{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,27]],"date-time":"2026-08-27T23:56:41Z","timestamp":1787875001311,"version":"build-2784847793"},"reference-count":9,"publisher":"Association for Computing Machinery (ACM)","issue":"5","license":[{"start":{"date-parts":[[2014,10,10]],"date-time":"2014-10-10T00:00:00Z","timestamp":1412899200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGCOMM Comput. Commun. Rev."],"published-print":{"date-parts":[[2014,10,10]]},"abstract":"<jats:p>Flow-based approaches for SSH intrusion detection have been developed to overcome the scalability issues of host-based alternatives. Although the detection of many SSH attacks in a flow-based fashion is fairly straightforward, no insight is typically provided in whether an attack was successful. We address this shortcoming by presenting a detection algorithm for the flow-based detection of compromises, i.e., hosts that have been compromised during an attack. Our algorithm has been implemented as part of our open-source IDS SSHCure and validated using almost 100 servers, workstations and honeypots, featuring an accuracy close to 100%.<\/jats:p>","DOI":"10.1145\/2677046.2677050","type":"journal-article","created":{"date-parts":[[2014,10,14]],"date-time":"2014-10-14T12:29:11Z","timestamp":1413289751000},"page":"20-26","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":53,"title":["SSH Compromise Detection using NetFlow\/IPFIX"],"prefix":"10.1145","volume":"44","author":[{"given":"Rick","family":"Hofstede","sequence":"first","affiliation":[{"name":"University of Twente, Enschede, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Luuk","family":"Hendriks","sequence":"additional","affiliation":[{"name":"University of Twente, Enschede, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Anna","family":"Sperotto","sequence":"additional","affiliation":[{"name":"University of Twente, Enschede, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aiko","family":"Pras","sequence":"additional","affiliation":[{"name":"University of Twente, Enschede, Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2014,10,10]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"crossref","unstructured":"B. Claise B. Trammell and P. Aitken. Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information. RFC 7011 (Internet Standard) September 2013.  B. Claise B. Trammell and P. Aitken. Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information. RFC 7011 (Internet Standard) September 2013.","DOI":"10.17487\/rfc7015"},{"key":"e_1_2_1_2_1","volume-title":"Proceedings of EUNICE'13","author":"M.","year":"2013"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-30633-4_11"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2014.2321898"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516719"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04989-7_13"},{"key":"e_1_2_1_7_1","volume-title":"Vena","author":"Inc. Ponemon","year":"2014"},{"key":"e_1_2_1_8_1","volume-title":"Brno","author":"Vykopal J.","year":"2013"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICFN.2009.36"}],"container-title":["ACM SIGCOMM Computer Communication Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2677046.2677050","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2677046.2677050","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T06:11:56Z","timestamp":1750227116000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2677046.2677050"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,10,10]]},"references-count":9,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2014,10,10]]}},"alternative-id":["10.1145\/2677046.2677050"],"URL":"https:\/\/doi.org\/10.1145\/2677046.2677050","relation":{},"ISSN":["0146-4833"],"issn-type":[{"value":"0146-4833","type":"print"}],"subject":[],"published":{"date-parts":[[2014,10,10]]},"assertion":[{"value":"2014-10-10","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}