SSH Attacks Research Articles

SSHAA: A Python Package Index for visualizing features of SSH attacks with text mining in classification

ABSTRACT With the proliferation of the Internet, the number of cyber-attacks has increased worldwide. To prevent cyber-attacks, network administrators need to use analytical tools to disclose six new critical statistics such as Internet Protocol (IP) authenticity and classification, IP ownership, frequency of attacks, time of day, day of the week, and country of attack. There are four SSH attack analysis tools available, but existing tools lack visualization and cannot provide the necessary attack statistics. This paper proposes SSHAA, the first open source PyPI analysis tool that meets the requirement. Text mining technology is used for extracting data from SSH log files, classifying IPs with identified country names and calculating a variety of statistics. PyPI allows SSHAA to run on Windows, MacOS, and Linux operating systems. This paper highlights how to debut a PyPI application using SSHAA which will be the world’s first tutorial in the security journals for maximum software dissemination. According to PePy, SSHAA has been downloaded 7668 times worldwide. The substantial number of downloads signifies the efficacy of the proposed tool. The proposed system offers ten functional statistics for SSH attack analysis. The six new functional statistics to information security are significant.

Detection of SSH Password Guessing Attacks using Classification Algorithms

The usage of SSH protocol has gained popularity among users due to its secure nature in recent times. Nevertheless, the SSH protocol can be susceptible to exploitation by hackers, who can access SSH servers without permission by exploiting vulnerabilities. SSH attacks cannot be completely detected using state-of-the-art security solutions like Firewall, Intrusion Detec- tion Systems, and so on. Malicious SSH traffic is created by malware and contains password guessing attacks. These attacks can result in compromising the security of servers and lead to the theft of private data. We aim to develop a robust and accurate SSH attack detection system that uses classification algorithms that can effectively differentiate between malicious SSH traffic and legitimate SSH traffic. In this paper, we have selected 14 classification algorithms like CNN, LSTM, Logistic regression, Deep Belief Networks, Auto Encoders, and so on. The process involves organising and preparing the data, extracting relevant features, and application of an ensemble learning approach with the selected classification algorithms. XGBoost is employed for model integration. The ensemble model achieves improved accuracy, successfully classifying between legitimate SSH traffic and SSH password guessing attacks.

Comparing FTP and SSH Password Brute Force Attack Detection using k-Nearest Neighbour (k-NN) and Decision Tree in Cloud Computing

Cloud computing represents a new epoch in computing. From huge enterprises to individual use, cloud computing always provides an answer. Therefore, cloud computing must be readily accessible and scalable, and customers must pay only for the resources they consume rather than for the entire infrastructure. With such conveniences, come with their own threat especially brute force attacks since the resources are available publicly online for the whole world to see. In a brute force attack, the attacker attempts every possible combination of username and password to obtain access to the system. This study aims to examine the performance of the k-Nearest Neighbours (k-NN) and Decision Tree algorithms by contrasting their precision, recall, and F1 score. This research makes use of the CICIDS2017 dataset, which is a labelled dataset produced by the Canada Institute for Cybersecurity. A signature for the brute force attack is utilised with an Intrusion Detection System (IDS) to detect the attack. This strategy, however, is ineffective when a network is being attacked by a novel or unknown attack or signature. At the conclusion of the study, the performance of both algorithms is evaluated by comparing their precision, recall, and f1 score. The results show that Decision Tree performs slightly better than k-NN at classifying FTP and SSH attacks.

Zero-Day Attack Detection using Ensemble Technique

The zero-day attacks exploit the new vulnerabilities in the system or old vulnerabilities in a new way. Zero-dayattacks are sustainable in the system exploiting the system until detected or until the patch is released, thiscreates a dire need to detect zero-day attacks in the system. The model in this proposed paper is an outlier-basedmodel trained using benign and known attack traffic to detect traffic of unknown attacks. The proposed systemsuccessfully detected most of the unknown attack traffic, achieving higher results in Web, Infiltration, SSH, FTP,and Botnet attacks.

An experimental study on cloud honeypot and data visualization using ELK stack

Nowadays, companies have been moving their IT infrastructure from own data centers to specialized public cloud providers. While there are cost benefits, the security issue is one of the major concerns in cloud computing due to the number of companies that use cloud storage to save their personal data keep increasing. Many honeypots have been used in the past, but they were difficult to use due to a lack of data visualization and attack analysis. To learn more about attackers, their motivations and techniques, honeypots are used to investigate how attackers attempt to hack an information system and provide useful insight into potential security flaws. This honeypot allows to monitor attacks by pretending to be actual machines with valuable and sensitive data, such that attackers interact with them. For this research, honeypot was set up on DigitalOcean cloud and the experimental method performs and result of the implementation in this research use real attack since the honeypot deployed on the cloud and exposed to the Internet. The results show that Cowrie honeypot able to collect data that is valuable to security researcher or network administrator for future research to make analysis. It is believed by implementing Cowrie honeypot using ELK stack on cloud platform will assist on detection and prevention for SSH attacks.

Detection of Severe SSH Attacks Using Honeypot Servers and Machine Learning Techniques

Detection of Severe SSH Attacks Using Honeypot Servers and Machine Learning Techniques

Detection of Severe SSH Attacks Using Honeypot Servers and Machine Learning Techniques

Detection of Severe SSH Attacks Using Honeypot Servers and Machine Learning Techniques

SSH Compromise Detection using NetFlow/IPFIX

Flow-based approaches for SSH intrusion detection have been developed to overcome the scalability issues of host-based alternatives. Although the detection of many SSH attacks in a flow-based fashion is fairly straightforward, no insight is typically provided in whether an attack was successful. We address this shortcoming by presenting a detection algorithm for the flow-based detection of compromises, i.e., hosts that have been compromised during an attack. Our algorithm has been implemented as part of our open-source IDS SSHCure and validated using almost 100 servers, workstations and honeypots, featuring an accuracy close to 100%.

An Experimental Study of SSH Attacks by using Honeypot Decoys

We studied Brute-force SSH attacks carried out on six different universities campus networks by using Honeypot Techniques. Brute-force password guessing attacks against SSH, FTP and telnet servers are the most common form of attack to compromise servers facing the internet. A key factor to avoid disruption of these networks is to defend it against Brute-force attacks. We focused on the attempts to gain remote access to our SSH Honeypots Plus Tools and techniques employed. There are striking similarities in the methods used to attack these dissimilar systems. The evidence shows that, pre-compiled lists of usernames and passwords that are widely shared form the basis for brute-force attacks. When the passwords were analysed, it was found that in the event of actual malicious traffic what was commonly understood to be strong password did not protect the systems from being compromised. The data from the study were used to evaluate the efficacy of a variety of techniques designed to defend the systems against these attacks. Table 17 lists some commonly recommendation for the protection of SSH servers.

Autonomic Parameter Tuning of Anomaly-Based IDSs: an SSH Case Study

Anomaly-based intrusion detection systems classify network traffic instances by comparing them with a model of the normal network behavior. To be effective, such systems are expected to precisely detect intrusions (high true positive rate) while limiting the number of false alarms (low false positive rate). However, there exists a natural trade-off between detecting all anomalies (at the expense of raising alarms too often), and missing anomalies (but not issuing any false alarms). The parameters of a detection system play a central role in this trade-off, since they determine how responsive the system is to an intrusion attempt. Despite the importance of properly tuning the system parameters, the literature has put little emphasis on the topic, and the task of adjusting such parameters is usually left to the expertise of the system manager or expert IT personnel. In this paper, we present an autonomic approach for tuning the parameters of anomaly-based intrusion detection systems in case of SSH traffic. We propose a procedure that aims to automatically tune the system parameters and, by doing so, to optimize the system performance. We validate our approach by testing it on a flow-based probabilistic detection system for the detection of SSH attacks.