A Denied-Events based Detection Method against SSH Brute-force Attack in Supercomputing Service Environment

摘要

The brute-force attack is one of general cyber security threats in supercomputing service environment using a secure shell (SSH) protocol. First we analyzed SSH brute-force attacks had been detected through the log file parsing method of servers in the KISTI. We found that SSH brute-force attacks are classified '1:1', '1:N' or 'N:1' types of attack between source and destination IP address. And the duration of attacks that is generally the time it takes to execute attacks keeps enough long time. In this paper, we propose a SSH brute-force attack detection method using denied-events of firewalls and evaluate the effectiveness of the method. The analysis results show that our method filter beforehand by 46% on average that the attack traffic flow to active servers.