Unveiling Flat Traffic on the Internet: An SSH Attack Case Study

Mattijs Jonker, R.J. Hofstede, Anna Sperotto, Aiko Pras

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    11 Citations (Scopus)
    186 Downloads (Pure)


    Many types of brute-force attacks are known to exhibit a characteristic ‘flat’ behavior at the network-level, meaning that connections belonging to an attack feature a similar number of packets and bytes, and duration. Flat traffic usually results from repeating similar application-layer actions, such as login attempts in a brute-force attack. For typical attacks, hundreds of attempts span over multiple connections, with each connection containing the same, small number of attempts. The characteristic flat behavior is used by many Intrusion Detection Systems (IDSes), both for identifying the presence of attacks and — once detected — for observing deviations, pointing out potential compromises, for example. However, flatness of network traffic may become indistinct when TCP retransmissions and control information come into play. These TCP phenomena affect not only intrusion detection, but also other forms of network traffic analysis. The contribution of this work is twofold. First, we analyze the impact of retransmissions and control information on network traffic based on traffic measurements. To do so, we have developed a flow exporter extension that was deployed in both a campus and a backbone network. Second, we show that intrusion detection results improve dramatically by up to 16 percentage points once IDSes are able to ‘flatten’ network traffic again, which we have validated by means of analyzing log files of almost 60 hosts over a period of one month.
    Original languageUndefined
    Title of host publicationProceedings of the 2015 IFIP/IEEE International Symposium on Integrated Network Management (IM 2015)
    Place of PublicationUSA
    Number of pages9
    ISBN (Print)978-3-901882-76-0
    Publication statusPublished - May 2015
    Event14th IFIP/IEEE International Symposium on Integrated Network Management, IM 2015: Integrated Management in the Age of Big Data - Shaw Centre, Ottawa, Canada
    Duration: 11 May 201515 May 2015
    Conference number: 14

    Publication series

    PublisherIEEE Communications Society


    Conference14th IFIP/IEEE International Symposium on Integrated Network Management, IM 2015
    Abbreviated titleIM 2015
    Internet address


    • EWI-26078
    • IR-96450
    • METIS-312636

    Cite this