Machine Learning for Detecting Brute Force Attacks at the Network Level

Abstract

The tremendous growth in computer network and Internet usage, combined with the growing number of attacks makes network security a topic of serious concern. One of the most prevalent network attacks that can threaten computers connected to the network is brute force attack. In this work we investigate the use of machine learners for detecting brute force attacks (on the SSH protocol) at the network level. We base our approach on applying machine learning algorithms on a newly generated dataset based upon network flow data collected at the network level. Applying detection at the network level makes the detection approach more scalable. It also provides protection for the hosts who do not have their own protection. The new dataset consists of real-world network data collected from a production network. We use four different classifiers to build brute force attack detection models. The use of different classifiers facilitates a relatively comprehensive study on the effectiveness of machine learners in the detection of brute force attack on the SSH protocol at the network level. Empirical results show that the machine learners were quite successful in detecting the brute force attacks with a high detection rate and low false alarms. We also investigate the effectiveness of using ports as features during the learning process. We provide a detailed analysis of how the models built can change as a result of including or excluding port features.Keywords -Brute force attack, network flow, network-level attack detection, machine learning.

A survey of network-based intrusion detection data sets

“…In addition to that, additional attacks were run manually. The IDS SNORT 16 and manual inspection were used for labeling. Since the data set is not publicly available due to privacy concerns, we are not able to fill all properties in Table III. ISCX 2012 [28].…”

“…IT security is an important issue and much effort has been spent in the research of intrusion and insider threat detection. Many contributions have been published for processing security-related data [1]- [4], detecting botnets [5]- [8], port scans [9]- [12], brute force attacks [13]- [16] and so on. All these works have in common that they require representative network-based data sets.…”

Performance Analysis of Network Intrusion Detection System using Machine Learning

“…• Brute Force [26], [27]: A brute force attack is one of the most common attack types that threaten computer networks and break encryption. In this kind of attack, the attacker attempts to get user credentials by utilizing a repetitive method to guess username and password using automated software to get the valid account information of victims.…”

TOPASE: Detection and Prevention of Brute Force Attacks with Disciplined IPs from IDS Logs

“…Najafabadi et al investigated several kinds of machine learnings for detecting brute force attacks with real data sets in Ref. [6]. Furthermore, not limited to brute force attacks, intrusion detection with anomaly detection and machine learning has been described in Refs.…”