Mining Threat Intelligence from Billion-scale SSH Brute-Force Attacks
Yuming Wu, Phuong Cao, Alexander Withers, Zbigniew Kalbarczyk, Ravishankar K. Iyer · 2020
This paper presents a longitudinal study of 11 Billion SSH brute-force attacks targeting an operational system at the National Center for Supercomputing Applications.We report the nature of these distributed attacks in terms of i) persistence (i.e., consecutively attacking over an entire year), ii) targeted strategies (i.e., using stolen SSH keys), iii) large-scale evasion techniques (i.e., using randomized SSH client versions) to bypass signature detectors, and iv) behaviors of human-supervised botnet.The significance of our analyses for security operators include i) discerning cross-country attacks versus persistent attacks, ii) notifying cloud providers and IoT vendors regarding stolen SSH keys for them to verify the effectiveness of software patches, iii) deterring the above evasion techniques by using anomaly detectors/rate limiters, and iv) differentiating between fully automated attacks versus more sophisticated attacks driven by human.