Hidden Markov Model modeling of SSH brute-force attacks

Anna Sperotto; R. Sadre; Pieter-Tjerk de Boer; Aiko Pras

doi:10.1007/978-3-642-04989-7_13

Hidden Markov Model modeling of SSH brute-force attacks

Anna Sperotto, R. Sadre, Pieter-Tjerk de Boer, Aiko Pras

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

37 Citations (Scopus)

414 Downloads (Pure)

Abstract

Nowadays, network load is constantly increasing and high-speed infrastructures (1-10Gbps) are becoming increasingly common. In this context, flow-based intrusion detection has recently become a promising security mechanism. However, since flows do not provide any information on the content of a communication, it also became more difficult to establish a ground truth for flow-based techniques benchmarking. A possible approach to overcome this problem is the usage of synthetic traffic traces where the generation of malicious traffic is driven by models. In this paper, we propose a flow time series model of SSH brute-force attacks based on Hidden Markov Models. Our results show that the model successfully emulates an attacker behavior, generating meaningful flow time series.

Original language	Undefined
Title of host publication	Integrated Management of Systems, Services, Processes and People in IT, Proceedings of the 20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009
Place of Publication	Berlin
Publisher	Springer
Pages	164-176
Number of pages	13
ISBN (Print)	978-3-642-04988-0
DOIs	https://doi.org/10.1007/978-3-642-04989-7_13
Publication status	Published - 21 Oct 2009
Event	20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009: Integrated Management of Systems, Services, Processes and People in IT - Venice, Italy Duration: 27 Oct 2009 → 28 Oct 2009 Conference number: 20

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer Verlag
Volume	5841/2009
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009
Abbreviated title	DSOM
Country/Territory	Italy
City	Venice
Period	27/10/09 → 28/10/09

Keywords

METIS-264131
EWI-16470
IR-68309

Access to Document

10.1007/978-3-642-04989-7_13

Cite this

Sperotto, A., Sadre, R., de Boer, P.-T., & Pras, A. (2009). Hidden Markov Model modeling of SSH brute-force attacks. In Integrated Management of Systems, Services, Processes and People in IT, Proceedings of the 20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009 (pp. 164-176). Article 10.1007/978-3-642-04989-7_13 (Lecture Notes in Computer Science; Vol. 5841/2009). Springer. https://doi.org/10.1007/978-3-642-04989-7_13

Sperotto, Anna ; Sadre, R. ; de Boer, Pieter-Tjerk et al. / Hidden Markov Model modeling of SSH brute-force attacks. Integrated Management of Systems, Services, Processes and People in IT, Proceedings of the 20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009. Berlin : Springer, 2009. pp. 164-176 (Lecture Notes in Computer Science).

@inproceedings{5d35e132bfe548c7a2bd99601b4a9646,

title = "Hidden Markov Model modeling of SSH brute-force attacks",

abstract = "Nowadays, network load is constantly increasing and high-speed infrastructures (1-10Gbps) are becoming increasingly common. In this context, flow-based intrusion detection has recently become a promising security mechanism. However, since flows do not provide any information on the content of a communication, it also became more difficult to establish a ground truth for flow-based techniques benchmarking. A possible approach to overcome this problem is the usage of synthetic traffic traces where the generation of malicious traffic is driven by models. In this paper, we propose a flow time series model of SSH brute-force attacks based on Hidden Markov Models. Our results show that the model successfully emulates an attacker behavior, generating meaningful flow time series.",

keywords = "METIS-264131, EWI-16470, IR-68309",

author = "Anna Sperotto and R. Sadre and {de Boer}, Pieter-Tjerk and Aiko Pras",

note = "10.1007/978-3-642-04989-7_13 ; 20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009 ; Conference date: 27-10-2009 Through 28-10-2009",

year = "2009",

month = oct,

day = "21",

doi = "10.1007/978-3-642-04989-7_13",

language = "Undefined",

isbn = "978-3-642-04988-0",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "164--176",

booktitle = "Integrated Management of Systems, Services, Processes and People in IT, Proceedings of the 20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009",

address = "Germany",

}

Sperotto, A, Sadre, R, de Boer, P-T & Pras, A 2009, Hidden Markov Model modeling of SSH brute-force attacks. in Integrated Management of Systems, Services, Processes and People in IT, Proceedings of the 20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009., 10.1007/978-3-642-04989-7_13, Lecture Notes in Computer Science, vol. 5841/2009, Springer, Berlin, pp. 164-176, 20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009, Venice, Italy, 27/10/09. https://doi.org/10.1007/978-3-642-04989-7_13

Hidden Markov Model modeling of SSH brute-force attacks. / Sperotto, Anna; Sadre, R.; de Boer, Pieter-Tjerk et al.
Integrated Management of Systems, Services, Processes and People in IT, Proceedings of the 20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009. Berlin: Springer, 2009. p. 164-176 10.1007/978-3-642-04989-7_13 (Lecture Notes in Computer Science; Vol. 5841/2009).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - Hidden Markov Model modeling of SSH brute-force attacks

AU - Sperotto, Anna

AU - Sadre, R.

AU - de Boer, Pieter-Tjerk

AU - Pras, Aiko

N1 - Conference code: 20

PY - 2009/10/21

Y1 - 2009/10/21

N2 - Nowadays, network load is constantly increasing and high-speed infrastructures (1-10Gbps) are becoming increasingly common. In this context, flow-based intrusion detection has recently become a promising security mechanism. However, since flows do not provide any information on the content of a communication, it also became more difficult to establish a ground truth for flow-based techniques benchmarking. A possible approach to overcome this problem is the usage of synthetic traffic traces where the generation of malicious traffic is driven by models. In this paper, we propose a flow time series model of SSH brute-force attacks based on Hidden Markov Models. Our results show that the model successfully emulates an attacker behavior, generating meaningful flow time series.

AB - Nowadays, network load is constantly increasing and high-speed infrastructures (1-10Gbps) are becoming increasingly common. In this context, flow-based intrusion detection has recently become a promising security mechanism. However, since flows do not provide any information on the content of a communication, it also became more difficult to establish a ground truth for flow-based techniques benchmarking. A possible approach to overcome this problem is the usage of synthetic traffic traces where the generation of malicious traffic is driven by models. In this paper, we propose a flow time series model of SSH brute-force attacks based on Hidden Markov Models. Our results show that the model successfully emulates an attacker behavior, generating meaningful flow time series.

KW - METIS-264131

KW - EWI-16470

KW - IR-68309

U2 - 10.1007/978-3-642-04989-7_13

DO - 10.1007/978-3-642-04989-7_13

M3 - Conference contribution

SN - 978-3-642-04988-0

T3 - Lecture Notes in Computer Science

SP - 164

EP - 176

BT - Integrated Management of Systems, Services, Processes and People in IT, Proceedings of the 20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009

PB - Springer

CY - Berlin

T2 - 20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009

Y2 - 27 October 2009 through 28 October 2009

ER -

Sperotto A, Sadre R, de Boer PT, Pras A. Hidden Markov Model modeling of SSH brute-force attacks. In Integrated Management of Systems, Services, Processes and People in IT, Proceedings of the 20th IFIP/IEEE International Workshop on Distributed Systems: Operations and Management, DSOM 2009. Berlin: Springer. 2009. p. 164-176. 10.1007/978-3-642-04989-7_13. (Lecture Notes in Computer Science). doi: 10.1007/978-3-642-04989-7_13