Cybersecurity Research

Live Detection and Mitigation for SSH Brute-Force Attacks

Co-authored and experimentally evaluated a layered SSH defense framework for Ubuntu Server combining proactive service concealment, live packet inspection, rate limiting and automated blocking. The controlled testbed demonstrated suspicious SSH activity detection within approximately 2–3 seconds while maintaining a lightweight, practical defense-in-depth design.

Ubuntu ServerKali LinuxPythonPySharkWiresharkPort KnockingIPTablesFail2BanNmapHydra

01 / Research Objective

Detect SSH attacks earlier through coordinated defensive layers.

The research addresses the limitations of relying on a single control. The proposed design combines proactive attack-surface reduction, live packet analysis and reactive blocking so reconnaissance, repeated connection attempts and persistent brute-force activity are handled at different stages.

2–3 secObserved detection

4Defensive layers

Real-timePacket inspection

LowResource overhead

ControlledVirtual testbed

02 / Defense Architecture

Conceal, detect, throttle and block.

The framework coordinates four complementary mechanisms rather than depending on a single detection or prevention tool.

01 / Proactive

Port Knocking

Keeps SSH hidden from unauthorized scans and exposes the service only after the expected knock sequence.

02 / Real-time

Python + PyShark

Inspects live TCP connection attempts and flags suspicious SSH patterns before log-only controls react.

03 / Network

IPTables

Rate-limits repeated connection attempts and drops traffic from persistent sources.

04 / Reactive

Fail2Ban

Monitors authentication failures and applies additional bans against repeated login attempts.

Published SSH defense workflow diagram — Published workflow showing the coordinated SSH defense architecture.

03 / Detection Logic

Live packet analysis before traditional log-based response.

The custom detector uses Python and PyShark to inspect new SSH connection attempts. In the published test configuration, five attempts from the same source within ten seconds trigger terminal and email alerts, providing an early warning before the follow-up blocking layers are reached.

Live TCP SYN inspection targeting SSH
Time-based source threshold
Terminal alert generation
Email notification to the administrator

Published terminal output from the live SSH detection script — Published terminal output from the real-time PyShark detection test.

04 / Controlled Testbed

Baseline and hardened Ubuntu environments tested under the same attack workflow.

The isolated virtual testbed used Ubuntu Server 24.04.2 LTS as the target and Kali Linux 2023.4 as the attacking host. Nmap was used for port scanning and Hydra for SSH brute-force simulation, allowing the unprotected baseline and layered defense to be compared directly.

Published comparison of unprotected and protected SSH scan results — Published scan evidence: exposed SSH in the baseline test versus filtered SSH after hardening.

05 / Validated Results

Each stage of the simulated attack was met by a different control.

In the hardened test, Port Knocking concealed SSH from the initial scan. After the concealment layer was manually bypassed for testing, the PyShark detector identified the suspicious pattern within approximately 2–3 seconds and generated terminal and email alerts. IPTables then throttled repeated attempts, while Fail2Ban provided additional application-level blocking.

SSH hidden from initial Nmap reconnaissance
Suspicious activity detected in approximately 2–3 seconds
Terminal and email alerts generated
Rate limiting reduced repeated connection attempts
Fail2Ban applied additional blocking

Published email alert IPTables and Fail2Ban mitigation evidence — Published mitigation evidence showing alerting, rate limiting and Fail2Ban response.

06 / Research Outcome

A lightweight defense-in-depth approach for SSH protection.

The evaluation showed that established open-source controls can be coordinated into a practical SSH defense architecture combining attack-surface reduction, early packet-level detection and automated mitigation without relying on a computationally heavy machine-learning IDS.

View Research View Certificate

My contribution

Research and experimental contribution.

Co-authored the SSH defense-in-depth research
Contributed to the design and evaluation of the multi-layer security approach
Participated in controlled attack simulation and validation
Analyzed the interaction between proactive, real-time and reactive controls
Contributed to documenting the methodology, results and research conclusions

Co-authored with Nael Zahreldine, Ahmad Hani El Fawal, Dani Merhi Bleik and Ali Mansour.

Continue exploringView all projects →