Some things you can learn from SSH traffic, (Wed, Apr 3rd)

This week, the SSH protocol made the news due to the now infamous xz-utils backdoor. One of my favorite detection techniques is network traffic analysis. Protocols like SSH make this, first of all, more difficult. However, as I did show in the discussion of SSH identification strings earlier this year, some information is still to be gained from SSH traffic [1].

Article Link: Some things you can learn from SSH traffic - SANS Internet Storm Center

1 post - 1 …

analysis backdoor can detection identification learn network network traffic network traffic analysis protocol protocols ssh ssh protocol strings techniques things traffic traffic analysis week