Detailed Information on Publication Record

@inproceedings{34527,
   author = {Čeleda, Pavel and Velan, Petr and Král, Benjamin and Kozák, Ondřej},
   address = {Washington DC, USA},
   booktitle = {2019 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)},
   keywords = {SSH; flow; monitoring; network; dataset},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {Washington DC, USA},
   isbn = {978-1-72810-618-2},
   pages = {569-574},
   publisher = {IEEE},
   title = {Enabling SSH Protocol Visibility in Flow Monitoring},
   url = {http://dl.ifip.org/db/conf/im/im2019exp/189410.pdf},
   year = {2019}
}

TY  - JOUR
ID  - 34527
AU  - Čeleda, Pavel - Velan, Petr - Král, Benjamin - Kozák, Ondřej
PY  - 2019
TI  - Enabling SSH Protocol Visibility in Flow Monitoring
PB  - IEEE
CY  - Washington DC, USA
SN  - 9781728106182
KW  - SSH
KW  - flow
KW  - monitoring
KW  - network
KW  - dataset
UR  - http://dl.ifip.org/db/conf/im/im2019exp/189410.pdf
N2  - The network flow monitoring has evolved to collect information beyond the network and transport layers, most importantly the application layer information. This information is used to improve network security and performance by enabling more precise performance analysis and intrusion detection. In this paper, we contribute to this effort by extending flow monitoring with information from the SSH protocol. Firstly, we analyze the SSH protocol to determine which information can be obtained from the connection establishment phase. Based on the analysis, we create an extension to our flow monitoring infrastructure that allows obtaining the selected information. Lastly, we analyze the SSH connections observed in the university campus network and discuss the benefits of performing the detailed SSH protocol analysis. We argue that with a precise recognition of login attempt results it is possible to improve the detection of successful brute-force password attacks. Moreover, we publish an anonymized version of our dataset including the SSH specific information.
ER  - 

ČELEDA, Pavel, Petr VELAN, Benjamin KRÁL and Ondřej KOZÁK. Enabling SSH Protocol Visibility in Flow Monitoring. Online. In \textit{2019 IFIP/IEEE Symposium on Integrated Network and Service Management (IM)}. Washington DC, USA: IEEE, 2019, p.~569-574. ISBN~978-1-72810-618-2.