| HAL-Inria | Publications, software ... of Inria's scientists |
Conference papers
SSHCure: A Flow-Based SSH Intrusion Detection System
Abstract : SSH attacks are a main area of concern for network managers, due to the danger associated with a successful compromise. Detecting these attacks, and possibly compromised victims, is therefore a crucial activity. Most existing network intrusion detection systems designed for this purpose rely on the inspection of individual packets and, hence, do not scale to today’s high-speed networks. To overcome this issue, this paper proposes SSHCure, a flow-based intrusion detection system for SSH attacks. It employs an efficient algorithm for the real-time detection of ongoing attacks and allows identification of compromised attack targets. A prototype implementation of the algorithm, including a graphical user interface, is implemented as a plugin for the popular NfSen monitoring tool. Finally, the detection performance of the system is validated with empirical traffic data.
Cited literature [11 references]
https://hal.inria.fr/hal-01529782
Contributor : Hal Ifip <>
Submitted on : Wednesday, May 31, 2017 - 1:17:45 PM
Last modification on : Thursday, June 1, 2017 - 1:09:01 AM
Long-term archiving on: : Wednesday, September 6, 2017 - 4:09:00 PM
Contributor : Hal Ifip <>
Submitted on : Wednesday, May 31, 2017 - 1:17:45 PM
Last modification on : Thursday, June 1, 2017 - 1:09:01 AM
Long-term archiving on: : Wednesday, September 6, 2017 - 4:09:00 PM
File
978-3-642-30633-4_11_Chapter.p...
Files produced by the author(s)
Licence
Distributed under a Creative Commons Attribution 4.0 International License