π€ AI Summary
This study addresses critical vulnerabilities in SSH password authentication, including susceptibility to slow brute-force attacks, credential spraying, and phishing or session hijacking exploits targeting conventional account recovery mechanisms. To counter these threats, the authors propose a real-time detection and response framework based on time-series log analysis. By employing multi-scale sliding windows to extract behavioral features and integrating a lightweight LightGBM classifier, the system achieves 99.96% attack detection accuracy within 10 seconds and automatically locks compromised accounts. Furthermore, the work introduces a novel credential rotation protocol that eliminates reliance on sessions, email, or one-time passwords (OTPs), instead leveraging single-use cryptographic binding and passkey-based authentication to enable secure and efficient password resets, thereby significantly enhancing resilience against a broad spectrum of cyberattacks.
π Abstract
SSH remains a critical yet heavily targeted protocol for remote system administration, with password-based authentication exposing servers to large-scale brute-force, dictionary, and credential-spray attacks. Existing rule-based defences such as Fail2Ban fail to detect slow, distributed, or threshold-aware adversaries, while conventional account-recovery mechanisms: email links, OTPs, and out-of-band verification introduce additional vulnerabilities including phishing, session hijacking, and weak authentication binding. This work presents SSHafe, a real-time SSH brute-force detection and mitigation system that combines time-series feature engineering with a lightweight LightGBM classifier to identify attack patterns directly from system authentication logs. A multi-scale sliding-window approach extracts behavioural features such as attempt rates, inter-arrival times, failure ratios, and username diversity, enabling the model to achieve a detection accuracy of 99.96% on benchmark data and strong performance on unlabeled real-world traffic. Upon detecting an attack, SSHafe automatically blocks the targeted user account and delivers an SSH banner guiding legitimate users to a novel passkey-based password-rotation workflow. The proposed novel password reset standard performs authentication and password update in a single cryptographically bound flow, eliminating the need for sessions, cookies, OTPs, or email-based verification, and mitigating phishing, session hijacking, CSRF, and replay attacks. Experiments on an Azure VM and live adversarial traffic demonstrate that SSHafe can identify and suppress brute-force activity within ten seconds, preventing account compromise even with weak credentials.