SSH BruteForce Detector
An autonomous host-based intrusion prevention system (HIDS/IPS) that continuously inspects Linux authentication logs, detects multi-threaded SSH brute-force campaigns using sliding-window rate analysis, and instantly drops offending IPs at the kernel firewall level.
Project Overview
An autonomous host-based intrusion prevention system (HIDS/IPS) that continuously inspects Linux authentication logs, detects multi-threaded SSH brute-force campaigns using sliding-window rate analysis, and instantly drops offending IPs at the kernel firewall level.
Problem Statement
Internet-facing Linux hosts endure relentless SSH credential stuffing and dictionary attacks by distributed botnets. Relying solely on manual syslog review or delayed log processors leads to multi-hour detection windows during which compromise can occur. Traditional static firewall configurations cannot dynamically distinguish between legitimate authentication spikes and multi-threaded credential exhaustion campaigns.
Objectives & Scope
Project Objectives
- 01Stream and parse /var/log/auth.log events with sub-second latency via inotify
- 02Detect coordinated brute-force attempts using sliding-window event counters
- 03Autonomously inject and manage kernel-level iptables DROP rules
- 04Implement time-to-live (TTL) rule expirations to prevent permanent IP pollution
- 05Provide a clean SOC dashboard displaying active bans, event frequencies, and system telemetry
Scope & Boundary
Host-level defense for Linux servers running OpenSSH. Involves real-time log ingestion, sliding-window heuristics, automated iptables manipulation, and local SOC dashboard telemetry. Distributed multi-server synchronization and external threat feed enrichment are out of scope.
Threat Model & Requirements
Threat Model: Automated credential brute-force, dictionary attacks, and username enumeration targeting OpenSSH on exposed ports. Adversary profile: Multi-threaded attack scripts (Hydra, Medusa) executing high-concurrency connection floods. Assumptions: Host kernel and daemon process running as privileged root are uncompromised. Boundaries: Local host perimeter and network socket ingress.
Architecture
The architecture comprises four decoupled subsystems: (1) Log Ingestion Engine monitoring /var/log/auth.log via inotify; (2) Detection Engine maintaining time-indexed sliding buckets per IP; (3) Mitigation Engine interfacing with /sbin/iptables via subprocess execution with sanity validation; (4) Telemetry Web Interface serving status APIs and SOC dashboard views.
+-------------------------------------------------------------------+ | SSH BRUTE-FORCE DETECTOR PIPELINE | +-------------------------------------------------------------------+ | | | Attacking Bots Linux Kernel Daemon | | [Hydra/Botnet] ------------> [OpenSSH 22] | | | | | (Fail Event) | | v | | [/var/log/auth.log] | | | | | (inotify tail) | | v | | +-------------------------+ | | | Sliding Window Engine | | | | (Rate > Threshold in T) | | | +-------------------------+ | | | | | (Trip Signal) | | v | | [iptables Enforcement] | | | | | (Kernel DROP Rule) | | v | | [Netfilter INPUT Drop] | | | | | [Flask SOC Dashboard] | | | +-------------------------------------------------------------------+
SSH BruteForce Detector Architecture Decomposition
Autonomous host-based intrusion prevention daemon combining real-time Linux log streaming, sliding-window heuristics, and kernel-level iptables automation with multi-channel incident alerting.
HIDS / IPS Engine
Log Ingestion Pipeline
Linux inotify Streamer
Regex Tokenizer
Threat Analytics Engine
Sliding-Window Analyzer
Reputation Scoring
Kernel Remediation
iptables Netfilter Integration
Lease & Unban Daemon
Telemetry & Alerting
Webhook Dispatcher
SQLite Forensic Vault
Implementation
Engineered an autonomous host-based intrusion prevention system (HIDS/IPS) in Python. The daemon asynchronously tails /var/log/auth.log via kernel inotify events, parsing authentication failures in real time. It implements an in-memory sliding-window rate tracking algorithm that aggregates failure events by source IP. Upon threshold breach, the system executes kernel-level Netfilter/iptables DROP commands with automated expiration and ban lifecycles. A Flask-powered SOC monitoring dashboard visualizes blocked subnets, attempt velocity, and ban table telemetry.
Technologies & Rationale
Packet dropping at the kernel PREROUTING/INPUT hook prevents socket allocation overhead, denying attacker resources before transport-layer handshakes consume host memory.
Provides sub-millisecond reaction times upon log write events without polling disks, minimizing CPU overhead during heavy attack phases.
Maintains rolling time-window counters per IP to defeat both high-frequency bursts and low-and-slow threshold evasion tactics.
Delivers lightweight, dependency-minimal situational awareness for SOC operators to inspect live active bans, attack origins, and historical metrics.
Testing Methodology
Simulated high-concurrency attack patterns using Hydra, Medusa, and custom multi-threaded Python attack harnesses with varying thread pools (10 to 100 threads) and randomized source ports. Verified that bans triggered accurately within configured window thresholds (e.g., 5 failures in 60 seconds) with zero false-positives against valid key/password logins.
Results & Evidence
Observed mean detection-to-enforcement latency under 350ms. Dropping at the Netfilter layer reduced SSH daemon CPU consumption from 85% during sustained attack to baseline idle levels (<2%). Ban rules successfully expired and released after configured TTL intervals.
Limitations & Trade-offs
Single-host implementation without distributed ban propagation across fleets. IP-based blocking does not account for large residential proxy networks rotating single attempts across thousands of distinct IPs. Requires root privileges for iptables invocation.
Future Improvements
Transition from iptables to eBPF/XDP for microsecond packet drops before network stack traversal. Integration with Redis for multi-host ban mesh coordination. Dynamic threshold adaptation using baseline login frequency models.
Resources & Code
Repository URL: https://github.com/prajwalk-cyber/SSH-BruteForce-Detector