Sciweavers

SMC
2007
IEEE

A flow based approach for SSH traffic detection

14 years 6 months ago
A flow based approach for SSH traffic detection
— The basic objective of this work is to assess the utility of two supervised learning algorithms AdaBoost and RIPPER for classifying SSH traffic from log files without using features such as payload, IP addresses and source/destination ports. Pre-processing is applied to the traffic data to express as traffic flows. Results of 10-fold cross validation for each learning algorithm indicate that a detection rate of 99% and a false positive rate of 0.7% can be achieved using RIPPER. Moreover, promising preliminary results were obtained when RIPPER was employed to identify which service was running over SSH. Thus, it is possible to detect SSH traffic with high accuracy without using features such as payload, IP addresses and source/destination ports, where this represents a particularly useful characteristic when requiring generic, scalable solutions.
Riyad Alshammari, A. Nur Zincir-Heywood
Added 04 Jun 2010
Updated 04 Jun 2010
Type Conference
Year 2007
Where SMC
Authors Riyad Alshammari, A. Nur Zincir-Heywood
Comments (0)