Generation of SSH Network Traffic Data for IDS Testbeds

Authors: 

Hristo Djidjev, Los Alamos National Laboratory; Lyudmil Aleksandrov, Institute of Information and Communication Technologies, Bulgaria

Abstract: 

We develop an algorithm for generating secure shell (ssh) network traffic that can find use as a part of a testbed for evaluating anomaly detection and intrusion detection systems in cyber security. Given an initial dataset describing real network traffic, the generator produces synthetic traffic with characteristics close to the original. The objective is to match parameters of the original traffic such as traffic volumes, session durations, diurnal patterns, and relationships between hosts in terms of communicating pairs and subsets.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

Presentation Audio

Djidjev PDF
BibTeX
@inproceedings {179213,
author = {Hristo Djidjev and Lyudmil Aleksandrov},
title = {Generation of {SSH} Network Traffic Data for {IDS} Testbeds},
booktitle = {Presented as part of the 6th Workshop on Cyber Security Experimentation and Test},
year = {2013},
address = {Washington, D.C.},
url = {https://www.usenix.org/conference/cset13/workshop-program/presentation/Djidjev},
publisher = {{USENIX}},
}
Download