Organizations commonly use SSH (Secure Shell) to provide encrypted remote access to Linux servers. SSH allows authorized users and administrators to log in remotely and manage server resources. Authentication activity generated by the SSH service provides important security information that can be used to identify suspicious login behavior.
An SSH server may receive repeated authentication attempts from an unauthorized source. If an attacker repeatedly attempts different passwords or credential combinations, the activity may indicate an SSH brute-force attack. Monitoring these authentication events is important for identifying suspicious access attempts and supporting timely security investigation.
Wazuh provides security monitoring capabilities that can collect and analyze authentication events from an Ubuntu Linux server. Its configured rules can identify supported authentication-related conditions, including repeated failed login attempts. However, authentication patterns may vary between environments, and additional anomaly analysis can be evaluated to determine whether it provides useful information beyond existing rule-based detection.
In this use case, an Ubuntu Linux virtual machine hosts the OpenSSH server, while Kali Linux is used as the security-testing environment. Wazuh collects the authentication logs generated by the Ubuntu server. Python and pandas process the collected records and extract numerical features such as failed login counts, authentication frequency, and other available account- or source-related activity.
The Local Outlier Factor (LOF) algorithm, implemented through the scikit-learn library, analyzes the extracted authentication features and identifies observations that differ from the local patterns represented in the reference data. A publicly available security-log or SSH-attack dataset is used for model development and evaluation, while controlled SSH login attempts from Kali Linux provide laboratory evidence for validating the monitoring workflow.
The model's results are compared with the authentication records, available Wazuh alerts, and controlled test activity. Streamlit is used to present suspicious authentication observations, relevant timestamps, available source information, and anomaly results in a dashboard. The findings are reviewed to determine whether the LOF model provides useful additional detection information.
Ubuntu SSH Server → SSH Authentication Activity → Wazuh Authentication Log Collection → Python Feature Extraction → Local Outlier Factor Analysis → Anomaly Identification → Wazuh Alert Correlation → Security Dashboard → Finding Validation → Security Assessment
Application/Service: OpenSSH Server on Ubuntu Linux
OpenSSH is the target remote-access service in this use case. It provides encrypted remote login and administration capabilities for the Ubuntu Linux server.
An SSH server may receive repeated login attempts from an unauthorized source. If authentication activity is not adequately monitored, repeated failures and unusual login patterns may be difficult to identify and prioritize for investigation.
Rule-based security monitoring can identify authentication conditions covered by configured detection rules. However, a fixed threshold may not represent every legitimate or suspicious authentication pattern. Additional analysis may help identify observations that differ from the reference behavior, although such observations are not automatically confirmed attacks.
The proposed solution introduces Wazuh authentication-log monitoring, Python-based log processing, authentication feature extraction, Local Outlier Factor analysis, correlation with existing Wazuh alerts, dashboard-based investigation, and detection-performance evaluation.
Specific Attack: SSH Brute-Force Attack
The controlled attack scenario evaluates whether repeated SSH authentication attempts against the authorized Ubuntu laboratory server can be observed in authentication logs and identified as unusual by the LOF-based analysis.
Kali Linux is used as the testing system, and Ubuntu runs the target SSH service. The test is restricted to an isolated laboratory environment and uses a designated test account.
The objective is to generate controlled authentication activity, verify that the relevant events are collected by Wazuh, and assess whether the extracted features enable LOF to identify unusual authentication patterns. The model's output is compared with the recorded activity and available Wazuh alerts.
Behavior-Based Authentication Anomaly Detection
The primary security concept is Behavior-Based Authentication Anomaly Detection combined with continuous security monitoring.
The approach analyzes authentication-related features to identify observations that differ from their local reference patterns. Local Outlier Factor estimates the local density of an observation relative to the density of its neighboring observations. It can therefore highlight unusual patterns within the prepared feature space.
Wazuh remains responsible for collecting and monitoring authentication events and generating alerts through its configured detection rules. Python and scikit-learn provide the additional anomaly-analysis stage. LOF results are correlated with the recorded authentication activity and Wazuh alerts rather than being treated as independent confirmation of a brute-force attack.
For scoring new authentication observations, LOF is configured for novelty detection and fitted to suitable reference data before new observations are evaluated. The selected features and preprocessing must remain consistent between model development and subsequent scoring.
The security concept defines the overall security strategy. The following are the specific defensive mechanisms implemented.
Wazuh collects and monitors authentication events generated by the Ubuntu SSH service.
LOF analyzes extracted authentication features and identifies observations that differ from their local reference patterns.
Wazuh's configured detection rules identify supported authentication-related conditions, including repeated failures where the relevant rules are enabled.
Python and pandas process authentication records and calculate suitable features from available log fields.
SSH configuration and account-access requirements are reviewed to reduce unnecessary access and strengthen authentication security.
Authentication records are reviewed for repeated failures against accounts and, where available, repeated activity from source addresses.
LOF results are compared with authentication records, controlled test activity, and available Wazuh alerts.
The model's results are evaluated against suitable reference labels or documented ground truth where available.
Suspicious observations are reviewed using available timestamps, authentication features, source information, and related alerts.
Authentication monitoring and controlled access tests are repeated after relevant SSH security improvements.
Wazuh is the primary security monitoring platform because it collects and analyzes supported authentication events from the Ubuntu SSH server and provides alerts through configured detection rules.
Local Outlier Factor is the machine learning algorithm used to identify observations that differ from their local reference patterns. The scikit-learn implementation supports novelty detection when configured and fitted appropriately for scoring new observations.
Python connects the authentication-log processing, feature extraction, model scoring, evaluation, and dashboard components.
pandas is used to clean, organize, transform, and aggregate authentication records before they are supplied to the LOF model.
The OpenSSH client is used from Kali Linux to generate controlled login attempts against the authorized Ubuntu SSH server.
OpenSSH Server provides the remote-access service being assessed and generates authentication-related events on the Ubuntu system.
Ubuntu provides the server environment hosting OpenSSH and generating authentication logs for Wazuh monitoring.
Kali Linux provides the controlled testing environment used to generate authorized SSH login attempts against the Ubuntu target.
Streamlit is used to present authentication activity and model outputs through a local security-monitoring dashboard.
A suitable publicly available dataset provides reference observations for model development and evaluation. The available fields and any supplied labels must be reviewed before deciding which features and evaluation metrics are appropriate.
VirtualBox provides the isolated laboratory infrastructure for the Ubuntu target and Kali Linux testing system.
The Ubuntu SSH server is configured as the authorized target for the continuous security-monitoring assessment.
Wazuh collects SSH authentication events and provides visibility into authentication-related alerts supported by its configured detection rules.
A publicly available security-log or SSH-attack dataset is prepared for model development and evaluation.
Python and pandas process authentication records and extract the numerical features required for Local Outlier Factor analysis.
The Local Outlier Factor model identifies authentication observations that differ from the local patterns represented in its reference data.
Controlled SSH login attempts from Kali Linux provide laboratory evidence for validating the authentication-monitoring and anomaly-analysis workflow.
LOF results are correlated with authentication records and available Wazuh alerts to support investigation of suspicious login activity.
The Streamlit dashboard presents relevant authentication information, anomaly classifications, available source details, and model evaluation results.
The detection evaluation documents the observed performance, false positives, and missed detections where suitable reference labels or ground truth are available.
The complete SSH Brute-Force Detection assessment, Wazuh authentication monitoring, LOF-based anomaly analysis, security-event correlation, dashboard presentation, and detection-performance evaluation workflow is demonstrated in the isolated laboratory environment.
Research Breakthrough Possible @S-Logix