A flow-based detection method for stealthy dictionary attacks against Secure Shell. (April 2015)

• Record Type: Journal Article
• Authors: Satoh, Akihiro; Nakamura, Yutaka; Ikenaga, Takeshi
• Is Part Of: Journal of information security and applications. Volume 21(2015)
• Page Start: 31
• Page End: 41
• Publication Date: 2015-04
• Subjects: ssh dictionary attack -- Flow analysis -- Network operation -- Machine learning algorithm; Computer security -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.jisa.2014.08.003
• Languages: English
• ISSNs: 2214-2126

Abstract

Abstract: SANS has warned about the new variants of SSH dictionary attacks that are very stealthy in comparison with a simple attack. In this paper, we propose a new method to detect simple and stealthy attacks by combining two key innovations. First, on the basis of our assumptions, we employ two criteria: "the existence of a connection protocol" and "the inter-arrival time of an auth-packet and the next" . These criteria are not available, though, owing to the confidentiality and flexibility of the SSH protocol. Second, we resolve this problem by identifying "the transition point of each sub-protocol" through flow features and machine learning algorithms. We evaluate the effectiveness through experiments on real network traffic at the edges in campus networks. The experimental results show that our method provides high accuracy with acceptable computational complexity.