Detecting stealthy, distributed SSH brute-forcing

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2013, Pages 85-95

  Javed, Mobin ^a   Paxson, Vern ^a,b  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b INTERNATIONAL COMPUTER SCIENCE INSTITUTE   (United States)

Author keywords

brute forcing; distributed; scanning; ssh

Indexed keywords

BETA-BINOMIAL DISTRIBUTIONS; BRUTE-FORCING; DISTRIBUTED; DISTRIBUTED ATTACK; INDIVIDUAL ATTACKS; LEGITIMATE USERS; MALICIOUS ACTIVITIES; SSH;

SCANNING;

SECURITY OF DATA;

EID: 84889042469     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2508859.2516719     Document Type: Conference Paper

References (20)

1. ww.aczoom.com/blockhosts/.
2. sourceforge.net/.
3. w.sshguard.net/.
4. The Hail Mary Cloud Data - Data collected by Peter N. M. Hansteen (peter@bsdly.net). http://www.bsdly.net/~peter/hailmary/.
5. -01.pdf, Feburary, 2012.
6. R. Bezut and V. Bernet-Rollande. Study of Dictionary Attacks on SSH. Technical report, University of Technology of Compiegne, http://files.xdec.net/ TX-EN-Bezut-Bernet-Rollande-BruteForce-SSH.pdf,2010.
7. D. Brook and D. A. Evans. An approach to the probability distribution of CUSUM run length. In Biometrika, volume 59, pages 539-549, 1972.
8. C. Gates. Coordinated scan detection. In 16th Annual Network and Distributed System Security Symposium, 2009.
9. D. Gerzo. BruteForceBlocker. http://danger.rulez.sk/projects/ bruteforceblocker.
10. D. M. Hawkins and D. H. Olwell. Cumulative sum charts and charting for quality improvement. Springer, 1998.
11. L. Hellemons. Flow-based Detection of SSH Intrusion Attempts. In 16th Twente Student Conference on IT. University of Twente, January 2012.
12. C. Jacquier. Fail2Ban. http://www.fail2ban.org.
13. M. Kumagai, Y. Musashi, D. Arturo, L. Romana, K. Takemori, S. Kubota, and K. Sugitani. SSH Dictionary Attack and DNS Reverse Resolution Traffic in Campus Network. In 3rd International Conference on Intelligent Networks and Intelligent Systems, pages 645-648, 2010.
14. E. L. Malecot, Y. Hori, K. Sakurai, J. Ryou, and H. Lee. (Visually) Tracking Distributed SSH BruteForce Attacks? In 3rd International Joint Workshop on Information Security and Its Applications, pages 1-8, Feburary, 2008.
15. J. Owens and J. Matthews. A Study of Passwords and Methods Used in Brute-Force SSH Attacks. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2008.
16. A. V. Siris and F. Papagalou. Application of anomaly detection algorithms for detecting SYN flooding attacks. In IEEE GLOBECOM, pages 2050-2054. IEEE, 2004.
17. S. Staniford, J. A. Hoagland, and J. M. McAlerney. Practical automated detection of stealthy portscans. In 7th ACM Conference on Computer and Communications Security, Athens, Greece, 2000.
18. J. Vykopal, T. Plesnik, and P. Minarik. Network-based Dictionary Attack Detection. In International Conference on Future Networks, 2009.
19. H. Wang, D. Zhang, and S. K. Detecting SYN flooding attacks. In 21st Joint Conference IEEE Computer and Communication Societies (IEEE INFOCOM), pages 1530-1539, 2002.
20. C. M. Zhang and V. Paxson. Detecting and Analyzing Automated Activity on Twitter. In Passive and Active Measurement. Springer, 2011.