SSH man-in-the-middle attack detection system based on session similarity analysis

Abstract

The invention provides an SSH man-in-the-middle attack detection system based on session similarity analysis, which selects a suspicious SSH session pair from network traffic data, and then discriminates the similarity between encrypted session pairs through a neural network technology so as to complete the detection of a man-in-the-middle attack event in the network traffic data. The method specifically comprises the following steps: designing an SSH man-in-the-middle attack detection process framework based on session similarity analysis, and defining composition modules and detection stepsof a detection scheme; designing an SSH suspicious session pair selection algorithm, so as to effectively reduce the session pair scale needing similarity discrimination; providing a sequence data representation method of the SSH session, and effectively identifying the similarity and uniqueness of the SSH session; constructing a session pair similarity judgment module based on an LSTM neural network and a full connection layer neural network, achieving prediction of SSH session pair similarity, and then completing determination of man-in-the-middle attack events.

Description

technical field [0001] The invention relates to the fields of network security and big data analysis, in particular to a system for detecting SSH (Secure Shell) man-in-the-middle attacks from network traffic data. Background technique [0002] The man-in-the-middle attack is a relatively subtle attack. After the relay connection is established, all plaintext information sent by the original communication parties can be viewed, which may cause very serious information leakage or network intrusion. At present, the research on man-in-the-middle attack detection mainly focuses on the Secure Sockets Layer (SSL, Secure Sockets Layer), and there are mainly two existing SSL man-in-the-middle attack detection methods, which are online detection and offline detection. Online detection means that the client actively detects through some mechanism during the connection process, and disconnects after detecting an attack. Existing online detection methods mainly include the following typ...

AI Technical Summary

Problems solved by technology

The interactivity of SSH makes the response time interval change greatly, and the time interval-based detection idea for SSL is mainly focused on abnormal time intervals, which are too affected by user operations in SSH, so it is not applicable

However, the detection method that actively detects abnormal certificates or keys has two obvious defects in the face of captured SSH encrypted traffic: detection cannot be performed by actively sending data in the captured traffic; SSH does not have the publicity of SSL , there is no guarantee that the server has multiple connections at the same time to provide the required comparison source

Images