Correlation theory: distributed SSH brute force attempts

Hey folks,
I'm currently mulling over something mentioned in this article:

http://isc.sans.org/diary.html?storyid=5047

Specifically:

We continue to see ssh brute force password guessing attempts.
Occasionally we see large increases. We have seen the attacks switch
from one host attempting lots of passwords to lots of hosts that appear
to share a dictionary attempting a few password username combinations
(coordinated and distributed). 
That was the direct result of limiting the number of times an ip could
attempt to login
(fail2ban, bruteforceblocker, denyhosts, sshdfilter, pam_abi, ...).
So the cyberwar arm's race continues with the bad guys developing tools
and methods to get around common mitigation methods. 

I suspect that this can be detected via a variation of a scan.
Currently, we have:
*  Eventscan:  One host playing multiple events against another host
(common source, target)
*  Eventsweep:  One host playing the same type of event against multiple
hosts (common source, event type)
*  Eventstorm:  One host playing a large amount of events (common
source)
All of these work well when a single host is generating all of the
traffic, but based on the above we know that the bad guys are taking
measures to frustrate things like this.  So, a straight-forward solution
to this particular issue:
*  Distributed Eventscan:  Multiple hosts playing the same type of event
against a single host (common event type, target)
This works great for things like brute force attempts and DDOS (where
all of the traffic looks alike), and has a low chance of showing false
positives, but not as well for things like distributed vulnerability
scans (which are a possibility, and representative of a class of events
that we may not have seen yet).
So, another possibility:
*  Distributed Eventstorm:  Multiple events against a single host
(common target)
This would detect a wider range of these types of distributed events,
but be *far* more prone to false positives.
Ideas?

- Ramon
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user