Search papers, labs, and topics across Lattice.
This paper introduces SSHafe, a real-time detection and mitigation system for SSH brute-force attacks that leverages time-series feature engineering and a lightweight LightGBM classifier to analyze authentication logs. By employing a multi-scale sliding-window approach to extract behavioral features, SSHafe achieves an impressive detection accuracy of 99.96% on benchmark data and effectively handles real-world traffic. Additionally, it innovates a passkey-based password rotation standard that enhances security by eliminating vulnerabilities associated with traditional recovery mechanisms, allowing for rapid account protection within ten seconds of an attack detection.
Achieving 99.96% detection accuracy, SSHafe not only thwarts SSH brute-force attacks but also revolutionizes password rotation with a secure, streamlined process.
SSH remains a critical yet heavily targeted protocol for remote system administration, with password-based authentication exposing servers to large-scale brute-force, dictionary, and credential-spray attacks. Existing rule-based defences such as Fail2Ban fail to detect slow, distributed, or threshold-aware adversaries, while conventional account-recovery mechanisms: email links, OTPs, and out-of-band verification introduce additional vulnerabilities including phishing, session hijacking, and weak authentication binding. This work presents SSHafe, a real-time SSH brute-force detection and mitigation system that combines time-series feature engineering with a lightweight LightGBM classifier to identify attack patterns directly from system authentication logs. A multi-scale sliding-window approach extracts behavioural features such as attempt rates, inter-arrival times, failure ratios, and username diversity, enabling the model to achieve a detection accuracy of 99.96% on benchmark data and strong performance on unlabeled real-world traffic. Upon detecting an attack, SSHafe automatically blocks the targeted user account and delivers an SSH banner guiding legitimate users to a novel passkey-based password-rotation workflow. The proposed novel password reset standard performs authentication and password update in a single cryptographically bound flow, eliminating the need for sessions, cookies, OTPs, or email-based verification, and mitigating phishing, session hijacking, CSRF, and replay attacks. Experiments on an Azure VM and live adversarial traffic demonstrate that SSHafe can identify and suppress brute-force activity within ten seconds, preventing account compromise even with weak credentials.
