Organizations commonly use Secure Shell (SSH) to remotely access, administer, and manage Linux servers. OpenSSH Server provides SSH authentication functionality and records authentication-related events that can be used for security monitoring and incident investigation.
SSH authentication logs contain information about login attempts, authentication failures, successful logins, usernames, timestamps, and source addresses where these details are recorded. Repeated failed authentication attempts may indicate a brute-force attack, in which an attacker attempts to discover valid credentials by repeatedly trying to authenticate to an SSH service.
If SSH authentication activity is not monitored effectively, suspicious login patterns may remain unnoticed among legitimate authentication failures and other routine system events. Manually examining large volumes of authentication logs can also make it difficult to correlate related events and reconstruct the sequence of a potential attack.
In this use case, an Ubuntu OpenSSH Server is deployed in an isolated cybersecurity laboratory. Kali Linux is used as the security-testing environment to generate legitimate SSH activity and perform a controlled SSH brute-force attack against the authorized Ubuntu server.
An existing public SSH authentication-log dataset is used as the data source for the machine-learning stage. The dataset is inspected to determine whether it contains suitable normal and brute-force-related records, usable classification labels, and features compatible with the proposed model. The selected records are processed and transformed into numerical features for training.
Multinomial Naive Bayes is used to classify authentication-log records according to the categories supported by the selected dataset. The trained model is then evaluated against held-out records and tested with authentication logs collected during the controlled laboratory attack.
A Python-based log-analysis workflow correlates related authentication events using available information such as timestamps, source IP addresses, usernames, and authentication outcomes. SQLite is used to store relevant log evidence, classification results, correlated events, and investigation records.
Gemma 2 2B Instruct is executed locally through Ollama to analyze the correlated evidence and generate an incident summary, possible root-cause explanations, and recommended investigation steps. The generated report is verified against the original authentication logs to ensure that the conclusions are supported by the collected evidence.
Application/Service: OpenSSH Server
OpenSSH Server is the target SSH service in this use case. It provides remote authentication functionality and generates authentication-related log records that can be examined during security monitoring and investigation.
The server is deployed on Ubuntu Linux within the authorized laboratory environment. Kali Linux is used to perform controlled SSH authentication testing against this server.
SSH services may receive repeated authentication attempts from unauthorized sources. When an attacker attempts to guess credentials through repeated login attempts, the resulting activity may generate numerous authentication failures.
However, authentication failures can also occur because of legitimate mistakes, outdated credentials, or incorrectly configured applications. Therefore, individual failed-login records cannot always establish whether an attack is occurring.
Traditional investigation may depend on manually examining logs or using predefined rules and fixed thresholds. These approaches can be useful, but they may require additional analysis when authentication events occur in different sequences or when legitimate and suspicious activity share similar characteristics.
The proposed solution introduces public-dataset-based model training, authentication-log classification, event correlation, evidence storage, LLM-assisted incident investigation, and detection-performance validation.
Specific Attack: Controlled SSH Brute-Force Attack
The controlled attack scenario evaluates whether repeated SSH authentication attempts against an Ubuntu OpenSSH Server can be recorded, analyzed, and identified by the proposed machine-learning-based detection workflow.
Kali Linux is used as the authorized security-testing machine, while Ubuntu hosts the target OpenSSH Server.
The attack simulation is restricted to the isolated VirtualBox laboratory. It uses a dedicated laboratory account and controlled authentication attempts rather than targeting external servers or third-party accounts.
The objective is to generate authentication-log evidence associated with the known test activity. The resulting records are processed by the trained Multinomial Naive Bayes model and correlated to support incident investigation.
The assessment also evaluates whether Gemma 2 2B Instruct can produce a useful incident summary from the collected evidence without introducing unsupported conclusions.
Machine Learning-Based Authentication Log Classification and LLM-Assisted Incident Investigation
The primary security concept is Machine Learning-Based Authentication Log Classification combined with LLM-Assisted Security Incident Investigation.
The first objective is to establish a suitable classification model using an existing public SSH authentication-log dataset. The selected records are processed into numerical features compatible with Multinomial Naive Bayes.
The second objective is to analyze authentication records generated by the controlled SSH brute-force simulation. The trained model classifies the captured records, and the investigation workflow correlates related events using the available authentication information.
The third objective is to use Gemma 2 2B Instruct to summarize the correlated evidence, reconstruct the observed incident timeline, and provide possible explanations that can be verified against the original logs.
The security concept defines the overall security strategy.
The following are the specific defensive mechanisms implemented.
Authentication records are collected from the Ubuntu OpenSSH Server during legitimate activity and controlled attack simulation.
An existing public authentication-log dataset is inspected and processed to prepare suitable training records.
The trained model classifies authentication-log records using the feature representation established during training.
Related authentication events are grouped using available timestamps, source IP addresses, usernames, and authentication outcomes.
The authentication records generated during the controlled SSH brute-force simulation are compared with the known testing activity.
Correlated authentication events are arranged chronologically to establish the progression of the observed activity.
Authentication records, ML predictions, correlation results, and investigation reports are stored in SQLite.
Gemma 2 2B Instruct analyzes the correlated evidence and generates an incident summary with possible explanations.
The generated incident summary is compared with the original authentication logs and known laboratory test conditions.
The ML predictions are evaluated against suitable known labels and controlled test results.
OpenSSH Server provides the SSH authentication environment being assessed.
Kali Linux provides the controlled security-testing environment.
Ubuntu provides the target server environment and supports the authentication-log analysis workflow.
VirtualBox provides the isolated laboratory infrastructure.
Python provides the main implementation environment for the detection and investigation workflow.
Scikit-learn provides the Multinomial Naive Bayes implementation and classification-evaluation utilities.
Pandas is used to load, filter, and organize the public dataset and collected authentication records.
NumPy supports numerical operations required for feature preparation and model processing.
CountVectorizer can transform suitable labelled authentication-log text into non-negative token-count features for Multinomial Naive Bayes.
Ollama provides the local execution environment for the selected language model.
Gemma 2 2B Instruct provides the LLM-assisted incident investigation capability.
SQLite provides the local database used to organize the investigation evidence.
Scikit-learn metrics support quantitative model evaluation.
An OpenSSH Server is successfully deployed on an Ubuntu virtual machine within an isolated cybersecurity laboratory for controlled SSH authentication testing.
The authentication logging behavior of the target server is validated using legitimate login operations and controlled failed-login tests, establishing the initial authentication evidence baseline.
An existing public SSH authentication-log dataset is inspected and processed to determine whether it supports the proposed Multinomial Naive Bayes classification task.
The selected dataset is transformed into numerical features, and the classification model is trained using the verified labels available in the public records.
The initial model performance is evaluated using held-out test data, providing measurable results for classification effectiveness and identifying false positives and false negatives.
A controlled SSH brute-force attack is performed from Kali Linux against the authorized Ubuntu OpenSSH Server, generating authentication records for the practical detection experiment.
The captured authentication records are processed using the established feature-extraction pipeline, allowing the trained model to classify compatible laboratory-generated log records.
Related authentication events are correlated using available timestamps, source addresses, usernames, and authentication outcomes, producing an evidence-based timeline of the observed activity.
SQLite stores the relevant authentication records, model predictions, correlated events, and investigation results in a structured format.
Gemma 2 2B Instruct analyzes the correlated evidence and generates a readable incident summary containing the observed activity, possible explanations, and recommended investigation steps.
The generated incident report is verified against the original authentication logs to identify unsupported conclusions and preserve the distinction between observed evidence and possible causes.
The classification results, event-correlation quality, and incident-report accuracy are evaluated using the available ground truth and controlled laboratory testing evidence.
The complete workflow of public dataset preparation, machine-learning training, SSH brute-force simulation, authentication log collection, ML classification, event correlation, evidence storage, LLM-assisted investigation, and final detection validation is demonstrated.
The final project provides a practical AI for Cybersecurity implementation that combines machine-learning-based authentication log classification with LLM-assisted security incident investigation, while documenting the detection limitations and data-compatibility requirements that affect real-world deployment.
Research Breakthrough Possible @S-Logix