Indian Journal of Science and Technology
DOI: 10.17485/ijst/2016/v9i24/96070
Year: 2016, Volume: 9, Issue: 24, Pages: 1-4
Original Article
Jae-Kook Lee, Sung-Jun Kim* and Taeyoung Hong
Department of Supercomputing Infrastructure, [email protected]
[email protected]
[email protected]
*Author for Correspondence
Sung-Jun Kim
Department of Supercomputing Infrastructure
Email:[email protected]
Background/Objectives: The brute-force attack is one of popular cyber security threats in the secure shell (SSH) service environment. The SANS Institute has warned about SSH brute-force attacks against remote services. Methods/Statistical Analysis: We describe two brute-force attack detection methods are applied in the High Performance Computing (HPC) service environment which has been operated by KISTI in KOREA. The first way parses failed authentication logs of systems. The second way analyze dropped events of network firewalls. Findings: We analyze SSH brute-force attacks that are detected applying these methods in our service environment. The analysis results show that SSH brute-force attacks are classified ‘1:N’ or ‘N:1’ types of attack between source and destination IP address. And a duration of attacks that is generally the time it takes to execute attacks keeps enough long times. Improvements/Applications: Two detection methods which are deployed in our HPC multi-user service environment are complementary to each other. These methods will be also able to apply for other service environment.
Keywords: Brute-force Attack, Cyber Attack Analysis, SSH, Supercomputer
Subscribe now for latest articles and news.