Proposta de identificação de ataques ao serviço SSH usando padrões no consumo de corrente em plataformas embarcadas

Abstract

This paper presents the obtaining of electric power consumption curves, from the responses generated by an embedded low-cost Raspberry Pi 2 Model B system running the Linux operating system Raspbian working as a remote access server SSH, which is assessed through different types of access and brute force attacks dictionaries through specialized tools Medusa and Hydra, as well as the tool Metasploit unspecialized. The energy behavior is interpreted by a current consumption measurement system developed by low embedded platform cost Arduino Uno that runs a current sensor based on ACS721ELC-5A Hall effect chip, which has the ability to collect the variations generated by the platform test in response to events produced by the proposed test scenarios, the data is processed by the framework Matlab that collects, parses and normalizes using the Welch method, the current signal which is interpreted by Arduino Uno subsequently presents a standard curve It features a particular event based on scenarios of evidence. The results show the different curves standard patterns, and contextualized on the types of scenarios evaluated subsequently presents a theoretical mathematical model of the proposed power consumption, as well as rules or signatures proposed to identify an attack using the detection method of standards used IDS Snort. These current curves facilitate understanding and obtaining a pattern of current consumption for each access and attack the embedded platform.