TY - GEN
T1 - SSHCure: A Flow-Based SSH Intrusion Detection System
AU - Hellemons, Laurens
AU - Hendriks, Luuk
AU - Hofstede, R.J.
AU - Sperotto, Anna
AU - Sadre, R.
AU - Pras, Aiko
N1 - 10.1007/978-3-642-30633-4_11
PY - 2012/6
Y1 - 2012/6
N2 - SSH attacks are a main area of concern for network managers, due to the danger associated with a successful compromise. Detecting these attacks, and possibly compromised victims, is therefore a crucial activity. Most existing network intrusion detection systems designed for this purpose rely on the inspection of individual packets and, hence, do not scale to today's high-speed networks. To overcome this issue, this paper proposes SSHCure, a flow-based intrusion detection system for SSH attacks. It employs an efficient algorithm for the real-time detection of ongoing attacks and allows identification of compromised attack targets. A prototype implementation of the algorithm, including a graphical user interface, is implemented as a plugin for the popular NfSen monitoring tool. Finally, the detection performance of the system is validated with empirical traffic data.
AB - SSH attacks are a main area of concern for network managers, due to the danger associated with a successful compromise. Detecting these attacks, and possibly compromised victims, is therefore a crucial activity. Most existing network intrusion detection systems designed for this purpose rely on the inspection of individual packets and, hence, do not scale to today's high-speed networks. To overcome this issue, this paper proposes SSHCure, a flow-based intrusion detection system for SSH attacks. It employs an efficient algorithm for the real-time detection of ongoing attacks and allows identification of compromised attack targets. A prototype implementation of the algorithm, including a graphical user interface, is implemented as a plugin for the popular NfSen monitoring tool. Finally, the detection performance of the system is validated with empirical traffic data.
KW - METIS-287906
KW - EWI-21999
KW - EC Grant Agreement nr.: FP7/257513
KW - IR-80710
U2 - 10.1007/978-3-642-30633-4_11
DO - 10.1007/978-3-642-30633-4_11
M3 - Conference contribution
SN - 978-3-642-30632-7
T3 - Lecture Notes in Computer Science
SP - 86
EP - 97
BT - Proceedings of the 6th International Conference on Autonomous Infrastructure, Management, and Security (AIMS 2012)
PB - Springer
CY - Berlin
T2 - 6th International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2012
Y2 - 4 June 2012 through 8 June 2012
ER -