These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
As the digital landscape evolves, cybersecurity has become an indispensable
focus of IT systems. Its ever-escalating challenges have amplified the
importance of digital forensics, particularly in the analysis of heap dumps
from main memory. In this context, the Secure Shell protocol (SSH) designed for
encrypted communications, serves as both a safeguard and a potential veil for
malicious activities. This research project focuses on predicting SSH keys in
OpenSSH memory dumps, aiming to enhance protective measures against illicit
access and enable the development of advanced security frameworks or tools like
honeypots. This Masterarbeit is situated within the broader SmartVMI project,
and seeks to build upon existing research on key prediction in OpenSSH heap
dumps. Utilizing machine learning (ML) and deep learning models, the study aims
to refine features for embedding techniques and explore innovative methods for
effective key detection based on recent advancements in Knowledge Graph and ML.
The objective is to accurately predict the presence and location of SSH keys
within memory dumps. This work builds upon, and aims to enhance, the
foundations laid by SSHkex and SmartKex, enriching both the methodology and the
results of the original research while exploring the untapped potential of
newly proposed approaches. The current thesis dives into memory graph
modelization from raw binary heap dump files. Each memory graph can support a
range of embeddings that can be used directly for model training, through the
use of classic ML models and graph neural network. It offers an in-depth
discussion on the current state-of-the-art in key prediction for OpenSSH memory
dumps, research questions, experimental setups, programs development, results
as well as discussing potential future directions.
External Datasets
OpenSSH memory dumps dataset
Cleaned Heap Dumps Dataset
Original Heap Dumps Dataset
References
SSHkex
SmartKex
Analysis of SSH Honeypot Effectiveness
Command and logs of the C-library version used for the dataset generation
Command and logs of the Linux Standard Base Release used for the dataset generation
Command and logs of the OS and kernel version used for the dataset generation