SSHafe: A Real-Time SSH Brute Force Attack Detection and Novel Credential Rotation Standard

Imagine the internet as a giant, bustling city where every building is a computer server, and the front door is a special protocol called SSH. This is the main way system administrators walk into their buildings to fix things, check the mail, or turn the lights on. Most of these doors have two ways to open: a high-tech key (public key) or a secret word (password). The secret word is easier to use because you can type it in from anywhere, but it has a nasty weakness: if someone guesses the word, they get in.

Enter the "brute force" attack. Picture a mischievous robot standing at your door, trying to whisper thousands of different passwords every second, hoping one of them matches your secret. If the robot gets lucky, it walks right in. To stop this, many buildings use a bouncer named Fail2Ban. This bouncer is smart but simple: "If you fail to guess the password three times, I'm kicking you out." But the robots are tricky. They can slow down their whispering or spread themselves out across the city, trying just once from a thousand different doors. The simple bouncer doesn't notice them because they never break the "three strikes" rule. This leaves a gap where the robots can sneak in, and the people inside are left vulnerable.

This is where a new team of researchers steps in with a project called SSHafe. They built a super-smart security guard that doesn't just count failed attempts; it watches the rhythm of the knocking. They realized that a real person typing a password has a natural, slow heartbeat, while a robot trying to guess has a frantic, machine-gun heartbeat. By using a special kind of math (machine learning) to listen to these heartbeats in the building's logbook, SSHafe can spot the robot almost instantly, even if it's trying to be sneaky.

But spotting the robot is only half the battle. What happens when the robot is caught? Usually, the building owner has to reset the password, which often involves sending a link via email or a text message. The researchers found that these recovery methods are like handing the robot a spare key while you're distracted; they can be stolen or tricked. So, SSHafe introduces a brand-new way to change the password. Instead of sending a link, it uses a "passkey"—a digital handshake that proves you are you without needing a password at all. It combines the act of proving your identity and changing the password into one single, unbreakable move.

The New Guard and the Magic Handshake

The paper presents SSHafe, a system designed to catch these sneaky password-guessing robots in real-time and then help the real owners lock the door tighter. The researchers built this system using a "lightweight" machine learning model called LightGBM. Think of this model as a detective that has read millions of logs and learned to recognize the specific "fingerprint" of an attack.

Instead of just looking at how many times a password was wrong, SSHafe looks at the timing. It uses a "sliding window" technique, which is like watching a video clip of the last 30, 60, or 300 seconds. It asks questions like: "How many times did this person try in the last minute?" "How many different usernames did they try?" and "How fast are they typing?" The researchers found that while a normal human might try a password once or twice a second, a robot tries 3 to 5 times a second, or even more. This frantic speed is the robot's giveaway.

When the system detects this frantic rhythm, it doesn't just wait. It acts immediately. Within 10 seconds, it blocks the targeted user account. But here is the clever part: instead of just locking the door and leaving the user stranded, SSHafe puts up a digital sign (an SSH banner) that says, "Hey, someone is trying to break in! We've locked the door. Click here to change your password safely."

The "One-Step" Password Reset

The most exciting part of the paper is the new way it handles password changes. Usually, resetting a password is a two-step dance: first, you prove who you are (maybe with an email link or a code sent to your phone), and then, in a separate step, you type in a new password. The researchers argue this is risky because the "proof" step can be stolen or tricked (like phishing).

SSHafe proposes a novel credential rotation standard that combines these two steps into one. It uses a technology called FIDO2 Passkeys (which is like a digital key stored on your phone or computer). When you need to change your password, the system doesn't ask for your old password or send you an email. Instead, it asks your device to perform a "magic handshake."

Here is how the magic works, according to the paper:

1. The server sends a challenge to your device.
2. Your device uses a secret key (the passkey) to sign a message that includes your new password, encrypted so no one can read it.
3. The server checks the signature. If it matches, it knows you are the real owner and it receives the new password at the same time.

This happens in a single flow. There are no cookies, no long-lasting sessions, and no email links to steal. The paper claims this method is resistant to phishing, session hijacking, and "replay" attacks (where a bad guy records a message and plays it back later).

The Results: Fast, Accurate, and Tough

The researchers tested SSHafe in a real-world setting using a cloud computer (an Azure VM) that was left open to the internet. They also simulated attacks using a tool called Hydra and a list of 14.3 million common passwords.

The results were impressive. On their test data, the system achieved a detection accuracy of 99.96%. This means it caught almost every single attack attempt. In their live tests, the system identified and blocked the attackers in under 10 seconds. Even when the user's password was weak, the attackers couldn't get in because the system locked the account before the robot could guess it.

The paper also compared SSHafe to other methods. While older systems like Fail2Ban rely on simple rules (like "3 strikes and you're out"), SSHafe uses the complex rhythm of the attacks to catch them. The researchers found that their method had a precision of 100% in their tests, meaning it didn't accidentally lock out any innocent users (no false alarms).

Why This Matters

The paper argues that we need to move beyond simple rules and outdated recovery methods. The "old way" of blocking IPs or sending email links is like using a wooden shield against a laser sword; it doesn't work well against modern, automated robots. SSHafe offers a two-part solution: a smart guard that listens to the rhythm of the attack, and a new, secure way to change passwords that doesn't rely on vulnerable links or codes.

The researchers tested this on a modest cloud computer with just 2 vCPUs and 1 GB of memory, proving that this high-tech solution doesn't need a supercomputer to run. They even left the system running for two weeks, where it was naturally discovered and attacked by real hackers on the internet. The system successfully defended against these real-world attacks, keeping the accounts safe even when the credentials were weak.

In short, SSHafe shows that by combining a smart, rhythm-sensing detector with a secure, one-step password change, we can build a much stronger defense for our digital doors. It's a step toward a future where our servers don't just react to attacks, but outsmart them before they can even get a foot in the door.