SSHafe: A Real-Time SSH Brute Force Attack Detection and Novel Credential Rotation Standard
2026-08-10 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors developed SSHafe, a system that watches SSH login attempts to quickly spot and stop brute-force attacks, which try many passwords to break in. Unlike older methods, SSHafe uses smart timing-based features and a machine learning model to detect suspicious activity almost perfectly. When an attack is detected, it blocks the user account and offers a safer way for users to reset their passwords without using risky methods like emails or codes. Tests showed SSHafe can stop attacks in about ten seconds, protecting accounts even if passwords are weak.
SSHbrute-force attackmachine learningLightGBMauthentication logspassword resetcybersecurityfail2banphishingcredential stuffing
Authors
Aditya Mitra, Amar Kumar Mandal, Amaan Rais Shah, Iqra Naz, E. Fatih Yetkin, Tuğçe Ballı
Abstract
SSH remains a critical yet heavily targeted protocol for remote system administration, with password-based authentication exposing servers to large-scale brute-force, dictionary, and credential-spray attacks. Existing rule-based defences such as Fail2Ban fail to detect slow, distributed, or threshold-aware adversaries, while conventional account-recovery mechanisms: email links, OTPs, and out-of-band verification introduce additional vulnerabilities including phishing, session hijacking, and weak authentication binding. This work presents SSHafe, a real-time SSH brute-force detection and mitigation system that combines time-series feature engineering with a lightweight LightGBM classifier to identify attack patterns directly from system authentication logs. A multi-scale sliding-window approach extracts behavioural features such as attempt rates, inter-arrival times, failure ratios, and username diversity, enabling the model to achieve a detection accuracy of 99.96% on benchmark data and strong performance on unlabeled real-world traffic. Upon detecting an attack, SSHafe automatically blocks the targeted user account and delivers an SSH banner guiding legitimate users to a novel passkey-based password-rotation workflow. The proposed novel password reset standard performs authentication and password update in a single cryptographically bound flow, eliminating the need for sessions, cookies, OTPs, or email-based verification, and mitigating phishing, session hijacking, CSRF, and replay attacks. Experiments on an Azure VM and live adversarial traffic demonstrate that SSHafe can identify and suppress brute-force activity within ten seconds, preventing account compromise even with weak credentials.