Detection of Malicious SSH Sessions: A Machine Learning Approach

Abstract

Cloud computing has enabled organizations to run their workloads on multi node clusters in different private and public cloud service providers (CSPs). Most nodes run some distribution of Linux which is accessed through Secure Shell (SSH). The infrastructure is not only accessed by the engineering team members, but also by automated scripts and bots that help manage those machines. This study formulates a machine learning based technique to classify those SSH sessions into Malicious and Benign by solely using the commands executed in the shell. Thus, this research will help identify any malicious insider in an engineering team or a compromised automation script or bot that was written to help manage that infrastructure. This study also provides a capability to help reduce the damage done by those malign entities by timely notifying the security personnel.