System update
On Tuesday, August 18th, between 12-1pm, a planned system update of DiVA will take place. During this time, DiVA will not be available.
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Detection of SSH Brute-Force Attacks Using Machine Learning: A Comparative Study with Fail2Ban and PAM Tally2
University West, Department of Engineering Science.
University West, Department of Engineering Science.
2025 (English)Independent thesis Advanced level (degree of Master (One Year)), 10 credits / 15 HE creditsStudent thesis
Abstract [en]

This study looks at how traditional tools and machine learning models compare when it comes to spotting brute-force attacks onSSH servers. Tools like Fail2Ban and PAM Tally2 are commonly used, but they depend on fixed rules and often miss slow or spread-out attacks. To improve this, a machine learning model was built using real SSH login data. It focused on patterns like failed login attempts, unusual usernames, and how ports were being used. The model performed well, reaching 90% accuracy, with a precision of 0.89 and a recall of 0.97. When the same dataset was tested with Fail2Ban and PAM Tally2, these tools were able to catch aggressive attacks but also flagged more false positives and missed less obvious ones. Real examples showed that the machine learning model was better at finding tricky attack patterns while letting legitimate users log in without trouble. The results suggest that using both machine learning and traditional tools together can create a stronger, more flexible defense against brute-force attacks.

Place, publisher, year, edition, pages
2025. , p. 60
Keywords [en]
Cybersecurity, SSH Brute-force attack, Machine learning, Fail2ban, PAM TALLY2
National Category
Computer Systems
Identifiers
URN: urn:nbn:se:hv:diva-23725Local ID: EXD600OAI: oai:DiVA.org:hv-23725DiVA, id: diva2:1981478
Subject / course
Computer engineering
Educational program
Master in Cybersecurity
Supervisors
Examiners
Available from: 2025-07-22 Created: 2025-07-04 Last updated: 2025-09-30Bibliographically approved

Open Access in DiVA

fulltext(497 kB)1016 downloads
File information
File name FULLTEXT01.pdfFile size 497 kBChecksum SHA-512
f50ce22ce98c0fd35700790eab7bbadbb1942b45187448452da3775bfc6cf8c9cd74ac459d86e07c7b24581b1a39e957e429d4d5df0a231f5d65d0b3419f52c6
Type fulltextMimetype application/pdf

By organisation
Department of Engineering Science
Computer Systems

Search outside of DiVA

GoogleGoogle Scholar
Total: 1018 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

urn-nbn

Altmetric score

urn-nbn
Total: 2081 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf