The Experts below are selected from a list of 1851 Experts worldwide ranked by ideXlab platform
Guanghan Chung - One of the best experts on this subject based on the ideXlab platform.
-
developing the upgrade detection and defense system of ssh Dictionary Attack for multi platform environment
Ibusiness, 2011Co-Authors: Guanghan ChungAbstract:Based on the improved algorithm for analyzing log and the detection and defense system of SSH Dictionary-Attack for Multi-Platform Environment (Su, Chen, Chung & Wu), we developed the upgrade detection and defense system of SSH Dictionary-Attack for Multi-Platform Environment. In this study, we introduced the current threats and the types of SSH Dictionary-Attack. Then, we explained the functions and differences between the current defense software and defense types of SSH Dictionary-Attack; and described the current system of SSH Dictionary-Attack for Multi-Platform Environment. Moreover, based on the study of Su, Chen, Chung and Wu, we improved the algorithm of analyzing log in order to increase the defense capability of SSH Dictionary-Attack. After that, we designed the upgrade detection and defense system of SSH Dictionary-Attack for Multi-Platform Environment. The contribution of this study is to provide the upgrade detection and defense system of SSH Dictionary-Attack which was to keep the functions of original system of SSH Dictionary-Attack, and to improve the effectiveness of the algorithm of analyzing log.
-
developing a ssh Dictionary Attack defense system in the multi platform environments through the analyzing log
International Conference on Internet Technology and Applications, 2010Co-Authors: Yuehhung Chen, Guanghan ChungAbstract:The researcher discussed the SSH Dictionary Attack defense system in the multi platform environments through the analyzing log. The study introduced the current formats and threats of the SSH Dictionary Attack. Then, the research explained the types of the SSH Dictionary Attack defense system, and compared the functions and differences between the traditional and current detection systems. Moreover, the study based on the research of Y.N. Su and Y. H. Chen (2010), the SSH Dictionary Attack defense system, and advanced the detection functions in the multi platforms. According to those literatures, the study developed the SSH Dictionary Attack and detection system in the multi platforms environments using analyzing log . The contributions of the study were to provide an easy way for detection, and to get the list of the SSH Dictionary Attack sources by typing into the defection system in order to achieve the purpose of the SSH Dictionary Attack system in the multi platform defection environments.
D P Jablon - One of the best experts on this subject based on the ideXlab platform.
-
extended password key exchange protocols immune to Dictionary Attack
Workshops on Enabling Technologies: Infrastracture for Collaborative Enterprises, 1997Co-Authors: D P JablonAbstract:Strong password methods verify even small passwords over a network without additional stored keys or certificates with the user, and without fear of network Dictionary Attack. We describe a new extension to further limit exposure to theft of a stored password-verifier, and apply it to several protocols including the Simple Password Exponential Key Exchange (SPEKE). Alice proves knowledge of a password C to Bob, who has a stored verifier S, where S=g/sup C/ mod p. They perform a SPEKE exchange based on the shared secret S to derive ephemeral shared key K/sub 1/. Bob chooses a random X and sends g/sup X/ mod p. Alice computes K=g/sup XC/ mod p, and proves knowledge of {K/sub 1/,K/sub 2/}. Bob verifies this result to confirm that Alice knows C. Implementation issues are summarized, showing the potential for improved performance over Bellovin and Merritt's comparably strong Augmented-Encrypted Key Exchange. These methods make the password a strong independent factor in authentication, and are suitable for both Internet and intranet use.
-
extended password key exchange protocols immune to Dictionary Attack
Workshops on Enabling Technologies: Infrastracture for Collaborative Enterprises, 1997Co-Authors: D P JablonAbstract:Strong password methods verify even small passwords over a network without additional stored keys or certificates with the user, and without fear of network Dictionary Attack. We describe a new extension to further limit exposure to theft of a stored password-verifier, and apply it to several protocols including the Simple Password Exponential Key Exchange (SPEKE). Alice proves knowledge of a password C to Bob, who has a stored verifier S, where S=g/sup C/ mod p. They perform a SPEKE exchange based on the shared secret S to derive ephemeral shared key K/sub 1/. Bob chooses a random X and sends g/sup X/ mod p. Alice computes K=g/sup XC/ mod p, and proves knowledge of {K/sub 1/,K/sub 2/}. Bob verifies this result to confirm that Alice knows C. Implementation issues are summarized, showing the potential for improved performance over Bellovin and Merritt's comparably strong Augmented-Encrypted Key Exchange. These methods make the password a strong independent factor in authentication, and are suitable for both Internet and intranet use.
Takeshi Ikenaga - One of the best experts on this subject based on the ideXlab platform.
-
identifying user authentication methods on connections for ssh Dictionary Attack detection
Computer Software and Applications Conference, 2013Co-Authors: Akihiro Satoh, Yutaka Nakamura, Takeshi IkenagaAbstract:A Dictionary Attack against SSH is a common security threat. Many published ways rely on network traffic to detect SSH Dictionary Attacks. This is because the connections of remote login, file transfer, and TCP/IP forwarding are visibly distinct from those of the Attacks. However these ways incorrectly consider the connections of automated tasks as those of the Attacks because of the mutual similarities. In this paper, we propose a new approach to identify user authentication methods on SSH connections and to remove connections that employ non-keystroke based authentication. This approach rests on two perspectives: (1) an SSH Dictionary Attack targets a host that provides keystroke based authentication, (2) automated tasks through SSH need to support non-keystroke based authentication. Thus, our proposal contributes to improvement in the detection accuracy of SSH Dictionary Attacks.
-
ssh Dictionary Attack detection based on flow analysis
Symposium on Applications and the Internet, 2012Co-Authors: Akihiro Satoh, Yutaka Nakamura, Takeshi IkenagaAbstract:SSH services are run on many hosts with various scopes other than just operation, so Dictionary Attack against the service is a common security threat. SANS has reported the emergence of distributed SSH Dictionary Attacks, which are very stealthy in comparison with a simple one. Since even one success of such an Attack causes serious problems, administrators should implement countermeasures. SSH Dictionary Attacks have been detected in two basic ways that rely on either log files or network traffic. Both approaches, however, have limitations. The first approach imposes upon administrators heavy maintenance costs, which grow linearly with the number of hosts in networks. The second approach cannot distinguish between successful and unsuccessful Attacks. Of more immediate concern, neither approach is effective against stealthy Attacks because the login attempts of these Attacks have little impact on log files or network traffic. An ideal method would be able to detect individual Attacks and distinguish between an Attack's success or failure, using information derived from only network traffic. In this paper, we describe such a method, which was developed by combining two novel elements. First, on the basis of our assumptions, we use two criteria: "existence of a connection protocol" and "difference in the inter-arrival time of an auth-packet". These criteria are not available, though, owing to the confidentiality and flexibility of the SSH protocol. Second, we resolve this problem by identifying transition points of a sub-protocol through flow features and machine learning algorithms. We evaluate the effectiveness of the proposed method through experiments on real traffic traces collected at the edge in our campus networks. The experimental results are encouraging for this research direction, though they are derived from reduced datasets of SSH Dictionary Attacks and under simplifying assumptions. The significant contribution is the demonstration that an ideal method for detecting SSH Dictionary Attacks seems feasible.
Akihiro Satoh - One of the best experts on this subject based on the ideXlab platform.
-
identifying user authentication methods on connections for ssh Dictionary Attack detection
Computer Software and Applications Conference, 2013Co-Authors: Akihiro Satoh, Yutaka Nakamura, Takeshi IkenagaAbstract:A Dictionary Attack against SSH is a common security threat. Many published ways rely on network traffic to detect SSH Dictionary Attacks. This is because the connections of remote login, file transfer, and TCP/IP forwarding are visibly distinct from those of the Attacks. However these ways incorrectly consider the connections of automated tasks as those of the Attacks because of the mutual similarities. In this paper, we propose a new approach to identify user authentication methods on SSH connections and to remove connections that employ non-keystroke based authentication. This approach rests on two perspectives: (1) an SSH Dictionary Attack targets a host that provides keystroke based authentication, (2) automated tasks through SSH need to support non-keystroke based authentication. Thus, our proposal contributes to improvement in the detection accuracy of SSH Dictionary Attacks.
-
ssh Dictionary Attack detection based on flow analysis
Symposium on Applications and the Internet, 2012Co-Authors: Akihiro Satoh, Yutaka Nakamura, Takeshi IkenagaAbstract:SSH services are run on many hosts with various scopes other than just operation, so Dictionary Attack against the service is a common security threat. SANS has reported the emergence of distributed SSH Dictionary Attacks, which are very stealthy in comparison with a simple one. Since even one success of such an Attack causes serious problems, administrators should implement countermeasures. SSH Dictionary Attacks have been detected in two basic ways that rely on either log files or network traffic. Both approaches, however, have limitations. The first approach imposes upon administrators heavy maintenance costs, which grow linearly with the number of hosts in networks. The second approach cannot distinguish between successful and unsuccessful Attacks. Of more immediate concern, neither approach is effective against stealthy Attacks because the login attempts of these Attacks have little impact on log files or network traffic. An ideal method would be able to detect individual Attacks and distinguish between an Attack's success or failure, using information derived from only network traffic. In this paper, we describe such a method, which was developed by combining two novel elements. First, on the basis of our assumptions, we use two criteria: "existence of a connection protocol" and "difference in the inter-arrival time of an auth-packet". These criteria are not available, though, owing to the confidentiality and flexibility of the SSH protocol. Second, we resolve this problem by identifying transition points of a sub-protocol through flow features and machine learning algorithms. We evaluate the effectiveness of the proposed method through experiments on real traffic traces collected at the edge in our campus networks. The experimental results are encouraging for this research direction, though they are derived from reduced datasets of SSH Dictionary Attacks and under simplifying assumptions. The significant contribution is the demonstration that an ideal method for detecting SSH Dictionary Attacks seems feasible.
Yasuo Musashi - One of the best experts on this subject based on the ideXlab platform.
-
Evaluation of DNS based SSH Dictionary Attack traffic in campus network
International Journal of Intelligent Engineering and Systems, 2010Co-Authors: Masaya Kumagai, Yasuo Musashi, Dennis Arturo Ludena RomanaAbstract:We performed statistical analysis on the total PTR resource record (RR) based DNS query packet traffic from a university campus network to the top domain DNS server through March 14th, 2009, when the network servers in the campus network were under inbound SSH Dictionary Attack. The interesting results are obtained, as follows: (1) the network servers, especially those providing SSH services, generated the significant PTR RR based DNS query request packet traffic through 07:30-08:30 in March 14th, 2009, (2) we calculated sample variance for the DNS query request packet traffic, (3) the variance can change in a sharp manner through 07:30-08:30, (4) we developed a couple of DNS based SSH detection technologies by employing the PTR RR DNS query request packet traffic variance- and the DNS query keywords Euclid distance based methods, and (5) we evaluated and compared the both detection rates. As a result, although the both detection technologies take high detection rates, the Euclid distance based detection technology can take a low false positive rate than that of the variance based one, indicating that we can detect the inbound SSH Dictionary Attack to the network server in the campus network by observing the total PTR RR DNS query request packet traffic from the campus network.
-
SSH Dictionary Attack and DNS Reverse Resolution Traffic in Campus Network
2010 Third International Conference on Intelligent Networks and Intelligent Systems, 2010Co-Authors: Masaya Kumagai, Yasuo Musashi, Dennis Arturo Ludena Romana, Shinichiro Kubota, Kazuya Takemori, Kenichi SugitaniAbstract:We performed statistical analysis on the total PTR resource record (RR) based DNS query packet traffic from a university campus network to the top domain DNS server through March 14th, 2009, when the network servers in the campus network were under inbound SSH Dictionary Attack. The interesting results are obtained, as follows: (1) the network servers, especially, they have a function of SSH services, generated the significant PTR RR based DNS query request packet traffic through 07:30-08:30 in March 14th, 2009, (2) we calculated sample variance for the DNS query request packet traffic, and (3) the variance can change in a sharp manner through 07:30-08:30. From these results, it is clearly concluded that we can detect the inbound SSH Dictionary Attack to the network server by only observing the variance of the total PTR RR based DNS query request packet traffic from the network servers in the campus network.
-
detection of ns resource record dns resolution traffic host search and ssh Dictionary Attack activities
International Journal of Intelligent Engineering and Systems, 2009Co-Authors: Kazuya Takemori, Dennis Arturo Ludena Romana, Kenichi Sugitani, Shinichiro Kubota, Yasuo MusashiAbstract:We carried out an entropy study on the DNS query traffic from the Internet to the top domain DNS server in a university campus network through January 1st to March 31st, 2009. The obtained results are: (1) We observed a difference for the entropy changes among the total-, the A-, and the PTR resource records (RRs) based DNS query traffic from the Internet through January 17th to February 1st, 2009. (2) We found the large NS RR based DNS query traffic including only a keyword "." in the total inbound DNS query traffic. (3) We also found that the unique source IP address based PTR DNS traffic entropy slightly increased, while the unique DNS query keywords based one drastically decreased in March 9th, 2009. We found a specific IP host which was an already-hijacked classical Linux PC that carried out the SSH Dictionary Attack to the Internet sites in March 9th, 2009. From these results,we can detect the unusual inbound NS RR based DNS traffic and the outbound SSH Dictionary Attacks by only watching DNS query traffic from the Internet.
-
DNS Based Detection of SSH Dictionary Attack in Campus Network
2009Co-Authors: Dennis Arturo Ludena Romana, Yasuo Musashi, Kenichi Sugitani, Shinichiro Kubota, Masaya Kumagai, Kazuya Takemori, Tsuyoshi Usagawa, Toshinori SueyoshiAbstract:We statistically investigated the DNS query access traffic from a university campus network toward the top domain DNS through March 14th, 2009, when the hosts in the campus network were under inbound SSH Dictionary brute force Attack. The interesting results are obtained, as follows: (1) the several hosts generated the DNS query packet traffic, taking a rate of more than 1,000 hour -1 , through 07:30-08:30 in March 14th, 2009, (2) the DNS query packet traffic correlates with the DNS query packet one including more than two specific query keywords (payloads of the packets), and (3) the former keyword is a fully qualified domain name (FQDN) and the latter one is an IP address. Therefore, we can detect inbound SSH Dictionary Attack by watching frequencies of the FQDNs and the IP addresses as query keywords in the DNS query packets from the hosts in the campus network.
-
Detection of NS Resource Record Based DNS Query Request Packet Traffic and SSH Dictionary Attack Activity
2009 Second International Conference on Intelligent Networks and Intelligent Systems, 2009Co-Authors: Kazuya Takemori, Dennis Arturo Ludena Romana, Kenichi Sugitani, Shinichiro Kubota, Yasuo MusashiAbstract:We carried out an entropy study on the DNS query traffic from the Internet to the top domain DNS server in a university campus network through January 1st to March 31st, 2009. The obtained results are: (1) We observed a difference for the entropy changes among the total-, the A-, and the PTR resource records (RRs) based DNS query traffic from the Internet through January 17th to February 1st, 2009. (2) We found the large NS RR based DNS query traffic including only a keyword "." in the total DNS query traffic from the Internet. (3) We also found that the unique source IP address based PTR DNS traffic entropy slightly increased, while the unique DNS query keywords based one drastically decreased in March 9th, 2009. We found a specific IP host which was an already-hijacked classical Linux PC that carried out the SSH Dictionary Attack to the Internet sites in March 9th, 2009. From these results, we can detect the unusual NS RR based DNS traffic and SSH Dictionary Attacks by only watching DNS query traffic from the Internet.