SSH Communication Detection Using Dual-Model Session Log Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting SSH communication are resource-intensive and inefficient, particularly when SSH servers bypass or falsify communication ports, leading to excessive traffic and resource consumption.
Innovation Solution
A machine learning-based model is developed using network session logs, combining a decision tree algorithm and a random forest algorithm to detect SSH communication, utilizing preprocessed log information and a final model that integrates detection results from both initial models to enhance accuracy and reduce false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network packet analysis is used to detect SSH communication, then detection accuracy is improved, but time consumption and computing resources increase excessively
Solution Approach 1:
The patent extracts only the necessary log information from network session logs (such as source IP, destination IP, port, protocol type) rather than analyzing complete network packets. This extraction approach maintains detection accuracy for SSH communication while significantly reducing the data processing burden and time consumption associated with full packet analysis.
Solution Approach 2:
The patent introduces network session logs as an intermediary data source between network traffic and detection algorithms. Instead of directly analyzing raw network packets, the system processes structured log information that contains essential SSH communication characteristics, thereby reducing computing resources and time while preserving detection accuracy.
2Measurement precision
If network packet analysis is used to detect SSH communication, then detection accuracy is improved, but computing resources are consumed excessively
Solution Approach 1:
The system extracts only critical fields from network session logs (source IP, destination IP, port, protocol) rather than processing entire network packets. This selective extraction reduces computing resource consumption while maintaining the accuracy needed to detect SSH communication patterns.
Solution Approach 2:
The patent uses lightweight log data structures instead of heavy packet data structures. The processed log information contains only essential fields needed for SSH detection, creating a lightweight, disposable data representation that consumes minimal computing resources while preserving detection effectiveness.
3Use of energy by moving object
If port information from session log is used to detect SSH communication, then computing resources are saved, but detection becomes difficult when SSH server bypasses or falsifies communication port
Solution Approach 1:
The patent segments the detection approach into multiple independent detection dimensions: protocol type identification, port analysis, and behavioral pattern recognition. By dividing the detection process into separate segments, the system can cross-validate results across different dimensions, maintaining reliability even when port information is falsified while keeping computational costs low.
Solution Approach 2:
The system performs partial analysis of multiple log fields beyond just port information. Instead of relying solely on port numbers, it analyzes combinations of protocol type, source/destination IPs, and other log fields to detect SSH communication, providing excessive verification that maintains reliability while using efficient log-based processing.
4Reliability
If multiple algorithms are combined to improve detection accuracy, then detection reliability is improved, but model complexity increases
Solution Approach 1:
The patent segments the multi-algorithm detection system into independent, modular algorithm components (protocol identification module, port analysis module, pattern recognition module). Each module operates independently on segmented aspects of the log data, improving reliability through diverse detection approaches while managing complexity through clear modular separation and independent operation.
Data Source
AI summary
A method for scheming a model for detecting SSH communication according to an embodiment includes collecting a training dataset including a plurality of network session logs from a web proxy, generating a plurality of preprocessed log information based on a plurality of original datasets included in each of the plurality of network session logs, training, in a first algorithm-based first initial model and a second algorithm-based second initial model for detecting a log corresponding to SSH communication from network session logs, the first initial model and the second initial model based on the plurality of preprocessed log information, and using a new dataset as input to the trained first initial model and the trained second initial model and scheming a final model based on a detection result of the trained first initial model and a detection result of the trained second initial model.