репрезентативной. ML модель возможно необходимо обучить заново в следующих ситуациях:
– появление новых типов (sid) компьютерных атак;
– модификация или удаление решающих правил сигнатурных анализаторов (раньше был sid и были вектора им соответствующие в датасете, теперь такие же вектора будут иметь другую метку класса);
– изменение количества сотрудников в компании или изменение их трудовых функций (изменение сетевой нагрузки и как следствие влияние трафика пользователей на задержки, маршрутизацию / балансировку трафика в сети и т.п.);
– изменение сетевого оборудования или набора локальных сетевых сервисов компании (изменение задержек в сети связи, маршрутизации / балансировки трафика в сети и т.п.).
Для качественного обучения ML IDS, в нашем случае, требуется 1 недели наблюдения за сетевым трафиком компании (включая, выходные и рабочие дни).
На этапе оценки качества обученной ML модели важно провести анализ ошибок классификации.
Причины ошибок:
– некачественные решающие правила сигнатурных анализаторов (IDS Suricata);
– состязательные атаки на ML модель.
Набор значимых признаков для распознавания разных типов компьютерных атак различный (очевидно, что для распознавания атак типа brute force и для распознавания сканирования портов признаки, отличающие их друг от друга, будут различные).
При сопоставлении событий безопасности IDS Suricata с векторами, характеризующими соответствующие сетевые соединения (session_analyzer или аналогичные утилиты) необходимо учесть следующее:
– метка времени срабатывания решающего правила IDS Suricata чаще всего не совпадает со временем начала сетевого соединения;
– одному и тому же событию безопасности IDS Suricata может соответствовать 2 сетевых соединения – это зависит от точки наблюдения за трафиком (например, session_analyzer может наблюдать за трафиком как до, так и после шлюза). Подробнее можно посмотреть выше в подразделе «Особенности приема сетевого трафика».
Качество ML IDS классификатора по метрики F1-меры при должной разметке датасета может достигать 0.98.

Недостатки проведенного исследования

Использование бинарной классификации при построении ML IDS, что в при практическом внедрении в существующие средства NGFW является на наш взгляд не приемлемым. Нельзя ответить на вопрос – какой класс атаки был зарегистрирован и как реагировать на такое событие?
При построении ML IDS защищаемым объектом была пользовательская сеть, а не конкретный ресурс, по этому на основании полученных результатов невозможно ответить на вопрос: какие классы атак на реальный объект защиты (например, web-сервер) возможно обнаруживать с помощью технологии ML IDS уровня сети.

В наших будущих публикациях постараемся ответить Вам, дорогие читатели, на эти вопросы. До скорой встречи!

Источник

Теги

ICO

Категория

Новости

Дата

26 мар. 2026 г.

25.05.26 12:25 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
25.05.26 20:55 luciajessy3

After falling victim to a fake crypto investment platform, I lost nearly $73,000 in Ethereum. The scammers disappeared overnight, and I honestly thought my money was gone forever. A friend recommended ADAM WILSON and although I was hesitant at first, I decided to give it one last try. Their team handled my case professionally, kept me updated throughout the process, and used Blockchain tracing methods I didn’t even know were possible. Within weeks, they were able to help me recover my funds. I’m incredibly grateful for their dedication and transparency. If you’ve been scammed in crypto, don’t lose hope contact ADAMWILSON . TRADING @ CONSULTANT COM What's App / + 1 { 7 1 3 } 9 1 9 - 5 1 2 3
25.05.26 20:55 luciajessy3

After falling victim to a fake crypto investment platform, I lost nearly $73,000 in Ethereum. The scammers disappeared overnight, and I honestly thought my money was gone forever. A friend recommended ADAM WILSON and although I was hesitant at first, I decided to give it one last try. Their team handled my case professionally, kept me updated throughout the process, and used Blockchain tracing methods I didn’t even know were possible. Within weeks, they were able to help me recover my funds. I’m incredibly grateful for their dedication and transparency. If you’ve been scammed in crypto, don’t lose hope contact ADAMWILSON . TRADING @ CONSULTANT COM What's App / + 1 { 7 1 3 } 9 1 9 - 5 1 2 3
25.05.26 20:55 luciajessy3

After falling victim to a fake crypto investment platform, I lost nearly $73,000 in Ethereum. The scammers disappeared overnight, and I honestly thought my money was gone forever. A friend recommended ADAM WILSON and although I was hesitant at first, I decided to give it one last try. Their team handled my case professionally, kept me updated throughout the process, and used Blockchain tracing methods I didn’t even know were possible. Within weeks, they were able to help me recover my funds. I’m incredibly grateful for their dedication and transparency. If you’ve been scammed in crypto, don’t lose hope contact ADAMWILSON . TRADING @ CONSULTANT COM What's App / + 1 { 7 1 3 } 9 1 9 - 5 1 2 3
25.05.26 20:55 luciajessy3

After falling victim to a fake crypto investment platform, I lost nearly $73,000 in Ethereum. The scammers disappeared overnight, and I honestly thought my money was gone forever. A friend recommended ADAM WILSON and although I was hesitant at first, I decided to give it one last try. Their team handled my case professionally, kept me updated throughout the process, and used Blockchain tracing methods I didn’t even know were possible. Within weeks, they were able to help me recover my funds. I’m incredibly grateful for their dedication and transparency. If you’ve been scammed in crypto, don’t lose hope contact ADAMWILSON . TRADING @ CONSULTANT COM What's App / + 1 { 7 1 3 } 9 1 9 - 5 1 2 3
26.05.26 14:45 kimberlyhebert786

I invested in bitcoin trading After losing $78.4 USDT) linked to a romance fraud scam worth of cryptocurrency through an online investment platform and later discovered it was a scam. After extensive research for recovery options, I contacted CAPITAL CRYPTO RECOVER based on positive client reviews and recommendations. Their professional security team guided me through the recovery process using advanced technology, and I was able to recover my lost cryptocurrency successfully. I am truly grateful for their support and assistance during such a difficult experience. I will advise you to contact CAPITAL CRYPTO RECOVER helped me recover my funds. For anyone facing similar issues, Website: https://recovercapital.wixsite.com/capital-crypto-rec-1 Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text Number: +1 (336) 390-6684
26.05.26 14:45 kimberlyhebert786

I invested in bitcoin trading After losing $78.4 USDT) linked to a romance fraud scam worth of cryptocurrency through an online investment platform and later discovered it was a scam. After extensive research for recovery options, I contacted CAPITAL CRYPTO RECOVER based on positive client reviews and recommendations. Their professional security team guided me through the recovery process using advanced technology, and I was able to recover my lost cryptocurrency successfully. I am truly grateful for their support and assistance during such a difficult experience. I will advise you to contact CAPITAL CRYPTO RECOVER helped me recover my funds. For anyone facing similar issues, Website: https://recovercapital.wixsite.com/capital-crypto-rec-1 Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text Number: +1 (336) 390-6684
28.05.26 03:09 kientadams11

Lot of people have lost money to scammers in so many ways which, I have been a victim as well of over 30 thousand pounds, this scammers are smart they create fake investment website, fake recovery site to swindle people of their Bitcoin. I found recoverydarek at G (M) (A) (I) (L) on Trust pilot who was able to track, investigate and expose this scammers and re coupled my funds back to me within 24 hours.
28.05.26 03:09 kientadams11

Lot of people have lost money to scammers in so many ways which, I have been a victim as well of over 30 thousand pounds, this scammers are smart they create fake investment website, fake recovery site to swindle people of their Bitcoin. I found recoverydarek at G (M) (A) (I) (L) on Trust pilot who was able to track, investigate and expose this scammers and re coupled my funds back to me within 24 hours.
28.05.26 04:01 luciajessy3

After falling victim to a fake crypto investment platform, I lost nearly $73,000 in Ethereum. The scammers disappeared overnight, and I honestly thought my money was gone forever. A friend recommended ADAM WILSON and although I was hesitant at first, I decided to give it one last try. Their team handled my case professionally, kept me updated throughout the process, and used Blockchain tracing methods I didn’t even know were possible. Within weeks, they were able to help me recover my funds. I’m incredibly grateful for their dedication and transparency. If you’ve been scammed in crypto, don’t lose hope contact ADAMWILSON . TRADING @ CONSULTANT COM What's App / + 1 { 7 1 3 } 9 1 9 - 5 1 2 3
28.05.26 09:40 kientadams11

Lot of people have lost money to scammers in so many ways which, I have been a victim as well of over 30 thousand pounds, this scammers are smart they create fake investment website, fake recovery site to swindle people of their Bitcoin. I found recoverydarek at G (M) (A) (I) (L) on Trust pilot who was able to track, investigate and expose this scammers and re coupled my funds back to me within 24 hours.
28.05.26 14:04 Frankmilton

Losing any Scent on the dollar hurts like a bad stomach ache from eating from the wrong MaC.Donalds. This stablecoin stays near one dollar. Traders use it to swap for Bitcoin or Ethereum without big price jumps. New users pick it first for its ease. Banks hold cash reserves to back it up. Losses hit fast. A wrong wallet address sends coins to strangers. Scams on Telegram steal seed phrases. DeFi bugs or hacks drain funds. Billions vanish each year from these mistakes. Blockchains track every step. Copy your transaction hash. Check it on Etherscan. Follow the trail to the wallet or contract. [email protected] +(44 7476618364) can help. Her team hunts funds across chains. They work with exchanges and devs to get assets back. People recover thousands of assets already even after being lost for years of failed agency and fake recovery experts. also teaches safety. Spot phishing in MetaMask. Secure your Ledger. Trade safe on Binance or Uniswap. Fix rookie slips into smart habits.
28.05.26 18:53 kimberlyhebert786

I invested in bitcoin trading After losing $78.4 USDT) linked to a romance fraud scam worth of cryptocurrency through an online investment platform and later discovered it was a scam. After extensive research for recovery options, I contacted CAPITAL CRYPTO RECOVER based on positive client reviews and recommendations. Their professional security team guided me through the recovery process using advanced technology, and I was able to recover my lost cryptocurrency successfully. I am truly grateful for their support and assistance during such a difficult experience. I will advise you to contact CAPITAL CRYPTO RECOVER helped me recover my funds. For anyone facing similar issues, Website: https://recovercapital.wixsite.com/capital-crypto-rec-1 Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text Number: +1 (336) 390-6684
28.05.26 18:53 kimberlyhebert786

I invested in bitcoin trading After losing $78.4 USDT) linked to a romance fraud scam worth of cryptocurrency through an online investment platform and later discovered it was a scam. After extensive research for recovery options, I contacted CAPITAL CRYPTO RECOVER based on positive client reviews and recommendations. Their professional security team guided me through the recovery process using advanced technology, and I was able to recover my lost cryptocurrency successfully. I am truly grateful for their support and assistance during such a difficult experience. I will advise you to contact CAPITAL CRYPTO RECOVER helped me recover my funds. For anyone facing similar issues, Website: https://recovercapital.wixsite.com/capital-crypto-rec-1 Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text Number: +1 (336) 390-6684
28.05.26 21:56 Frankmilton

Losing any Scent on the dollar hurts like a bad stomach ache from eating from the wrong MaC.Donalds. This stablecoin stays near one dollar. Traders use it to swap for Bitcoin or Ethereum without big price jumps. New users pick it first for its ease. Banks hold cash reserves to back it up. Losses hit fast. A wrong wallet address sends coins to strangers. Scams on Telegram steal seed phrases. DeFi bugs or hacks drain funds. Billions vanish each year from these mistakes. Blockchains track every step. Copy your transaction hash. Check it on Etherscan. Follow the trail to the wallet or contract. [email protected] +(44 7476618364) can help. Her team hunts funds across chains. They work with exchanges and devs to get assets back. People recover thousands of assets already even after being lost for years of failed agency and fake recovery experts. also teaches safety. Spot phishing in MetaMask. Secure your Ledger. Trade safe on Binance or Uniswap. Fix rookie slips into smart habits.
29.05.26 02:26 luciajessy3

After falling victim to a fake crypto investment platform, I lost nearly $73,000 in Ethereum. The scammers disappeared overnight, and I honestly thought my money was gone forever. A friend recommended ADAM WILSON and although I was hesitant at first, I decided to give it one last try. Their team handled my case professionally, kept me updated throughout the process, and used Blockchain tracing methods I didn’t even know were possible. Within weeks, they were able to help me recover my funds. I’m incredibly grateful for their dedication and transparency. If you’ve been scammed in crypto, don’t lose hope contact ADAMWILSON . TRADING @ CONSULTANT COM What's App / + 1 { 7 1 3 } 9 1 9 - 5 1 2 3
29.05.26 02:27 luciajessy3

After falling victim to a fake crypto investment platform, I lost nearly $73,000 in Ethereum. The scammers disappeared overnight, and I honestly thought my money was gone forever. A friend recommended ADAM WILSON and although I was hesitant at first, I decided to give it one last try. Their team handled my case professionally, kept me updated throughout the process, and used Blockchain tracing methods I didn’t even know were possible. Within weeks, they were able to help me recover my funds. I’m incredibly grateful for their dedication and transparency. If you’ve been scammed in crypto, don’t lose hope contact ADAMWILSON . TRADING @ CONSULTANT COM What's App / + 1 { 7 1 3 } 9 1 9 - 5 1 2 3
29.05.26 04:46 Frankmilton

Losing any Scent on the dollar hurts like a bad stomach ache from eating from the wrong MaC.Donalds. This stablecoin stays near one dollar. Traders use it to swap for Bitcoin or Ethereum without big price jumps. New users pick it first for its ease. Banks hold cash reserves to back it up. Losses hit fast. A wrong wallet address sends coins to strangers. Scams on Telegram steal seed phrases. DeFi bugs or hacks drain funds. Billions vanish each year from these mistakes. Blockchains track every step. Copy your transaction hash. Check it on Etherscan. Follow the trail to the wallet or contract. [email protected] +(44 7476618364) can help. Her team hunts funds across chains. They work with exchanges and devs to get assets back. People recover thousands of assets already even after being lost for years of failed agency and fake recovery experts. also teaches safety. Spot phishing in MetaMask. Secure your Ledger. Trade safe on Binance or Uniswap. Fix rookie slips into smart habits
31.05.26 10:06 wendytaylor015

My name is Wendy Taylor, I'm from Los Angeles, i want to announce to you Viewer how Capital Crypto Recover help me to restore my Lost Bitcoin, I invested with a Crypto broker without proper research to know what I was hoarding my hard-earned money into scammers, i lost access to my crypto wallet or had your funds stolen? Don’t worry Capital Crypto Recover is here to help you recover your cryptocurrency with cutting-edge technical expertise, With years of experience in the crypto world, Capital Crypto Recover employs the best latest tools and ethical hacking techniques to help you recover lost assets, unlock hacked accounts, Whether it’s a forgotten password, Capital Crypto Recover has the expertise to help you get your crypto back. a security company service that has a 100% success rate in the recovery of crypto assets, i lost wallet and hacked accounts. I provided them the information they requested and they began their investigation. To my surprise, Capital Crypto Recover was able to trace and recover my crypto assets successfully within 24hours. Thank you for your service in helping me recover my $647,734 worth of crypto funds and I highly recommend their recovery services, they are reliable and a trusted company to any individuals looking to recover lost money. Contact email [email protected] OR Telegram @Capitalcryptorecover Call/Text Number +1 (336)390-6684 his contact: [email protected] His website: https://recovercapital.wixsite.com/capital-crypto-rec-1
31.05.26 10:06 wendytaylor015

My name is Wendy Taylor, I'm from Los Angeles, i want to announce to you Viewer how Capital Crypto Recover help me to restore my Lost Bitcoin, I invested with a Crypto broker without proper research to know what I was hoarding my hard-earned money into scammers, i lost access to my crypto wallet or had your funds stolen? Don’t worry Capital Crypto Recover is here to help you recover your cryptocurrency with cutting-edge technical expertise, With years of experience in the crypto world, Capital Crypto Recover employs the best latest tools and ethical hacking techniques to help you recover lost assets, unlock hacked accounts, Whether it’s a forgotten password, Capital Crypto Recover has the expertise to help you get your crypto back. a security company service that has a 100% success rate in the recovery of crypto assets, i lost wallet and hacked accounts. I provided them the information they requested and they began their investigation. To my surprise, Capital Crypto Recover was able to trace and recover my crypto assets successfully within 24hours. Thank you for your service in helping me recover my $647,734 worth of crypto funds and I highly recommend their recovery services, they are reliable and a trusted company to any individuals looking to recover lost money. Contact email [email protected] OR Telegram @Capitalcryptorecover Call/Text Number +1 (336)390-6684 his contact: [email protected] His website: https://recovercapital.wixsite.com/capital-crypto-rec-1
05.06.26 18:26 edengarcia

When most people hear the words crypto recovery service, their guard immediately goes up—and for good reason. In today’s online environment, finding a legitimate service feels like finding a needle in a haystack. Ask about trusted crypto recovery on any major forum, and you’ll be met with hostility. It’s become a cultural bias that victims often prefer filing police reports rather than seeking private help, fearing that speaking openly will only attract more scammers. But silence doesn’t bring your funds back. Website https://techyforcecyberretrieval.com Whatsapp +15617263697 The reality is harsh: Less than 10% of “recovery agencies” online are genuine. Fraudsters have mastered the art of mimicking trust. So, how do you separate the wolves from the professionals? The Golden Rule: No Upfront Fees If there is one sign that separates a scam from a legitimate operation, it is the payment model. Legitimate recovery companies never ask for upfront fees. Predatory scams will demand "processing fees," "software licenses," or "tax payments" before they lift a finger. A genuine agency knows its value lies in results, not promises. They operate on a success-based fee —typically around 10% of the recovered amount. Simply put: No recovery, no payment. Enter TechY Force Cyber Retrieval At TechY Force Cyber Retrieval, we understand why you’re skeptical. We built our model to eliminate that risk. We specialize in the fast, forensic tracking of lost crypto assets. Because we are confident in our technology and methodology, we don’t need your money to start working—we need your trust. We only get paid once you receive your crypto. How to Spot a Legitimate Partner Beyond the fee structure, keep these signs in mind: 1. Transparency: They explain how without asking for your private keys or seed phrase. 2. Realism: They don’t promise 100% success on impossible cases but offer honest assessments. 3. Speed: Time is critical in blockchain tracing. Legitimate firms act fast. Website https://techyforcecyberretrieval.com Whatsapp +15617263697 Don’t let the fear of secondary scams prevent you from seeking justice. Choose a partner who puts their money where their mouth is. TechY Force Cyber Retrieval: Fast. Secure. Success-based. Disclaimer: Always conduct your own due diligence. Legitimate firms will never ask for your wallet credentials.
07.06.26 08:58 keithwilson9899

ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team's primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance Phone (Call/Text): +1 (336) 390-6684 Email: [email protected] Alternate Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
07.06.26 08:58 keithwilson9899

ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team's primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance Phone (Call/Text): +1 (336) 390-6684 Email: [email protected] Alternate Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
07.06.26 21:00 gordondowney9

Email: [email protected] Telegram —digitallightsolution, https://t.me/digitallightsolution Losing my USDT to a fraudulent cryptocurrency platform was one of the most painful and overwhelming experiences I have ever faced. I felt devastated, confused, and ashamed that something I had placed my trust in had turned out to be a scam. For a while, I did not know where to turn or whether there was any real hope of recovering what I had lost. During that very difficult time, a trusted pastor recommended Digital-Light-Solution, and although I was hesitant at first, I decided to visit their website https://digitallightsolution.com/. From my first interaction with them, I felt a sense of relief. They listened to my situation with patience and understanding, and they treated me with kindness at a time when I felt completely broken. Their team explained the process clearly, answered my questions, and kept me informed throughout. What meant the most to me was not just their professionalism, but the way they made me feel supported when I was struggling emotionally. As the process continued, I began to regain a sense of hope. They remained consistent, responsive, and committed to my case, which gave me comfort during an incredibly stressful period. In the end, Digital-Light-Solutions was able to assist with tracing my lost USDT and supporting the recovery process. The relief my family and I felt is difficult to put into words. I will always be grateful for the support, compassion, and professionalism they showed me during one of the hardest moments of my life, I highly recommend their services to anyone in need. Contact them today for assistance
07.06.26 21:00 gordondowney9

Email: [email protected] Telegram —digitallightsolution, https://t.me/digitallightsolution Losing my USDT to a fraudulent cryptocurrency platform was one of the most painful and overwhelming experiences I have ever faced. I felt devastated, confused, and ashamed that something I had placed my trust in had turned out to be a scam. For a while, I did not know where to turn or whether there was any real hope of recovering what I had lost. During that very difficult time, a trusted pastor recommended Digital-Light-Solution, and although I was hesitant at first, I decided to visit their website https://digitallightsolution.com/. From my first interaction with them, I felt a sense of relief. They listened to my situation with patience and understanding, and they treated me with kindness at a time when I felt completely broken. Their team explained the process clearly, answered my questions, and kept me informed throughout. What meant the most to me was not just their professionalism, but the way they made me feel supported when I was struggling emotionally. As the process continued, I began to regain a sense of hope. They remained consistent, responsive, and committed to my case, which gave me comfort during an incredibly stressful period. In the end, Digital-Light-Solutions was able to assist with tracing my lost USDT and supporting the recovery process. The relief my family and I felt is difficult to put into words. I will always be grateful for the support, compassion, and professionalism they showed me during one of the hardest moments of my life, I highly recommend their services to anyone in need. Contact them today for assistance
07.06.26 21:02 gordondowney9

Email: [email protected] Telegram —digitallightsolution, https://t.me/digitallightsolution Losing my USDT to a fraudulent cryptocurrency platform was one of the most painful and overwhelming experiences I have ever faced. I felt devastated, confused, and ashamed that something I had placed my trust in had turned out to be a scam. For a while, I did not know where to turn or whether there was any real hope of recovering what I had lost. During that very difficult time, a trusted pastor recommended Digital-Light-Solution, and although I was hesitant at first, I decided to visit their website https://digitallightsolution.com/. From my first interaction with them, I felt a sense of relief. They listened to my situation with patience and understanding, and they treated me with kindness at a time when I felt completely broken. Their team explained the process clearly, answered my questions, and kept me informed throughout. What meant the most to me was not just their professionalism, but the way they made me feel supported when I was struggling emotionally. As the process continued, I began to regain a sense of hope. They remained consistent, responsive, and committed to my case, which gave me comfort during an incredibly stressful period. In the end, Digital-Light-Solutions was able to assist with tracing my lost USDT and supporting the recovery process. The relief my family and I felt is difficult to put into words. I will always be grateful for the support, compassion, and professionalism they showed me during one of the hardest moments of my life, I highly recommend their services to anyone in need. Contact them today for assistance
07.06.26 21:02 gordondowney9

Email: [email protected] Telegram —digitallightsolution, https://t.me/digitallightsolution Losing my USDT to a fraudulent cryptocurrency platform was one of the most painful and overwhelming experiences I have ever faced. I felt devastated, confused, and ashamed that something I had placed my trust in had turned out to be a scam. For a while, I did not know where to turn or whether there was any real hope of recovering what I had lost. During that very difficult time, a trusted pastor recommended Digital-Light-Solution, and although I was hesitant at first, I decided to visit their website https://digitallightsolution.com/. From my first interaction with them, I felt a sense of relief. They listened to my situation with patience and understanding, and they treated me with kindness at a time when I felt completely broken. Their team explained the process clearly, answered my questions, and kept me informed throughout. What meant the most to me was not just their professionalism, but the way they made me feel supported when I was struggling emotionally. As the process continued, I began to regain a sense of hope. They remained consistent, responsive, and committed to my case, which gave me comfort during an incredibly stressful period. In the end, Digital-Light-Solutions was able to assist with tracing my lost USDT and supporting the recovery process. The relief my family and I felt is difficult to put into words. I will always be grateful for the support, compassion, and professionalism they showed me during one of the hardest moments of my life, I highly recommend their services to anyone in need. Contact them today for assistance
07.06.26 21:03 gordondowney9

Email: [email protected] Telegram —digitallightsolution, https://t.me/digitallightsolution Losing my USDT to a fraudulent cryptocurrency platform was one of the most painful and overwhelming experiences I have ever faced. I felt devastated, confused, and ashamed that something I had placed my trust in had turned out to be a scam. For a while, I did not know where to turn or whether there was any real hope of recovering what I had lost. During that very difficult time, a trusted pastor recommended Digital-Light-Solution, and although I was hesitant at first, I decided to visit their website https://digitallightsolution.com/. From my first interaction with them, I felt a sense of relief. They listened to my situation with patience and understanding, and they treated me with kindness at a time when I felt completely broken. Their team explained the process clearly, answered my questions, and kept me informed throughout. What meant the most to me was not just their professionalism, but the way they made me feel supported when I was struggling emotionally. As the process continued, I began to regain a sense of hope. They remained consistent, responsive, and committed to my case, which gave me comfort during an incredibly stressful period. In the end, Digital-Light-Solutions was able to assist with tracing my lost USDT and supporting the recovery process. The relief my family and I felt is difficult to put into words. I will always be grateful for the support, compassion, and professionalism they showed me during one of the hardest moments of my life, I highly recommend their services to anyone in need. Contact them today for assistance
07.06.26 21:04 gordondowney9

Email: [email protected] Telegram —digitallightsolution, https://t.me/digitallightsolution Losing my USDT to a fraudulent cryptocurrency platform was one of the most painful and overwhelming experiences I have ever faced. I felt devastated, confused, and ashamed that something I had placed my trust in had turned out to be a scam. For a while, I did not know where to turn or whether there was any real hope of recovering what I had lost. During that very difficult time, a trusted pastor recommended Digital-Light-Solution, and although I was hesitant at first, I decided to visit their website https://digitallightsolution.com/. From my first interaction with them, I felt a sense of relief. They listened to my situation with patience and understanding, and they treated me with kindness at a time when I felt completely broken. Their team explained the process clearly, answered my questions, and kept me informed throughout. What meant the most to me was not just their professionalism, but the way they made me feel supported when I was struggling emotionally. As the process continued, I began to regain a sense of hope. They remained consistent, responsive, and committed to my case, which gave me comfort during an incredibly stressful period. In the end, Digital-Light-Solutions was able to assist with tracing my lost USDT and supporting the recovery process. The relief my family and I felt is difficult to put into words. I will always be grateful for the support, compassion, and professionalism they showed me during one of the hardest moments of my life, I highly recommend their services to anyone in need. Contact them today for assistance
10.06.26 06:21 wendytaylor015

My name is Wendy Taylor, I'm from Los Angeles, i want to announce to you Viewer how Capital Crypto Recover help me to restore my Lost Bitcoin, I invested with a Crypto broker without proper research to know what I was hoarding my hard-earned money into scammers, i lost access to my crypto wallet or had your funds stolen? Don’t worry Capital Crypto Recover is here to help you recover your cryptocurrency with cutting-edge technical expertise, With years of experience in the crypto world, Capital Crypto Recover employs the best latest tools and ethical hacking techniques to help you recover lost assets, unlock hacked accounts, Whether it’s a forgotten password, Capital Crypto Recover has the expertise to help you get your crypto back. a security company service that has a 100% success rate in the recovery of crypto assets, i lost wallet and hacked accounts. I provided them the information they requested and they began their investigation. To my surprise, Capital Crypto Recover was able to trace and recover my crypto assets successfully within 24hours. Thank you for your service in helping me recover my $647,734 worth of crypto funds and I highly recommend their recovery services, they are reliable and a trusted company to any individuals looking to recover lost money. Contact email [email protected] OR Telegram @Capitalcryptorecover Call/Text Number +1 (336)390-6684 his contact: [email protected] His website: https://recovercapital.wixsite.com/capital-crypto-rec-1
10.06.26 06:21 wendytaylor015

My name is Wendy Taylor, I'm from Los Angeles, i want to announce to you Viewer how Capital Crypto Recover help me to restore my Lost Bitcoin, I invested with a Crypto broker without proper research to know what I was hoarding my hard-earned money into scammers, i lost access to my crypto wallet or had your funds stolen? Don’t worry Capital Crypto Recover is here to help you recover your cryptocurrency with cutting-edge technical expertise, With years of experience in the crypto world, Capital Crypto Recover employs the best latest tools and ethical hacking techniques to help you recover lost assets, unlock hacked accounts, Whether it’s a forgotten password, Capital Crypto Recover has the expertise to help you get your crypto back. a security company service that has a 100% success rate in the recovery of crypto assets, i lost wallet and hacked accounts. I provided them the information they requested and they began their investigation. To my surprise, Capital Crypto Recover was able to trace and recover my crypto assets successfully within 24hours. Thank you for your service in helping me recover my $647,734 worth of crypto funds and I highly recommend their recovery services, they are reliable and a trusted company to any individuals looking to recover lost money. Contact email [email protected] OR Telegram @Capitalcryptorecover Call/Text Number +1 (336)390-6684 his contact: [email protected] His website: https://recovercapital.wixsite.com/capital-crypto-rec-1
10.06.26 18:09 david

Look, engaging with the authorities is a marathon, not a sprint. By methodically filing these reports, you’re not just fighting for your own funds—you’re contributing to the broader battle against crypto crime. For a deeper dive into what to do after a theft, check out [email protected] for complete guide on how to recover stolen crypto
12.06.26 17:13 keithwilson9899

ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team's primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance Phone (Call/Text): +1 (336) 390-6684 Email: [email protected] Alternate Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
12.06.26 17:13 keithwilson9899

ETHEREUM RECOVERY ASSISTANCE: CAPITAL CRYPTO RECOVER HELPED ME RECOVER $98,000 WORTH OF LOST ETH In cases of cryptocurrency scams, having accurate information and trusted support is essential. I would like to recommend Capital Crypto Recover Service, a professional team that specializes in assisting individuals with the recovery of lost or stolen Bitcoin and Ethereum (ETH). Their experienced experts are dedicated to helping victims of digital asset fraud by carefully analyzing each case, developing strategic recovery plans, Capital Crypto Recover Service knowledgeable team's primary goals are to satisfy clients and offer significant support and working diligently toward fund retrieval. The team is committed to providing reliable assistance and maintaining a high level of client satisfaction. Based on my assessment, their reputation professionalism and a strong commitment to their clients. If you have experienced a cryptocurrency loss, you can contacting them for further assistance Phone (Call/Text): +1 (336) 390-6684 Email: [email protected] Alternate Email: [email protected] Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
14.06.26 14:53 Freeman James

Recently, I was scammed out of $332,000 in a fraudulent Bitcoin investment scheme. This devastating loss added significant stress to my already difficult health challenges, as I was also facing surgery expenses for cancer. Desperate to recover my funds, I spent countless hours researching and speaking with other victims. That effort led me to a Google post that revealed the excellent reputation of FundsRetriever. Only after many hours of digging and consulting others did I learn about their stellar track record. I decided to contact them because of their successful recovery history and encouraging client testimonials. I had no idea that this decision would become the turning point in my fight against cryptocurrency theft. Thanks to their expert team, I was able to recover my lost funds. The process was complex, but FundsRetriever's commitment to using the latest technology ensured a successful outcome. I highly recommend their services to anyone who has fallen victim to cryptocurrency fraud. For assistance, contact: 📧 [email protected] 📞 WhatsApp: +1 603 512 144 8, Telegram: @FundsRetriever
14.06.26 15:37 kimberlyhebert786

I invested in bitcoin trading After losing $78.4 USDT) linked to a romance fraud scam worth of cryptocurrency through an online investment platform and later discovered it was a scam. After extensive research for recovery options, I contacted CAPITAL CRYPTO RECOVER based on positive client reviews and recommendations. Their professional security team guided me through the recovery process using advanced technology, and I was able to recover my lost cryptocurrency successfully. I am truly grateful for their support and assistance during such a difficult experience. I will advise you to contact CAPITAL CRYPTO RECOVER helped me recover my funds. For anyone facing similar issues, Website: https://recovercapital.wixsite.com/capital-crypto-rec-1 Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text Number: +1 (336) 390-6684
14.06.26 15:37 kimberlyhebert786

I invested in bitcoin trading After losing $78.4 USDT) linked to a romance fraud scam worth of cryptocurrency through an online investment platform and later discovered it was a scam. After extensive research for recovery options, I contacted CAPITAL CRYPTO RECOVER based on positive client reviews and recommendations. Their professional security team guided me through the recovery process using advanced technology, and I was able to recover my lost cryptocurrency successfully. I am truly grateful for their support and assistance during such a difficult experience. I will advise you to contact CAPITAL CRYPTO RECOVER helped me recover my funds. For anyone facing similar issues, Website: https://recovercapital.wixsite.com/capital-crypto-rec-1 Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text Number: +1 (336) 390-6684
14.06.26 16:34 Emmi Hakola

I’m open about my experience with Bitcoin investment and losing money to scammers. That said, it is possible to recover stolen Bitcoin. I used to think recovery was impossible because that’s what I had been told. But last October, I fell for a forex scam promising extremely high returns and ended up losing nearly $87,600. After searching for help for a month, I came across a Reddit article about recovering stolen cryptocurrency. I reached out to the contact provided: [email protected] and WhatsApp +19852969146. I was scared and skeptical, having heard many bad stories, but I decided to give them a try. To my amazement, I got all my stolen Bitcoin back within a very short time. I’m not sure if I’m allowed to post links here, but you can reach out to them if you also need help.
14.06.26 16:53 James willson

I lost $328,650 to a fraudulent website that claimed to be a legitimate investment platform offering high returns. I was drawn in by the desire to earn more for myself and my family. Unfortunately, by the end of 2024, I realized it was a scam when the broker stopped responding to my emails and messages. A colleague then introduced me to ResQPro Firm, and to my surprise, they were able to trace and recover my stolen funds. Contact them at: resqprofirm AT AOL dot com | WhatsApp: +1 985 296 9146 | Telegram: ResQproFirm
14.06.26 19:38 riley777

G`DAY, I lost more than 119,000 Australian dollars to a crypto scam and it took almost everything I had saved which left me feeling like I had no future. I was stuck. I did not know where to go or how to find the money again. The wallet company is no help at all and they make it so hard to see where the coins go once they leave your account so you just feel lost. I spent days looking for a way out. Then I saw a post for a person who finds stolen money. The ad said they can track any crypto that goes missing. I wanted to check if it was real. I sent an email to [email protected] +44//// 7476618364\ to see if they could help me get my funds back. They did an amazing job. My money was back in my account in less than a week after they did a fast search and return.
15.06.26 06:12 Evan Garrison

When investing in staking platforms, proceed with caution. If your funds are stolen by a fake staking pool, the experience can be very frustrating. Rather than giving in to frustration, it's important to act quickly to improve your chances of recovering your money. Unfortunately, many victims never get their money back because scammers are often in another country or using fake identities. However, in some cases, tracking the funds is easier, especially for smart contract forensics specialists. I lost €18,500 to StakeKing. FundsRetriever found a backdoor in the contract and recovered my stake. Contact [email protected], WhatsApp +1(603)5121(448), or Telegram FUNDSRETRIEVER for assistance.
15.06.26 06:25 Glenn robble

Stop putting money into platforms promising guaranteed monthly returns of 10%, 20%, or more. These are Ponzi schemes. Your "profits" are just other victims' deposits. The moment withdrawals slow down, the scam is about to collapse. If you already have money trapped, do not send more to "unlock" your funds. That is a second scam. Instead, gather all transaction hashes and wallet addresses. Bitcoin Evolution Pro took €25,000 from me. FundsRetriever traced the funds through KYC exchanges and recovered my principal. Contact [email protected], WhatsApp +1(603)5121(448) or Telegram FUNDSRETRIEVER.
15.06.26 06:34 Sallymarch

If IQ Option or any similar platform blocks your withdrawal citing "bonus terms" or "abnormal activity," do not argue with their chat support. They are not empowered to help you. Instead, request all trade logs and bonus terms in writing. Then get FundsRetrievers forensic specialist to audit your account. IQ Option held my €9,200 for two months. FundsRetriever reviewed my case, identified regulatory violations, and secured my full payout within 72 hours. Professional pressure works. Do it immediately. Contact [email protected], WhatsApp +1(603)5121(448) or Telegram FUNDSRETRIEVER.
15.06.26 06:38 Sallymarch

If IQ Option or any similar platform blocks your withdrawal citing "bonus terms" or "abnormal activity," do not argue with their chat support. They are not empowered to help you. Instead, request all trade logs and bonus terms in writing. Then get FundsRetrievers forensic specialist to audit your account. IQ Option held my €9,200 for two months. FundsRetriever reviewed my case, identified regulatory violations, and secured my full payout within 72 hours. Professional pressure works. Do it immediately. Contact [email protected], WhatsApp +1(603)5121(448) or Telegram FUNDSRETRIEVER.
15.06.26 06:41 Ewaguz

Cloud mining contracts are almost always too good to be true. I learned that the hard way with MineMax. First two months, small daily payouts. Then "maintenance fees" ate everything. Then my account was frozen. Then the website disappeared. I was heartbroken. FundsRetriever traced my payments through three shell companies to a real bank account. They froze it and got my €11,000 back. Recovery is possible even from complex scams. Contact [email protected], WhatsApp +1(603)5121(448) or Telegram FUNDSRETRIEVER.
15.06.26 12:49 Jason

Did a scammer take your money? Fake loan, crypto fraud, romance trap, phishing—they count on you feeling helpless. Prove them wrong. FundsRetriever recovers stolen digital assets fast. No upfront payment. Ever. Backed by the FBI, Interpol, and cybercrime units. Blockchain tracing, legal freezing, and full recovery—for Bitcoin, Ethereum, USDT, Ponzi schemes, you name it. Your move: get a free case review right now. Then forensics, legal action, and your funds back. ⏳ Time is everything. 📧 FUNDSRETRIEVER @ PROTON.ME 📞 +16035121448 (WhatsApp) 📱 Telegram: @FUNDSRETRIEVER
15.06.26 12:56 Hillary

As a blockchain forensic analyst, I’ve reviewed numerous recovery cases. Fundsretriever demonstrates proper on-chain tracing, evidence preservation, and legal coordination. Their methodology helped several of my clients retrieve stolen or stuck assets. Recommended for victims seeking verifiable solutions. 📧 [email protected] Telegram @FUNDSRETRIEVER WhatsApp +1 603 512 1448
15.06.26 13:03 Feliksa Stegniy

A woman added me on Facebook, and after she suggested we become friends, we started communicating. Over time, she introduced me to a crypto trading platform called btctradingfx.com. She shared a lot of information about it, along with screenshots that made the platform seem trustworthy. Convinced by her claims, I decided to give it a try. I was promised a 10% weekly return, so I made an initial investment of $500. To my surprise, I received $5,000 back. That success encouraged me to invest more, so I put in $20,000. But when I tried to withdraw my funds, I was denied access and told I needed to deposit even more money before I could make a withdrawal. In the end, I lost a total of $43,850. It was an extremely difficult and painful experience. Fortunately, I later found a professional recovery service called ResQprofirm while searching on Google. I contacted them and provided all the evidence I had. They took my case seriously and were able to track down and recover my capital from the platform, which had been inaccessible for a long time. If you find yourself in a similar situation, you might consider reaching out to them via email at [email protected] or on WhatsApp at +19852969146, Telegram @resqprofirm Thank you, ResQPro, for your support.
15.06.26 13:05 James willson

The Most Credible Crypto Recovery Service: RESQPROFIRM RESQPROFIRM is a reliable, legitimate company that helps recover lost cryptocurrency assets. After weeks of doubting whether my lost BTC could ever be restored, I realized how widespread crypto scams have become. Caution is essential when dealing with strangers online, especially about money. While recovering stolen crypto is possible, avoiding fake "recovery companies" is just as important. Real hackers work discreetly and don't advertise openly. I was scammed multiple times while desperately seeking help. Finally, a friend introduced me to RESQPROFIRM—a trustworthy, discreet team. They handle everything from website security to crypto asset recovery. With their help, I recovered $320,000 in USDT within a week. Their professionalism, discretion, and speed were outstanding. If you've been compromised, don't lose hope—but beware of fraudsters posing as saviors. RESQPROFIRM are true professionals. I'm living proof. Contact them at [email protected], WhatsApp +19852969146, or Telegram @resqprofirm.
15.06.26 13:06 Tansy

Lost $18,500 to a fake Elon Musk crypto giveaway. Sent ETH, got nothing. Recovery pages demanded more gas fees. I stopped believing. FuNds rEtRiEveR on Te.le_gram was the real one. Email: [email protected] – WhatsApp: +1 603 512 1448
15.06.26 13:08 Sarahy billy

A REAL EXPERIENCE, EVERYONE ... PLEASE BE CAREFUL ONLINE A few weeks ago, I lost around $64,000 to a fake crypto trading platform. I was drawn in by the promise of earning 15% profit daily. It was a devastating time—I struggled to pay my bills and was financially ruined. I eventually opened up to a close friend, who recommended a crypto recovery team with highly effective methods. I contacted them, and they successfully recovered all my stolen digital assets with ease. Their service was excellent, and they acted quickly—within just 5 working days, they tracked down the scammers and returned my funds. I strongly urge anyone facing investment theft or similar issues to reach out to this team for the right solution and avoid losing large sums to fraudsters... Email: Resqprofirm @aol.com WhatsApp: +19852969146, telegram @resqprofirm
15.06.26 13:12 Cole donald

"I strongly recommend RESQPRO FIRM to anyone trying to recover lost cryptocurrency assets, including Bitcoin, USDC, USDT, Ethereum, and Trump Coin. Like many others, I was shocked to learn that crypto holdings can be stolen even when private keys are carefully protected. After a sophisticated hack wiped out my entire portfolio, I felt completely helpless. Fortunately, I was referred to RESQPRO FIRM. Their team understood the complexity of my situation and successfully recovered my funds. They were responsive, communicated clearly, and followed a careful, step-by-step process—which gave me a lot of reassurance during a stressful time. If you've experienced a similar financial loss, I encourage you to reach out to them. Their professionalism and ethical hacking skills exceeded my expectations." Contact Info: · WhatsApp: +1 (985) 2969146 · Email: [email protected] · Telegram: Resqprofirm
15.06.26 13:16 Meral Yetkiner

I recently lost $38,000 to an online platform. Initially, they requested additional deposits to grant me access to my portfolio. Despite complying, my withdrawal requests were repeatedly denied, and they continued asking for more funds. Suspecting fraudulent activity, I ceased further payments and promptly reported the matter to ResQProfirm, a firm I discovered through Google. They listened to my situation, initiated communication regarding the sequence of events, and requested all relevant evidence to support their investigation. Through their dedicated efforts, they successfully traced and recovered my funds. I extend my thanks to ResQProfirm at [email protected] and via WhatsApp at +19852969146. I urge everyone to exercise caution and thoroughly research any platform before investing.
15.06.26 13:18 Silas Olsen

A fraudulent investment scheme operated by BTCMining.limited functions as a fake return scam. In this setup, scammers lure victims with false promises of high returns. Through manipulative tactics, they gain individuals' trust and convince them to invest, ultimately leading to financial loss. If you have ever faced a cyber threat or fallen victim to an online crypto scam and need to reach the authorities, I recommend contacting [email protected]. They are a legitimate team that helps victims of online crypto scams using advanced tools.
15.06.26 13:59 Ewaguz

If a binary options broker refuses your withdrawal, do not pay any "verification fees" or "tax fees." These are lies designed to extract more money. Stop communicating with their support team – they are trained to stall. Instead, immediately document every transaction, screenshot your account balance, and contact a professional recovery specialist. BinaryBook stole €14,500 from me before I learned this. FundsRetriever traced the deposits and recovered everything within two weeks. Do not wait. Do not pay more fees. Act now. Contact [email protected], WhatsApp +1(603)5121(448) or Telegram FUNDSRETRIEVER.
15.06.26 14:16 Martina k.

Stop putting money into platforms promising guaranteed monthly returns of 10%, 20%, or more. These are Ponzi schemes. Your "profits" are just other victims' deposits. The moment withdrawals slow down, the scam is about to collapse. If you already have money trapped, do not send more to "unlock" your funds. That is a second scam. Instead, gather all transaction hashes and wallet addresses. Bitcoin Evolution Pro took €25,000 from me. FundsRetriever traced the funds through KYC exchanges and recovered my principal. Contact [email protected], WhatsApp +1(603)5121(448) or Telegram FUNDSRETRIEVER.
15.06.26 14:18 Garrison Good

If IQ Option or any similar platform blocks your withdrawal citing "bonus terms" or "abnormal activity," do not argue with their chat support. They are not empowered to help you. Instead, request all trade logs and bonus terms in writing. Then hire a forensic specialist to audit your account. IQ Option held my €9,200 for two months. FundsRetriever reviewed my case, identified regulatory violations, and secured my full payout within 72 hours. Professional pressure works. Do it immediately. Contact [email protected], WhatsApp +1(603)5121(448) or Telegram FUNDSRETRIEVER.
15.06.26 14:22 Sallymarch

Never grant API keys with withdrawal permissions to any third-party software. This is how crypto arbitrage bots steal your funds. If you have already done this, revoke all API keys immediately. Then check your exchange transaction history. CryptoArb AI drained €7,800 from my account within hours. FundsRetriever reverse-engineered the bot's code, traced the scammer's wallet, and recovered everything. Always use "read-only" API permissions only. If you made the mistake, act fast. Contact [email protected], WhatsApp +1(603)5121(448) or Telegram FUNDSRETRIEVER.
15.06.26 14:23 Glennrobble

If a binary options broker closes your account and confiscates your profits, do not accept their explanation. Demand a full audit of your trade history. Most brokers cannot justify their actions when challenged by professionals. ExpertOption stole €6,200 from me claiming "abnormal activity." FundsRetriever audited my trades, proved they were legitimate, and threatened legal action. The broker paid within 10 days. Do not let them intimidate you. Get professional help. Contact [email protected], WhatsApp +1(603)5121(448) or Telegram FUNDSRETRIEVER.
15.06.26 14:25 Evan Garrison

Cloud mining contracts are almost always too good to be true. I learned that the hard way with MineMax. First two months, small daily payouts. Then "maintenance fees" ate everything. Then my account was frozen. Then the website disappeared. I was heartbroken. FundsRetriever traced my payments through three shell companies to a real bank account. They froze it and got my €11,000 back. Recovery is possible even from complex scams. Contact [email protected], WhatsApp +1(603)5121(448) or Telegram FUNDSRETRIEVER.
15.06.26 14:26 Ewaguz

That 100% deposit bonus looks tempting, doesn't it? I took it. Big mistake. When I tried to withdraw my €4,500, Olymp Trade demanded I trade 50 times the bonus amount. Impossible by design. My money was trapped. FundsRetriever reviewed the terms and found they violated consumer protection laws in my country. They negotiated directly with Olymp Trade's legal team. Within a week, my funds were released. My advice? Never accept bonuses. But if you're already trapped, call [email protected], WhatsApp +1(603)5121(448) or Telegram FUNDSRETRIEVER.
15.06.26 16:34 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
15.06.26 16:34 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
15.06.26 16:41 Louane Mercier

It is crucial to act quickly and consult a reputable, experienced recovery specialist who will support you throughout the entire recovery process. You must provide them with transaction evidence, scammer information, and any other relevant details that could aid the investigation. With this data, the experts can trace and attempt to recover your funds from the scammers' concealed accounts or wallets. R£sQprofirm company offers recovery assistance with no upfront fees. Contact them via Telegram (@ResQprofirm), WhatsApp (+19852969146), or email ([email protected]).
15.06.26 16:45 Andrés Montero

I’m open about my experience with Bitcoin investment and losing money to scammers. That said, it is possible to recover stolen Bitcoin. I used to think recovery was impossible because that’s what I had been told. But last October, I fell for a forex scam promising extremely high returns and ended up losing nearly $87,600. After searching for help for a month, I came across a Reddit article about recovering stolen cryptocurrency. I reached out to the contact provided: [email protected] and WhatsApp +19852969146. I was scared and skeptical, having heard many bad stories, but I decided to give them a try. To my amazement, I got all my stolen Bitcoin back within a very short time. I’m not sure if I’m allowed to post links here, but you can reach out to them if you also need help.
15.06.26 16:48 Olivia Sørensen

Several months ago, investing in Bitcoin proved to be one of my most lucrative endeavors. I achieved considerable profits across multiple platforms and felt a strong sense of accomplishment. Unfortunately, the situation deteriorated when I inadvertently engaged with a fraudulent Bitcoin platform. This entity swindled me out of $92,000 USD, refused to honor my withdrawal requests, and persistently demanded further deposits. Fortunately, I encountered (R£SQPRO FIRM) online. After reporting my case to them, they acted promptly and effectively recovered my lost Bitcoin. I am sincerely grateful for their professionalism and continuous assistance. Contact: ResQprofirm AT aol.com, Telegram @resqprofirm, WhatsApp +1 9 8 5 2 9 6 9 1 4 6.
15.06.26 16:51 Viljar Yohannes

I'm willing to share my experience with Bitcoin investment and losing money to scammers. But yes, recovering stolen Bitcoin is possible. I never believed in Bitcoin recovery myself, because I was told it couldn't be done. Then, last October, I fell for a forex scam that promised unrealistically high returns, and I ended up losing nearly $70,000. I searched for help for about a month until I finally found a Reddit article about recovering stolen cryptocurrency. I reached out to the contact mentioned: [RESQPROFIRM [at] AOL DOT com] and [WhatsApp +19852969146]. I was scared and skeptical because I'd heard horror stories, but I decided to give them a try. To my surprise, I got all my stolen Bitcoin back from the scammers in a very short time. I'm not sure if I'm allowed to post links here, but you can contact them if you need help too.
15.06.26 16:58 Guimar da Rosa

Withdrawal troubles shouldn’t stress you out. I faced a similar problem, and this firm stepped in and recovered my funds. Their support truly mattered. Contact them: [ResQProFirm @aol.com] telegram @resqprofirm, WhatsApp: <+198> <5296> <9146>.
15.06.26 17:03 Andrea Escalante

If withdrawals keep getting denied, stay calm. I went through the same, and this firm helped me recover everything. Their assistance was outstanding. Contact: [[email protected]], Telegram: ResQprofirm, WhatsApp: <+198> <5296> <9146>. Withdrawal troubles shouldn’t
16.06.26 11:40 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
16.06.26 11:43 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
16.06.26 13:37 Felix Steve

MY CRYPTO WAS STOLEN – HERE'S HOW I GOT IT BACK I'm Felix Steve from Canada, and I lost $115,000 USDC to a fraudulent broker who locked me out of my wallet. After sleepless nights, a friend told me about RESQPROFIRM Recovery Service. I sent them my wallet addresses, transaction history, and chat logs. Their team used blockchain tracking to trace the stolen funds, identified the scammer's wallet, and froze the assets before they could be moved. Within 24 hours, most of my crypto was recovered. I can't thank them enough. If you need help, reach out via WhatsApp: +19852969146, email: [email protected], or TG: @resqprofirm.
16.06.26 13:45 Wills ben

SUCCESSFUL CRYPTO SCAM RECOVERY – HOW I REGAINED ACCESS TO MY LOST WALLET My name is Felix Steve, and I'm from Canada. I'm sharing my story to help others who have fallen victim to crypto fraud. A few months ago, I was lured into a fake investment scheme promoted by a broker company. With Bitcoin prices climbing, I invested heavily—only to lose $115,000 USDC when the broker locked me out of my wallet and assets. It was a harrowing experience that left me sleepless and desperate. Crypto scams are on the rise, often involving bogus trading platforms, phishing, and misleading promises. In my search for help, a fellow crypto enthusiast recommended RESQPROFIRM Recovery Service, which specializes in recovering lost or stolen funds. After checking their reviews, I reached out and supplied all the evidence—wallet addresses, transaction records, and communication logs. Their team responded immediately and launched an investigation. Using advanced blockchain tracking, they traced the stolen funds, pinpointed the scammer's wallet, and worked with authorities to freeze the assets in time. Remarkably, within just 24 hours, RESQPROFIRM recovered the bulk of my stolen crypto. I was overwhelmed with relief and gratitude. Their professionalism, transparency, and steady communication made all the difference during a very dark period. If you've been scammed, I wholeheartedly recommend contacting them via WhatsApp: +19852969146, email: [email protected], or Telegram: @resqprofirm.
18.06.26 13:31 Noemi Bernard

I never expected such outstanding results. The outcome far exceeded my expectations, and I am extremely satisfied with the successful recovery of my stolen funds totaling $49,360 from my blockchain wallet. I hold this team in the highest regard. Without a doubt, they are among the most dedicated professionals in the field of fund recovery. Keep up the exceptional work! Email: [email protected] WhatsApp: +1 985 296 9146
18.06.26 13:35 Carter Morris

My experience improved significantly thanks to ResQprofirm's expert assistance and attentive customer care. Their professionalism was evident every step of the way they were able to track and recover my stolen crypto $88,360, email: [email protected], WhatsApp +19852969146.
18.06.26 13:40 Kuybida Andriyiv

I recovered my $232,000 refund through the assistance of [email protected] and WhatsApp +19852969146. Their guidance was very helpful.
20.06.26 14:57 michaeldavenport218

I was recently scammed out of $53,000 by a fraudulent Bitcoin investment scheme, which added significant stress to my already difficult health issues, as I was also facing cancer surgery expenses. Desperate to recover my funds, I spent hours researching and consulting other victims, which led me to discover the excellent reputation of Capital Crypto Recover, I came across a Google post It was only after spending many hours researching and asking other victims for advice that I discovered Capital Crypto Recovery’s stellar reputation. I decided to contact them because of their successful recovery record and encouraging client testimonials. I had no idea that this would be the pivotal moment in my fight against cryptocurrency theft. Thanks to their expert team, I was able to recover my lost cryptocurrency back. The process was intricate, but Capital Crypto Recovery's commitment to utilizing the latest technology ensured a successful outcome. I highly recommend their services to anyone who has fallen victim to cryptocurrency fraud. For assistance contact [email protected] and on Telegram OR Call Number +1 (336)390-6684 via email: [email protected] you can visit his website: https://recovercapital.wixsite.com/capital-crypto-rec-1
20.06.26 14:57 michaeldavenport218

I was recently scammed out of $53,000 by a fraudulent Bitcoin investment scheme, which added significant stress to my already difficult health issues, as I was also facing cancer surgery expenses. Desperate to recover my funds, I spent hours researching and consulting other victims, which led me to discover the excellent reputation of Capital Crypto Recover, I came across a Google post It was only after spending many hours researching and asking other victims for advice that I discovered Capital Crypto Recovery’s stellar reputation. I decided to contact them because of their successful recovery record and encouraging client testimonials. I had no idea that this would be the pivotal moment in my fight against cryptocurrency theft. Thanks to their expert team, I was able to recover my lost cryptocurrency back. The process was intricate, but Capital Crypto Recovery's commitment to utilizing the latest technology ensured a successful outcome. I highly recommend their services to anyone who has fallen victim to cryptocurrency fraud. For assistance contact [email protected] and on Telegram OR Call Number +1 (336)390-6684 via email: [email protected] you can visit his website: https://recovercapital.wixsite.com/capital-crypto-rec-1
21.06.26 11:09 Maurizio Rolland

I would like to express my sincere appreciation to RESQPRO FIRM for their outstanding assistance in helping victims of online fraud. Many scammers deceive investors by blocking withdrawals and continuously demanding additional deposits, making the loss of hard-earned funds a painful experience. Fortunately, RESQPRO FIRM provides support to individuals seeking to recover funds lost to fraudulent online schemes. Contact: Email: RESQPRO FIRM at Gmail Telegram: RESQPROFIRM, [email protected], WhatsApp: +1 985 296 9146
21.06.26 11:13 Buse Fahri

It is important for more people to stand together in the fight against online fraud. Those who target innocent individuals especially vulnerable people such as seniors should be held fully accountable for their actions. Every effort to raise awareness and support victims makes a meaningful difference. The team at RESQPRO FIRM is committed to helping expose fraudulent schemes and assisting those affected by online scams. Their dedication, persistence, and passion for protecting victims are truly commendable. I sincerely appreciate the hard work and commitment shown toward this mission. Together, we can continue to educate others, support victims, and work toward a safer online environment for everyone. Contact Information: Telegram: RESQPROFIRM WhatsApp: +1 985 296 9146 Email: [email protected], [email protected]
21.06.26 11:16 علیرضا گلشن

The successful recovery of my stolen funds, totaling $1,310,000, would not have been possible without your unwavering support, dedication, and tireless efforts. I am truly grateful for the opportunity to work with such a skilled and professional team. From the very beginning, I had confidence in your ability to handle this challenging situation, and you exceeded my expectations by delivering remarkable results. Your expertise, persistence, and commitment throughout the process were exceptional. I encourage you to continue maintaining the high standards of professionalism and excellence that distinguish your work. You exemplify the qualities of a trustworthy, dedicated, and hardworking professional, and your efforts deserve sincere recognition and appreciation. Contact: Email: [email protected], [email protected], Telegram: Resqprofirm WhatsApp: +1 985 296 9146
22.06.26 21:51 kimberlyhebert786

I invested in bitcoin trading After losing $78.4 USDT) linked to a romance fraud scam worth of cryptocurrency through an online investment platform and later discovered it was a scam. After extensive research for recovery options, I contacted CAPITAL CRYPTO RECOVER based on positive client reviews and recommendations. Their professional security team guided me through the recovery process using advanced technology, and I was able to recover my lost cryptocurrency successfully. I am truly grateful for their support and assistance during such a difficult experience. I will advise you to contact CAPITAL CRYPTO RECOVER helped me recover my funds. For anyone facing similar issues, Website: https://recovercapital.wixsite.com/capital-crypto-rec-1 Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text Number: +1 (336) 390-6684
22.06.26 21:51 kimberlyhebert786

I invested in bitcoin trading After losing $78.4 USDT) linked to a romance fraud scam worth of cryptocurrency through an online investment platform and later discovered it was a scam. After extensive research for recovery options, I contacted CAPITAL CRYPTO RECOVER based on positive client reviews and recommendations. Their professional security team guided me through the recovery process using advanced technology, and I was able to recover my lost cryptocurrency successfully. I am truly grateful for their support and assistance during such a difficult experience. I will advise you to contact CAPITAL CRYPTO RECOVER helped me recover my funds. For anyone facing similar issues, Website: https://recovercapital.wixsite.com/capital-crypto-rec-1 Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text Number: +1 (336) 390-6684
24.06.26 01:25 Fraddy Pual

I never thought it would happen to me—but I lost $256,100 in Bitcoin through a shady investment deal. I was shattered, panicked, and convinced my savings were gone forever. Just when I was about to give up, I stumbled upon reviews for FUNDSRETRIEVER, a cyber recovery team with a solid reputation. I decided to give it a shot, and to my absolute shock, they recovered every single cent in record time. Working with them was a lifesaver. If you've been tricked by fake investment platforms, don't lose hope—FUNDSRETRIEVER can help. Contact them here: Email: [email protected] | WhatsApp: +1603512144 8| Telegram: @Fundsretriever
24.06.26 01:27 Fraddy Pual

I never thought it would happen to me—but I lost $256,100 in Bitcoin through a shady investment deal. I was shattered, panicked, and convinced my savings were gone forever. Just when I was about to give up, I stumbled upon reviews for FUNDSRETRIEVER, a cyber recovery team with a solid reputation. I decided to give it a shot, and to my absolute shock, they recovered every single cent in record time. Working with them was a lifesaver. If you've been tricked by fake investment platforms, don't lose hope—FUNDSRETRIEVER can help. Contact them here: Email: [email protected] | WhatsApp: +16035121448 | Telegram: @Fundsretriever
24.06.26 01:28 Fraddy Pual

I never thought it would happen to me—but I lost $256,100 in Bitcoin through a shady investment deal. I was shattered, panicked, and convinced my savings were gone forever. Just when I was about to give up, I stumbled upon reviews for FUNDSRETRIEVER, a cyber recovery team with a solid reputation. I decided to give it a shot, and to my absolute shock, they recovered every single cent in record time. Working with them was a lifesaver. If you've been tricked by fake investment platforms, don't lose hope—FUNDSRETRIEVER can help. Contact them here: Email: [email protected] | WhatsApp: +16035121448 | Telegram: @Fundsretriever.
24.06.26 01:58 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
24.06.26 01:58 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
24.06.26 14:16 Universina da Mota

Becoming a victim of an investment scam is never anyone's intention it often happens because fraudsters exploit trust and a lack of awareness. I would like to express my sincere gratitude to the dedicated team at ResQpro for their professionalism and commitment to helping victims of online investment fraud. Their efforts in assisting individuals with the recovery of stolen assets and holding scammers accountable are truly commendable. If you need assistance or would like to learn more, you can contact them through: Email: [email protected] Alternative Email: [email protected] Telegram: @ResQprofirm WhatsApp: +1 (985) 296-9146
24.06.26 14:21 Elizabeth Thompson

If you believe you have been the victim of an investment scam, it is important to act promptly and gather all relevant information. Keep records of transaction receipts, wallet addresses, communication logs, account details, and any other evidence related to the incident. Providing accurate documentation can help investigators, financial institutions, legal professionals, or recovery specialists review your case and determine what options may be available. Be cautious of anyone who guarantees the recovery of lost funds or requests large upfront payments. For additional information, you may contact: Email: [email protected] Telegram: @ResQprofirm WhatsApp: +1 (985) 296-9146
24.06.26 15:33 Júlia Castro

If you have fallen victim to an investment scam, it is important to act quickly and gather all available evidence related to the incident. This may include transaction records, wallet addresses, screenshots of conversations, emails, account details, and any information connected to the individuals or entities involved. Having complete documentation can help professionals assess your situation and explore possible recovery options. Always exercise caution when seeking assistance and carefully verify the credentials of any service provider before proceeding. For further information, you may contact: Email: [email protected] Telegram: @ResQprofirm WhatsApp: +1 (985) 296-9146
24.06.26 22:01 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
24.06.26 22:01 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
25.06.26 21:13 Emilie Safi

A fraudulent investment scheme operated by BTCMining.limited functions as a fake return scam. In this setup, scammers lure victims with false promises of high returns. Through manipulative tactics, they gain individuals' trust and convince them to invest, ultimately leading to financial loss. If you have ever faced a cyber threat or fallen victim to an online crypto scam and need to reach the authorities, I recommend contacting [email protected], [email protected], WhatsApp +19852969146, telegram @resqprofirm. They are a legitimate team that helps victims of online crypto scams using advanced tools.
25.06.26 21:25 Emilie Safi

So I ended up losing $38,000 to this platform. At first, they kept asking me to put in more money so I could get into my portfolio. I did that, but then they wouldn’t let me withdraw anything—just kept asking for more deposits. It got way too suspicious, so I stopped. I found this company called ResQProfirm on Google and told them what happened. They got in touch, asked me to walk them through everything, and I gave them all the proof I had. They did an amazing job tracking down my money and getting it back. Big thanks to them at [email protected] and on WhatsApp at +19852969146. Please be careful out there and always research before investing.
01:04 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
01:04 robertalfred175

CRYPTO SCAM RECOVERY SUCCESSFUL – A TESTIMONIAL OF LOST PASSWORD TO YOUR DIGITAL WALLET BACK. My name is Robert Alfred, Am from Australia. I’m sharing my experience in the hope that it helps others who have been victims of crypto scams. A few months ago, I fell victim to a fraudulent crypto investment scheme linked to a broker company. I had invested heavily during a time when Bitcoin prices were rising, thinking it was a good opportunity. Unfortunately, I was scammed out of $120,000 AUD and the broker denied me access to my digital wallet and assets. It was a devastating experience that caused many sleepless nights. Crypto scams are increasingly common and often involve fake trading platforms, phishing attacks, and misleading investment opportunities. In my desperation, a friend from the crypto community recommended Capital Crypto Recovery Service, known for helping victims recover lost or stolen funds. After doing some research and reading multiple positive reviews, I reached out to Capital Crypto Recovery. I provided all the necessary information—wallet addresses, transaction history, and communication logs. Their expert team responded immediately and began investigating. Using advanced blockchain tracking techniques, they were able to trace the stolen Dogecoin, identify the scammer’s wallet, and coordinate with relevant authorities to freeze the funds before they could be moved. Incredibly, within 24 hours, Capital Crypto Recovery successfully recovered the majority of my stolen crypto assets. I was beyond relieved and truly grateful. Their professionalism, transparency, and constant communication throughout the process gave me hope during a very difficult time. If you’ve been a victim of a crypto scam, I highly recommend them with full confidence contacting: Email: [email protected] Telegram: @Capitalcryptorecover Contact: [email protected] Call/Text: +1 (336) 390-6684 Website: https://recovercapital.wixsite.com/capital-crypto-rec-1
02:48 Miriam Rocha

I trusted this platform with $120,000 of my hard-earned money. Then they started asking for more deposits just so I could access my own portfolio. I paid, but every withdrawal request was denied. They kept pushing for more money. I finally stopped it just felt wrong. Desperate, I found ResQProfirm on Google. They didn't just hear me out; they truly listened. I shared all my proof, and they launched an investigation. Thanks to their hard work, they tracked and returned my funds. From the bottom of my heart, thank you to [email protected] and their WhatsApp +19852969146. Please stay safe and always verify a platform before investing
02:52 Miško Bakić

I got my $232,000 refund thanks to [email protected] and WhatsApp +19852969146. Highly recommended for anyone in a similar situation.
02:56 Asunción Herrera

A recovery of $48,330 was facilitated by [email protected]. Individuals who have experienced financial fraud may consider contacting this service.

Для участия в Чате вам необходим бесплатный аккаунт pro-blockchain.com Войти Регистрация

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|5	1954\|10	0\|0	0\|0	3036\|11
2	2060504	ET INFO Observed Discord Service Domain (gateway .discord .gg) in TLS SNI	135\|0	534\|10	853\|7	0\|0	0\|0	3253\|669
3	2050884	ET INFO Observed vk .com API Domain (api .vk .com in TLS SNI)	231\|3	303\|261	331\|278	0\|0	0\|0	508\|361
4	2053282	ET TA_ABUSED_SERVICES Commonly Actor Abused Online Service Domain (syncthing .net)	197\|0	222\|14	459\|36	0\|0	0\|0	418\|29
5	2014819	ET INFO Packed Executable Download	145\|1	224\|44	261\|60	31\|2	47\|3	278\|59
6	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	92\|0	172\|26	220\|39	24\|8	12\|2	208\|37
7	2041933	ET INFO Observed Telegram Domain (t .me in TLS SNI)	25\|2	55\|46	53\|48	0\|0	0\|0	54\|40
8	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|46	66\|66	0\|0	0\|0	73\|73
9	28000001	(o)DoH Query for dns.google	0\|0	2\|2	82\|82	0\|0	0\|0	1\|1
10	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|1	0\|0	0\|0	5\|0
11	2052581	ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)	0\|0	3\|3	0\|0	0\|0	0\|0	59\|59
12	28000974	(o)DoH Query for httpdns-push.heytapmobile.com	0\|0	0\|0	0\|0	0\|0	0\|0	61\|61
13	2060505	ET INFO Observed Discord Service Domain (discord .com) in TLS SNI	0\|0	13\|13	21\|21	0\|0	0\|0	24\|24
14	2029634	ET HUNTING Suspected Malicious Telegram Communication (POST)	5\|0	13\|13	6\|6	0\|0	0\|0	15\|13
15	1006213	MultiProxy Firefox Add-ons	33\|0	3\|2	0\|0	0\|0	0\|0	0\|0
16	2062715	ET INFO Observed UA-CPU Header	2\|1	7\|7	12\|12	0\|0	7\|7	8\|8
17	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
18	1006319	PORT SCAN (NMAP -sA)	0\|0	8\|8	4\|4	0\|0	0\|0	16\|16
19	1006585	Outbound connection to a possible C&C server	0\|0	4\|4	1\|1	0\|0	0\|0	22\|22
20	2057746	ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)	3\|3	3\|3	7\|7	0\|0	0\|0	9\|9
21	1006557	IP blocklist	2\|2	4\|4	5\|5	1\|1	2\|2	7\|7
22	2029322	ET HUNTING Telegram API Certificate Observed	3\|0	3\|1	2\|1	1\|1	2\|1	3\|1
23	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|8	5\|5	0\|0	0\|0	1\|1
24	2063118	ET INFO Abused Hosting Domain (azurewebsites .net) in TLS SNI	1\|0	1\|1	2\|2	0\|0	0\|0	6\|6
25	2027695	ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)	0\|0	1\|0	4\|0	0\|0	0\|0	4\|0
26	1800920	IP blocklist	0\|0	0\|0	9\|9	0\|0	0\|0	0\|0
27	2050633	ET INFO Observed File Hosting Service Domain (zohopublic .eu) in TLS SNI	8\|0	0\|0	0\|0	0\|0	0\|0	0\|0
28	28000196	(o)DoH Query for dns.google.com	1\|1	3\|3	4\|4	0\|0	0\|0	0\|0
29	28000040	(o)DoH Query for mozilla.cloudflare-dns.com	1\|0	4\|0	1\|0	0\|0	1\|0	1\|0
30	1006258	PlanetVPN	0\|0	3\|1	1\|1	0\|0	0\|0	3\|1
31	1801497	IP blocklist	0\|0	3\|3	2\|2	0\|0	1\|1	0\|0
32	2058779	ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed .binance .org)	0\|0	2\|2	4\|4	0\|0	0\|0	0\|0
33	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|2	0\|0	0\|0	4\|4
34	2013927	ET INFO HTTP traffic on port 443 (HEAD)	0\|0	2\|2	2\|2	0\|0	0\|0	1\|1
35	2046071	ET INFO Observed Google DNS over HTTPS Domain (dns .google .com in TLS SNI)	0\|0	2\|2	1\|1	0\|0	0\|0	2\|2
36	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
37	2049202	ET INFO Observed File Hosting Service Domain (files .pythonhosted .org in TLS SNI)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
38	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|4	0\|0	0\|0	1\|1
39	28000002	(o)DoH Query for cloudflare-dns.com	0\|0	2\|0	1\|0	0\|0	0\|0	1\|0
40	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|2	2\|2	0\|0	0\|0	0\|0
41	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
42	1801678	IP blocklist	1\|1	1\|1	0\|0	0\|0	0\|0	1\|1
43	1802605	IP blocklist	1\|1	0\|0	1\|1	1\|1	0\|0	0\|0
44	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|3	0\|0	0\|0	0\|0	0\|0
45	1006260	VeePN	0\|0	3\|3	0\|0	0\|0	0\|0	0\|0
46	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|2	1\|1	0\|0	0\|0	0\|0
47	2063071	ET INFO Observed External IP Lookup Domain (l2 .io) in TLS SNI	0\|0	0\|0	1\|1	0\|0	0\|0	2\|2
48	1803186	IP blocklist	0\|0	0\|0	1\|1	0\|0	0\|0	2\|2
49	2047866	ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)	0\|0	0\|0	3\|3	0\|0	0\|0	0\|0
50	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
51	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
52	28000957	(o)DoH Query for httpdns-push.heytapmobile.com	2\|2	0\|0	0\|0	0\|0	0\|0	0\|0
53	1800572	IP blocklist	1\|1	0\|0	0\|0	0\|0	1\|1	0\|0
54	2039595	ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI	0\|0	2\|2	0\|0	0\|0	0\|0	0\|0
55	1800324	IP blocklist	0\|0	1\|1	0\|0	0\|0	0\|0	1\|1
56	1801470	IP blocklist	0\|0	1\|1	0\|0	0\|0	0\|0	1\|1
57	1802765	IP blocklist	0\|0	1\|1	0\|0	0\|0	0\|0	1\|1
58	2054227	ET TA_ABUSED_SERVICES Fingerprinting Service in TLS SNI (customfingerprints .bablosoft .com)	0\|0	0\|0	2\|2	0\|0	0\|0	0\|0
59	1802434	IP blocklist	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
60	2050282	ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
61	2400004	ET DROP Spamhaus DROP Listed Traffic Inbound group 5	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|0	1954\|9	0\|0	0\|0	3036\|6
2	2014819	ET INFO Packed Executable Download	145\|0	224\|0	261\|42	31\|0	47\|1	278\|37
3	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|0	66\|5	0\|0	0\|0	73\|0
4	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|2	0\|0	0\|0	5\|0
5	1006213	MultiProxy Firefox Add-ons	33\|4	3\|0	0\|0	0\|0	0\|0	0\|0
6	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
7	1006319	PORT SCAN (NMAP -sA)	0\|0	8\|0	4\|3	0\|0	0\|0	16\|16
8	2029322	ET HUNTING Telegram API Certificate Observed	3\|0	3\|1	2\|1	1\|1	2\|2	3\|3
9	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|0	5\|0	0\|0	0\|0	1\|0
10	2027695	ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)	0\|0	1\|1	4\|4	0\|0	0\|0	4\|4
11	2050633	ET INFO Observed File Hosting Service Domain (zohopublic .eu) in TLS SNI	8\|5	0\|0	0\|0	0\|0	0\|0	0\|0
12	28000196	(o)DoH Query for dns.google.com	1\|1	3\|3	4\|4	0\|0	0\|0	0\|0
13	28000040	(o)DoH Query for mozilla.cloudflare-dns.com	1\|1	4\|4	1\|1	0\|0	1\|1	1\|1
14	2058779	ET INFO Observed Smart Chain Domain in TLS SNI (bsc-dataseed .binance .org)	0\|0	2\|1	4\|4	0\|0	0\|0	0\|0
15	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|2	0\|0	0\|0	4\|4
16	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
17	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|4	0\|0	0\|0	1\|1
18	28000002	(o)DoH Query for cloudflare-dns.com	0\|0	2\|2	1\|1	0\|0	0\|0	1\|1
19	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|2	2\|2	0\|0	0\|0	0\|0
20	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
21	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|0	0\|0	0\|0	0\|0	0\|0
22	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|1	1\|1	0\|0	0\|0	0\|0
23	2063071	ET INFO Observed External IP Lookup Domain (l2 .io) in TLS SNI	0\|0	0\|0	1\|1	0\|0	0\|0	2\|2
24	2047866	ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI)	0\|0	0\|0	3\|3	0\|0	0\|0	0\|0
25	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
26	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
27	28000957	(o)DoH Query for httpdns-push.heytapmobile.com	2\|2	0\|0	0\|0	0\|0	0\|0	0\|0
28	2039595	ET INFO External IP Address Lookup Domain (get .geojs .io) in TLS SNI	0\|0	2\|2	0\|0	0\|0	0\|0	0\|0
29	2054227	ET TA_ABUSED_SERVICES Fingerprinting Service in TLS SNI (customfingerprints .bablosoft .com)	0\|0	0\|0	2\|2	0\|0	0\|0	0\|0
30	2047894	ET INFO Observed Online Collab Tool Domain (figma .com in TLS SNI)	0\|0	0\|0	1\|1	0\|0	0\|0	1\|1
31	2050282	ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
32	2400004	ET DROP Spamhaus DROP Listed Traffic Inbound group 5	0\|0	0\|0	0\|0	0\|0	0\|0	2\|2
33	2054246	ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
34	2038967	ET INFO SSH-2.0-Go version string Observed in Network Traffic	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
35	1006206	Browsec-VPN	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
36	2060251	ET INFO Go-http-client User-Agent Observed Outbound	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
37	2014788	ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
38	2017499	ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
39	1006914	Possible trojan activity, base64-encoded content	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
40	1003302	Anonymizer detected	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
41	2018383	ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
42	2012252	ET SHELLCODE Common 0a0a0a0a Heap Spray String	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
43	2048493	ET INFO ISO File Downloaded	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
44	2024833	ET INFO Observed IP Lookup Domain (l2 .io in TLS SNI)	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|0	1954\|11	0\|0	0\|0	3036\|8
2	2014819	ET INFO Packed Executable Download	145\|0	224\|0	261\|37	31\|0	47\|1	278\|30
3	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|0	66\|6	0\|0	0\|0	73\|2
4	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|2	0\|0	0\|0	5\|0
5	1006213	MultiProxy Firefox Add-ons	33\|5	3\|1	0\|0	0\|0	0\|0	0\|0
6	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
7	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|0	5\|0	0\|0	0\|0	1\|0
8	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|2	0\|0	0\|0	4\|4
9	2013927	ET INFO HTTP traffic on port 443 (HEAD)	0\|0	2\|0	2\|2	0\|0	0\|0	1\|1
10	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|3	0\|0	0\|0	2\|2
11	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|4	0\|0	0\|0	1\|1
12	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|2	2\|2	0\|0	0\|0	0\|0
13	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
14	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|0	0\|0	0\|0	0\|0	0\|0
15	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|0	1\|1	0\|0	0\|0	0\|0
16	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
17	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
18	2054246	ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
19	2038967	ET INFO SSH-2.0-Go version string Observed in Network Traffic	0\|0	1\|1	0\|0	0\|0	0\|0	0\|0
20	1006206	Browsec-VPN	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
21	2060251	ET INFO Go-http-client User-Agent Observed Outbound	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
22	2014788	ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
23	2017499	ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
24	1006914	Possible trojan activity (base64-encoded content)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
25	1003302	Anonymizer detected	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
26	2018383	ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
27	2012252	ET SHELLCODE Common 0a0a0a0a Heap Spray String	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
28	2048493	ET INFO ISO File Downloaded	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1

№ п/п	sid	Описание	dataset_1	dataset_2	dataset_3	dataset_4	dataset_5	dataset_6
1	2028762	ET JA3 Hash - [Abuse.ch] Possible Trickbot	688\|0	1424\|0	1954\|0	0\|0	0\|0	3036\|2
2	2014819	ET INFO Packed Executable Download	145\|0	224\|1	261\|5	31\|0	47\|0	278\|29
3	2022082	ET INFO External IP Lookup ip-api.com	0\|0	46\|0	66\|6	0\|0	0\|0	73\|2
4	2035303	ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)	19\|0	18\|0	27\|1	0\|0	0\|0	5\|0
5	1006213	MultiProxy Firefox Add-ons	33\|3	3\|0	0\|0	0\|0	0\|0	0\|0
6	2026521	ET USER_AGENTS Suspicious User-Agent (Windows 10)	0\|0	26\|26	6\|6	0\|0	0\|0	0\|0
7	58565362	Trojan-PSW.Agent.HTTP.C&C	0\|0	8\|0	5\|0	0\|0	0\|0	1\|0
8	2027762	ET REMOTE_ACCESS AnyDesk Remote Desktop Software User-Agent	0\|0	0\|0	2\|1	0\|0	0\|0	4\|2
9	2013927	ET INFO HTTP traffic on port 443 (HEAD)	0\|0	2\|0	2\|0	0\|0	0\|0	1\|0
10	2017398	ET INFO IP Check Domain (icanhazip. com in HTTP Host)	0\|0	0\|0	3\|1	0\|0	0\|0	2\|1
11	2043310	ET HUNTING DDoS-Guard Hosted Content	0\|0	0\|0	4\|0	0\|0	0\|0	1\|1
12	2050130	ET INFO Observed Online Application Hosting Domain (supabase .co in TLS SNI)	0\|0	2\|0	2\|0	0\|0	0\|0	0\|0
13	2057036	ET EXPLOIT_KIT Balada Domain in TLS SNI (broworker10s .com)	0\|0	4\|4	0\|0	0\|0	0\|0	0\|0
14	2021701	ET GAMES MINECRAFT Server response inbound	0\|0	3\|0	0\|0	0\|0	0\|0	0\|0
15	2049251	ET INFO Observed FingerprintJS Domain (openfpcdn .io in TLS SNI)	0\|0	2\|0	1\|1	0\|0	0\|0	0\|0
16	36674245	HackTool.Nmap.TLS.C&C	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
17	2023753	ET SCAN MS Terminal Server Traffic on Non-standard Port	0\|0	0\|0	0\|0	0\|0	0\|0	3\|3
18	2054246	ET ATTACK_RESPONSE Eval Hex Obfuscated JS Inbound	0\|0	1\|0	0\|0	0\|0	0\|0	0\|0
19	2038967	ET INFO SSH-2.0-Go version string Observed in Network Traffic	0\|0	1\|1	0\|0	0\|0	0\|0	0\|0
20	1006206	Browsec-VPN	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
21	2060251	ET INFO Go-http-client User-Agent Observed Outbound	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
22	2014788	ET DYN_DNS DYNAMIC_DNS HTTP Request to a 3322.net Domain *.3322.net	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
23	2017499	ET ATTACK_RESPONSE Probably Evil Long Unicode string only string and unescape 1	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
24	1006914	Possible trojan activity (base64-encoded content)	0\|0	0\|0	1\|0	0\|0	0\|0	0\|0
25	1003302	Anonymizer detected	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
26	2018383	ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)	0\|0	0\|0	1\|1	0\|0	0\|0	0\|0
27	2012252	ET SHELLCODE Common 0a0a0a0a Heap Spray String	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1
28	2048493	ET INFO ISO File Downloaded	0\|0	0\|0	0\|0	0\|0	0\|0	1\|1

Н Новости