{"id":"https://openalex.org/W2158880761","doi":"https://doi.org/10.1145/2508859.2516719","title":"Detecting stealthy, distributed SSH brute-forcing","display_name":"Detecting stealthy, distributed SSH brute-forcing","publication_year":2013,"publication_date":"2013-01-01","ids":{"openalex":"https://openalex.org/W2158880761","doi":"https://doi.org/10.1145/2508859.2516719","mag":"2158880761"},"language":"en","primary_location":{"id":"doi:10.1145/2508859.2516719","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2508859.2516719","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security - CCS '13","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5059146127","display_name":"Mobin Javed","orcid":"https://orcid.org/0000-0002-1321-1988"},"institutions":[{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mobin Javed","raw_affiliation_strings":["U.C. Berkeley, Berkeley, California, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"U.C. Berkeley, Berkeley, California, USA","institution_ids":["https://openalex.org/I95457486"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5002219113","display_name":"Vern Paxson","orcid":"https://orcid.org/0009-0005-2673-543X"},"institutions":[{"id":"https://openalex.org/I1297971548","display_name":"International Computer Science Institute","ror":"https://ror.org/01ewh7m12","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I1297971548"]},{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Vern Paxson","raw_affiliation_strings":["U.C. Berkeley, International Computer Science Institute, Berkeley, California, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"U.C. Berkeley, International Computer Science Institute, Berkeley, California, USA","institution_ids":["https://openalex.org/I1297971548","https://openalex.org/I95457486"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":28.3688,"has_fulltext":false,"cited_by_count":77,"citation_normalized_percentile":{"value":0.9955225,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":93,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"85","last_page":"96"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11838","display_name":"Crime, Illicit Activities, and Governance","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11838","display_name":"Crime, Illicit Activities, and Governance","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.996399998664856,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9958000183105469,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.7069554328918457},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6884023547172546},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.459751158952713},{"id":"https://openalex.org/keywords/forcing","display_name":"Forcing (mathematics)","score":0.4508481025695801},{"id":"https://openalex.org/keywords/interval","display_name":"Interval (graph theory)","score":0.44402840733528137},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.43095964193344116},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.35641932487487793},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.1435571014881134},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.12886080145835876}],"concepts":[{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.7069554328918457},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6884023547172546},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.459751158952713},{"id":"https://openalex.org/C197115733","wikidata":"https://www.wikidata.org/wiki/Q1003136","display_name":"Forcing (mathematics)","level":2,"score":0.4508481025695801},{"id":"https://openalex.org/C2778067643","wikidata":"https://www.wikidata.org/wiki/Q166507","display_name":"Interval (graph theory)","level":2,"score":0.44402840733528137},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.43095964193344116},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.35641932487487793},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.1435571014881134},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.12886080145835876},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C114614502","wikidata":"https://www.wikidata.org/wiki/Q76592","display_name":"Combinatorics","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/2508859.2516719","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2508859.2516719","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security - CCS '13","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.392.1199","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.392.1199","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.icir.org/vern/papers/dist-ssh-det.ccs13.pdf","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.6399999856948853,"id":"https://metadata.un.org/sdg/10","display_name":"Reduced inequalities"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":10,"referenced_works":["https://openalex.org/W180886567","https://openalex.org/W1649901946","https://openalex.org/W1672660286","https://openalex.org/W2056821499","https://openalex.org/W2094013156","https://openalex.org/W2121904442","https://openalex.org/W2122803863","https://openalex.org/W2127273221","https://openalex.org/W2147514835","https://openalex.org/W4285719527"],"related_works":["https://openalex.org/W1557094818","https://openalex.org/W2183246718","https://openalex.org/W2099261052","https://openalex.org/W2971214053","https://openalex.org/W3209204065","https://openalex.org/W2021517900","https://openalex.org/W1755711892","https://openalex.org/W2060606417","https://openalex.org/W2160907113","https://openalex.org/W2045623209"],"abstract_inverted_index":{"In":[0],"this":[1,64],"work":[2],"we":[3,78,114,163],"propose":[4],"a":[5,21,35,42,90,98,132,154],"general":[6],"approach":[7,28,65],"for":[8],"detecting":[9,70],"distributed":[10,43,72,119],"malicious":[11],"activity":[12],"in":[13,20,34,45,125],"which":[14,50,93,144],"individual":[15],"attack":[16,44],"sources":[17,51],"each":[18],"operate":[19],"stealthy,":[22],"low-profile":[23],"manner.":[24],"We":[25,62],"base":[26],"our":[27],"on":[29],"observing":[30],"statistically":[31],"significant":[32],"changes":[33],"parameter":[36],"that":[37,54,77,100,167,178],"summarizes":[38],"aggregate":[39],"activity,":[40,75],"bracketing":[41],"time,":[46],"and":[47],"then":[48],"determining":[49],"present":[52],"during":[53],"interval":[55],"appear":[56],"to":[57,66,87,96,150],"have":[58],"coordinated":[59],"their":[60],"activity.":[61],"apply":[63],"the":[67,81,112,116,141,157,170],"problem":[68],"of":[69,83,106,118,123,140,143,156],"stealthy":[71],"SSH":[73,137],"bruteforcing":[74],"showing":[76],"can":[79],"model":[80],"process":[82],"legitimate":[84],"users":[85],"failing":[86],"authenticate":[88],"using":[89],"beta-binomial":[91],"distribution,":[92],"enables":[94],"us":[95],"tune":[97],"detector":[99,113],"trades":[101],"off":[102],"an":[103,126],"expected":[104],"level":[105],"false":[107],"positives":[108],"versus":[109],"time-to-detection.":[110],"Using":[111],"study":[115],"prevalence":[117],"bruteforcing,":[120],"finding":[121],"dozens":[122],"instances":[124],"extensive":[127],"8-year":[128],"dataset":[129],"collected":[130],"from":[131],"site":[133],"with":[134],"several":[135],"thousand":[136],"users.":[138],"Many":[139],"attacks---some":[142],"last":[145],"months---would":[146],"be":[147],"quite":[148],"difficult":[149],"detect":[151],"individually.":[152],"While":[153],"number":[155],"attacks":[158,166,177],"reflect":[159],"indiscriminant":[160],"global":[161],"probing,":[162],"also":[164],"find":[165],"targeted":[168],"only":[169],"local":[171],"site,":[172],"as":[173,175],"well":[174],"occasional":[176],"succeeded.":[179]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":10},{"year":2023,"cited_by_count":5},{"year":2022,"cited_by_count":7},{"year":2021,"cited_by_count":7},{"year":2020,"cited_by_count":7},{"year":2019,"cited_by_count":5},{"year":2018,"cited_by_count":6},{"year":2017,"cited_by_count":3},{"year":2016,"cited_by_count":10},{"year":2015,"cited_by_count":5},{"year":2014,"cited_by_count":5}],"updated_date":"2026-08-26T07:47:46.906454","created_date":"2025-10-10T00:00:00"}