SSH Attack Detector: Live Demo
What does this do?
Every time someone tries to log in to a Linux server, the server writes a line in a log file. Attackers often try to break in by guessing passwords over and over with automated tools. This tool reads that log and spots three common password-guessing patterns, the same way a security analyst would.
It only raises an alarm when attempts are packed into a short burst (5 minutes), so a person mistyping their password now and then isn't mistaken for an attack.
What do these terms mean?
- Log file
- A diary the server keeps automatically, with one line for every login attempt.
- SSH
- The standard way to log in to a Linux server remotely. It's a common target because it's usually exposed to the internet.
- IP address
- A number that identifies a computer on the internet, like a return address on an envelope.
- Account / username
- The name being logged in as. Attackers love common ones like
rootandadmin. - Time window
- How close together attempts must be to count as one attack. Here it's 5 minutes.
- MITRE ATT&CK
- A free, public catalog of hacker techniques that security teams use as a shared vocabulary. Each finding links to its entry.
The example data uses IP addresses reserved for documentation, so none of them belong to real computers.