An SSH predictive model using machine learning with web proxy session logs
DC Field | Value | Language |
---|---|---|
dc.contributor.author | Lee, Junwon | - |
dc.contributor.author | Lee, Heejo | - |
dc.date.accessioned | 2022-06-12T12:40:44Z | - |
dc.date.available | 2022-06-12T12:40:44Z | - |
dc.date.created | 2022-06-10 | - |
dc.date.issued | 2022-04 | - |
dc.identifier.issn | 1615-5262 | - |
dc.identifier.uri | https://scholar.korea.ac.kr/handle/2021.sw.korea/142137 | - |
dc.description.abstract | An adversary can use SSH communication as a route for information leakage or hacking. Many studies have focused on TCP header analysis to detect encrypted communication. However, SSH detection using TCP header analysis is limited when changing TCP port information or modifying components of the SSH protocol. Various machine-learning (ML) techniques have been introduced to enhance network traffic classification by analyzing TCP headers. Most ML-based traffic classification research has analyzed network packet flows. However, because of the complex structures and the various implementations of the TCP protocol, a lot of time and resources are required for the recombination of network packet flows. This paper presents a novel contribution to overcome the problems of network packet analysis that employs web proxy session logs, which do not require the recombination of packets to prepare a dataset for analysis. Moreover, we propose a hybrid predictive model that is useful for web proxy session log analysis. In the modeling process, we collected the web proxy logs from an actual network of ICT companies (more than 10,000 employees, Seoul, South Korea) and used the random forest and decision tree algorithms for the supervised learning. The detection rate (DR) for the training dataset was 99.9%, which is similar to or higher than that of other studies using ML and deep learning. Using the dataset of DARPA99, we proved that the DR and FPR for our proposed model were better than those achieved by Alshammari et al.'s model. We expect that the proposed predictive model can be used to block illegal attempts at SSH communication over HTTP CONNECT by changing the destination port and to detect novel illegal communication protocols. | - |
dc.language | English | - |
dc.language.iso | en | - |
dc.publisher | SPRINGER | - |
dc.title | An SSH predictive model using machine learning with web proxy session logs | - |
dc.type | Article | - |
dc.contributor.affiliatedAuthor | Lee, Heejo | - |
dc.identifier.doi | 10.1007/s10207-021-00555-6 | - |
dc.identifier.scopusid | 2-s2.0-85107768376 | - |
dc.identifier.wosid | 000660421500001 | - |
dc.identifier.bibliographicCitation | INTERNATIONAL JOURNAL OF INFORMATION SECURITY, v.21, no.2, pp.311 - 322 | - |
dc.relation.isPartOf | INTERNATIONAL JOURNAL OF INFORMATION SECURITY | - |
dc.citation.title | INTERNATIONAL JOURNAL OF INFORMATION SECURITY | - |
dc.citation.volume | 21 | - |
dc.citation.number | 2 | - |
dc.citation.startPage | 311 | - |
dc.citation.endPage | 322 | - |
dc.type.rims | ART | - |
dc.type.docType | Article | - |
dc.description.journalClass | 1 | - |
dc.description.journalRegisteredClass | scie | - |
dc.description.journalRegisteredClass | scopus | - |
dc.relation.journalResearchArea | Computer Science | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Information Systems | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Software Engineering | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Theory & Methods | - |
dc.subject.keywordAuthor | Web proxy | - |
dc.subject.keywordAuthor | SSH | - |
dc.subject.keywordAuthor | HTTP CONNECT | - |
dc.subject.keywordAuthor | TCP tunneling | - |
dc.subject.keywordAuthor | Machine learning | - |
dc.subject.keywordAuthor | Random forest | - |
dc.subject.keywordAuthor | Decision tree | - |
dc.subject.keywordAuthor | PCA | - |
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.
(02841) 서울특별시 성북구 안암로 14502-3290-1114
COPYRIGHT © 2021 Korea University. All Rights Reserved.
Certain data included herein are derived from the © Web of Science of Clarivate Analytics. All rights reserved.
You may not copy or re-distribute this material in whole or in part without the prior written consent of Clarivate Analytics.