다중 사용자 컴퓨팅 환경에서 SSH 무작위 공격 분석 및 대응
Analysis and Response of SSH Brute Force Attacks in Multi-User Computing Environment
1
조회
0
다운로드
4
인용
0
참고문헌
키워드
초록
SSH 서비스는 공개키를 이용하여 두 시스템 사이의 안전하고 암호화된 통신 채널을 제공한다. 그러나 이 서비스를 악용한 SSH 무작위 공격(SSH brute force attack)과 같은 해킹 시도가 지속적으로 발생하고 있다. SSH 무작위 공격은 사용자의 계정과 패스워드 조합을 추측하여SSH 서버에 지속적으로 로그인을 시도한다. 본 논문에서는 2014년 국가 슈퍼컴퓨터를 대상(Target)으로 발생한 SSH 무작위 공격을 분석하고이와 같이 공격을 탐지하고 대응하기 위한 실패로그 기반의 방법을 기술한다.
Abstract
SSH provides a secure, encrypted communication channel between two end point systems using public key encryption. But SSH brute force attack is one of the most significant attacks. This kind of attack aims to login to the SSH server by continually guessing a large number of user account and password combinations. In this paper, we analyze logs of SSH brute force attacks in 2014 and propose a failed-log based detection mechanism in high performance computing service environment.
참고문헌 (20)
- Chan Yeol Park, "Pattern Analysis of Jobs on Supercomputer Tachyon2", Journal of Supercomputing Information, 2(1) (2014)
- Bu Young Ahn, "Study of High Performance Computing Activation Strategy", International Journal of Multimedia and Ubiquitous Engineering, 9(6) (2014)
- Jae-Kook Lee, "Performance Analysis and Improvement of Network Firewalls in the KISTI-4 Supercomputing Service Environment", Journal of Supercomputing Information, 2(2) (2014)
- Steve Mansfield-Devine, "Interview: Tatu Ylönen, SSH communications Security", Computer Fraud & Security (2012)
- Gene Schultz, "Using ssh: Do security risks outweigh the benefits?", Network Security, 2004(10) (2004)
- Dusi, M., "Tunnel hunter: Detecting application-layer tunnels with statistical fingerprinting", Computer Networks, 53(1) (2009)
- Mehdi Barati, "Intrusion Detection System in Secure Shell Traffic in Cloud Environment", Journal of Computer Science, 10 (2014)
- Stanislav Ponomarev, "Detection of SSH Host Spoofing in Control Systems Through Network Telemetry Analysis", Cyber and Information Security Research Conference, 8-10th (2014)
- Ahmed Patel, "An intrusion detection and prevention system in cloud computing: A systematic review", Journal of Network and Computer Applications, 36 (2013)
- Chirag Modi, "A survey of intrusion detection techniques in Cloud", Journal of Network and Computer Applications, 36 (2013)
- Zigang Cao, "Progress in Study of Encrypted Traffic Clasification", ISCTCS 2012 (2012)
- Zubair M. Fadlullah, "DTRAB: Combating Against Attacks on Encrypted Protocols Through Traffic-Feature Analysis", IEEE, 2010, pp.18(4), ~
- Laurens Hellemons, "SSHCure: A Flow-Based SSH Intrusion Detection System", LNCS, 7279 (2012)
- Anna Sperotto, "Hidden Markov Model modeling of SSH brute-force attacks", LNCS, 5841 (2009)
- Dusi, "Tunnel hunter: Detecting application-layer tunnels with statistical fingerprinting", Computer Networks, 53(1) (2009)
- Akihiro Satoh, "SSH Dictionary Attack Detection based on Flow Analysis", 12th International Symposium on Applications and the Internet (2012)
- Xiaoqiao Huang, "Construct the Secure Shell Transport Model and Analyze Its Security Performance", Procedia Environmental Sciences, 11 (2011)
- 김우석, "엔트로피를 이용한 ShellCode 탐지 방법", 정보처리학회논문지. 컴퓨터 및 통신시스템, 3(3), pp.87~96 (2014), 한국정보처리학회[DOI]
- Aly M. El-Semary, "Distributed and Scalable Intrusion Detection System Based on Agents and Intelligent Techniques", JIPS(Journal of Information Processing Systems), 6(4), pp.481~500 (2010), 한국정보처리학회
- 원일용, "Alpha-cut 과 Beta-pick를 이용한 시그너쳐 기반 침입탐지 시스템과 기계학습 기반 침입탐지 시스템의 결합", 정보처리학회논문지C, 12(4), pp.609~616 (2005), 한국정보처리학회