Clustering of SSH brute-force attack logs using k-clique percolation

Hudan Studiawan; Baskoro Adi Pratomo; Radityo Anggoro

doi:10.1109/ICTS.2016.7910269

Clustering of SSH brute-force attack logs using k-clique percolation

Hudan Studiawan, Baskoro Adi Pratomo, Radityo Anggoro

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

5 Citations (Scopus)

Abstract

The brute-force attacks to SSH service still persist in the server environments. The existing methods have not applied graph theory to analyze authentication log that records this attack. Therefore, we model the log as a graph and propose k-clique percolation to cluster auth.log file to assist the system administrators to inspect this incident. The k-clique percolation has proven in clustering of biological networks and we will deploy it to this problem. We then provide the mechanism for edge removal to separate the generated clusters and make clear the clustering outputs. The experimental results show that this approach is appropriate to cluster raw logs of SSH brute-force attacks.

Original language	English
Title of host publication	Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	39-42
Number of pages	4
ISBN (Electronic)	9781509013791
DOIs	https://doi.org/10.1109/ICTS.2016.7910269
Publication status	Published - 24 Apr 2017
Event	2016 International Conference on Information and Communication Technology and Systems, ICTS 2016 - Surabaya, Indonesia Duration: 12 Oct 2016 → …

Publication series

Name	Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016

Conference

Conference	2016 International Conference on Information and Communication Technology and Systems, ICTS 2016
Country/Territory	Indonesia
City	Surabaya
Period	12/10/16 → …

Keywords

SSH brute-force attack
event log clustering
k-clique percolation

Access to Document

10.1109/ICTS.2016.7910269

Cite this

Studiawan, H., Pratomo, B. A., & Anggoro, R. (2017). Clustering of SSH brute-force attack logs using k-clique percolation. In Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016 (pp. 39-42). Article 7910269 (Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/ICTS.2016.7910269

Studiawan, Hudan ; Pratomo, Baskoro Adi ; Anggoro, Radityo. / Clustering of SSH brute-force attack logs using k-clique percolation. Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016. Institute of Electrical and Electronics Engineers Inc., 2017. pp. 39-42 (Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016).

@inproceedings{e34ea0593cd7464fa630e9a264e1ea42,

title = "Clustering of SSH brute-force attack logs using k-clique percolation",

abstract = "The brute-force attacks to SSH service still persist in the server environments. The existing methods have not applied graph theory to analyze authentication log that records this attack. Therefore, we model the log as a graph and propose k-clique percolation to cluster auth.log file to assist the system administrators to inspect this incident. The k-clique percolation has proven in clustering of biological networks and we will deploy it to this problem. We then provide the mechanism for edge removal to separate the generated clusters and make clear the clustering outputs. The experimental results show that this approach is appropriate to cluster raw logs of SSH brute-force attacks.",

keywords = "SSH brute-force attack, event log clustering, k-clique percolation",

author = "Hudan Studiawan and Pratomo, {Baskoro Adi} and Radityo Anggoro",

note = "Publisher Copyright: {\textcopyright} 2016 IEEE.; 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016 ; Conference date: 12-10-2016",

year = "2017",

month = apr,

day = "24",

doi = "10.1109/ICTS.2016.7910269",

language = "English",

series = "Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "39--42",

booktitle = "Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016",

address = "United States",

}

Studiawan, H , Pratomo, BA & Anggoro, R 2017, Clustering of SSH brute-force attack logs using k-clique percolation. in Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016., 7910269, Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016, Institute of Electrical and Electronics Engineers Inc., pp. 39-42, 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016, Surabaya, Indonesia, 12/10/16. https://doi.org/10.1109/ICTS.2016.7910269

Clustering of SSH brute-force attack logs using k-clique percolation. / Studiawan, Hudan ; Pratomo, Baskoro Adi ; Anggoro, Radityo.
Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016. Institute of Electrical and Electronics Engineers Inc., 2017. p. 39-42 7910269 (Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Clustering of SSH brute-force attack logs using k-clique percolation

AU - Studiawan, Hudan

AU - Pratomo, Baskoro Adi

AU - Anggoro, Radityo

PY - 2017/4/24

Y1 - 2017/4/24

N2 - The brute-force attacks to SSH service still persist in the server environments. The existing methods have not applied graph theory to analyze authentication log that records this attack. Therefore, we model the log as a graph and propose k-clique percolation to cluster auth.log file to assist the system administrators to inspect this incident. The k-clique percolation has proven in clustering of biological networks and we will deploy it to this problem. We then provide the mechanism for edge removal to separate the generated clusters and make clear the clustering outputs. The experimental results show that this approach is appropriate to cluster raw logs of SSH brute-force attacks.

AB - The brute-force attacks to SSH service still persist in the server environments. The existing methods have not applied graph theory to analyze authentication log that records this attack. Therefore, we model the log as a graph and propose k-clique percolation to cluster auth.log file to assist the system administrators to inspect this incident. The k-clique percolation has proven in clustering of biological networks and we will deploy it to this problem. We then provide the mechanism for edge removal to separate the generated clusters and make clear the clustering outputs. The experimental results show that this approach is appropriate to cluster raw logs of SSH brute-force attacks.

KW - SSH brute-force attack

KW - event log clustering

KW - k-clique percolation

UR - http://www.scopus.com/inward/record.url?scp=85019406288&partnerID=8YFLogxK

U2 - 10.1109/ICTS.2016.7910269

DO - 10.1109/ICTS.2016.7910269

M3 - Conference contribution

AN - SCOPUS:85019406288

T3 - Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016

SP - 39

EP - 42

BT - Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016

Y2 - 12 October 2016

ER -

Studiawan H , Pratomo BA , Anggoro R. Clustering of SSH brute-force attack logs using k-clique percolation. In Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016. Institute of Electrical and Electronics Engineers Inc. 2017. p. 39-42. 7910269. (Proceedings of 2016 International Conference on Information and Communication Technology and Systems, ICTS 2016). doi: 10.1109/ICTS.2016.7910269

Clustering of SSH brute-force attack logs using k-clique percolation

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this