[
  {
    "name": "window_event_count",
    "index": 0,
    "type": "float",
    "description": "Total number of security events observed for the source IP within the 5-minute sliding window."
  },
  {
    "name": "failure_ratio",
    "index": 1,
    "type": "float",
    "description": "Ratio of failed events (failed passwords, invalid users, 401/403/404 HTTP errors) to total events in the window (range: 0.0 to 1.0)."
  },
  {
    "name": "distinct_paths",
    "index": 2,
    "type": "float",
    "description": "Number of unique URL paths or target resources probed by the source IP in the window."
  },
  {
    "name": "distinct_users",
    "index": 3,
    "type": "float",
    "description": "Number of distinct usernames targeted during SSH authentication attempts within the window."
  },
  {
    "name": "path_entropy",
    "index": 4,
    "type": "float",
    "description": "Shannon character entropy of all concatenated request paths, capturing random probing, fuzzer output, and automated scanner payloads."
  },
  {
    "name": "inter_event_time_mean_ms",
    "index": 5,
    "type": "float",
    "description": "Mean time delta between consecutive events in milliseconds. Low values indicate automated scanning, rapid brute-forcing, or scripted bursts."
  },
  {
    "name": "hour_of_day_norm",
    "index": 6,
    "type": "float",
    "description": "Normalized timestamp hour (hour / 24.0, range: 0.0 to 1.0), capturing temporal deviations from host baseline hours."
  },
  {
    "name": "sensitive_path_ratio",
    "index": 7,
    "type": "float",
    "description": "Proportion of requests targeting high-risk security files or administrative endpoints (.env, wp-config, phpmyadmin, .git, actuator, webshells)."
  }
]