Active and Passive Collection of SSH Key Material for Cyber Threat Intelligence

Active and Passive Collection of SSH Key Material for Cyber Threat Intelligence

연구 분야: Safety

학회: Digital Threats: Research and Practice (DTRAP), Volume 3, Issue 3

This article describes a system for storing historical forensic artifacts collected from SSH connections. This system exposes a REST API in a similar fashion as passive DNS databases, malware hash registries, and SSL notaries with the goal of supporting incident investigations and monitoring of infrastructure.