SSH dictionary attack and DNS reverse resolution traffic in campus network

Proceedings - 3rd International Conference on Intelligent Networks and Intelligent Systems, ICINIS 2010

Volumn , Issue , 2010, Pages 645-648

  Kumagai, Masaya ^a   Musashi, Yasuo ^a   Romaña, Dennis Arturo Ludeña ^a   Takemori, Kazuya ^a   Kubota, Shinichiro ^a   Sugitani, Kenichi ^a  

^a KUMAMOTO UNIVERSITY   (Japan)

Author keywords

DNS based detection; SSH brute force attack; SSH dictionary attack

Indexed keywords

CAMPUS NETWORK; DICTIONARY ATTACK; DNS BASED DETECTION; DNS SERVER; NETWORK SERVER; PACKET TRAFFIC; QUERY PACKETS; SAMPLE VARIANCE; SSH BRUTE FORCE ATTACK; STATISTICAL ANALYSIS; UNIVERSITY CAMPUS;

INTELLIGENT NETWORKS; INTELLIGENT SYSTEMS; INTERNET PROTOCOLS; SERVERS;

COMPUTER CRIME;

EID: 79951728212     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICINIS.2010.9     Document Type: Conference Paper

References (13)

1. P. Barford and V. Yegneswaran: An Inside Look at Botnets, Special Workshop on Malware Detection, Advances in Information Security, Springer Verlag, 2006.
2. J. Nazario: Defense and Detection Strategies against Internet Worms, I Edition; Computer Security Series, Artech House, 2004.
3. J. Kristoff: Botnets, North American Network Operators Group (NANOG32), Reston, Virginia (2004), http://www.nanog.org/mtg-0410/kristoff.html
4. D. David, C. Zou, and W. Lee: Model Botnet Propagation Using Time Zones, Proceeding of the Network and Distributed System Security (NDSS) Symposium 2006; http://www.isc.org/isoc/conferences/ndss/06/proceedings/html/2006/
5. C. Seifert: Analyzing Malicious SSH Login Attempts, Technical Report, 2006 http://www.securityfocus.com/infocus/1876.
6. D. Ramsbrock, R. Berthier, and M. Cukier: Profiling Attacker Behavior Following SSH Compromises, Proceedings of the 37th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN07), Washington D.C., USA, IEEE Computer Society, 2007, p. 119-124. (Pubitemid 350080416)
7. Y. Oosumi and N. Yamai: Technique of the countermeasure for brute force attack which can cooperate between the hosts, IPSJ SIG Technical Reports, Distributed System and Management 47th (DSM47), Vol. 2007, No. 93, 2007, p.49-54.
8. J. L. Thames, R. Abler, and D. Keeling: A distributed active response architecture for preventing SSH dictionary attacks, Proceedings of the Southeastcon, 2008, IEEE, Huntsville, AL, USA, 2008, pp. 84-89.
9. D. A. Ludeña R., K. Sugitani, and Y. Musashi: DNS Based Security Incidents Detection in Campus Network, International Journal of Intelligent Engineering and Systems, Vol. 1, No. 1, 2009, pp.17-21.
10. D. A. Ludeña R., S. Kubota, K. Sugitani, Y. Musashi: DNS-based Spam Bots Detection in a University, International Journal of Intelligent Engineering and Systems, Vol. 2, No. 3, 2009, pp.11-18.
11. D. A. Ludeña R., Y. Musashi, K. Takemori, S. Kubota, K. Sugitani, T. Usagawa, and T. Sueyoshi: DNS Based Detection of SSH Dictionary Attack in Campus Network, Proceedings of the 5th International Conference on Information (INFORMATION 2009), Kyoto, Japan, p.134-137.
12. K. Takemori, D. A. Ludeña R., S. Kubota, K. Sugitani and Y. Musashi: Detection of NS Resource Record DNS Resolution Traffic, Host Search, and SSH Dictionary Attack Activities, International Journal of Intelligent Engineering and Systems, Vol. 2, No. 4, 2009, pp.35-42.
13. BIND-9.2.6: http://www.isc.org/products/BIND/