Abstract:
Cloud computing has enabled organizations to run their workloads on multi node clusters in different private and public cloud service providers (CSPs).
Most nodes run some distribution of Linux which is accessed through Secure
Shell (SSH). The infrastructure is not only accessed by the engineering team
members, but also by automated scripts and bots that help manage those
machines. This study formulates a machine learning based technique to
classify those SSH sessions into Malicious and Benign by solely using the
commands executed in the shell. Thus, this research will help identify any
malicious insider in an engineering team or a compromised automation script
or bot that was written to help manage that infrastructure. This study also
provides a capability to help reduce the damage done by those malign entities
by timely notifying the security personnel.
