SSHCure: A Flow-Based SSH Intrusion Detection System

Abstract. SSH attacks are a main area of concern for network man-agers, due to the danger associated with a successful compromise. De-tecting these attacks, and possibly compromised victims, is therefore a crucial activity. Most existing network intrusion detection systems de-signed for this purpose rely on the inspection of individual packets and, hence, do not scale to today’s high-speed networks. To overcome this is-sue, this paper proposes SSHCure, a flow-based intrusion detection sys-tem for SSH attacks. It employs an efficient algorithm for the real-time detection of ongoing attacks and allows identification of compromised attack targets. A prototype implementation of the algorithm, including a graphical user interface, is implemented as a plugin for the popular NfSen monitoring tool. Finally, the detection performance of the system is validated with empirical traffic data.