SSH Dictionary Attack Detection Based on Flow Analysis

SSH services are run on many hosts with various scopes other than just operation, so dictionary attack against the service is a common security threat. SANS has reported the emergence of distributed SSH dictionary attacks, which are very stealthy in comparison with a simple one. Since even one success of such an attack causes serious problems, administrators should implement countermeasures. SSH dictionary attacks have been detected in two basic ways that rely on either log files or network traffic. Both approaches, however, have limitations. The first approach imposes upon administrators heavy maintenance costs, which grow linearly with the number of hosts in networks. The second approach cannot distinguish between successful and unsuccessful attacks. Of more immediate concern, neither approach is effective against stealthy attacks because the login attempts of these attacks have little impact on log files or network traffic. An ideal method would be able to detect individual attacks and distinguish between an attack's success or failure, using information derived from only network traffic. In this paper, we describe such a method, which was developed by combining two novel elements. First, on the basis of our assumptions, we use two criteria: "existence of a connection protocol" and "difference in the inter-arrival time of an auth-packet". These criteria are not available, though, owing to the confidentiality and flexibility of the SSH protocol. Second, we resolve this problem by identifying transition points of a sub-protocol through flow features and machine learning algorithms. We evaluate the effectiveness of the proposed method through experiments on real traffic traces collected at the edge in our campus networks. The experimental results are encouraging for this research direction, though they are derived from reduced datasets of SSH dictionary attacks and under simplifying assumptions. The significant contribution is the demonstration that an ideal method for detecting SSH dictionary attacks seems feasible.