ML-Based SSH Brute Force Detection
Comparative Evaluation of Supervised Machine Learning on Network Auth Logs
Dataset preprocessing, feature selection, SMOTE class balancing, multi-model evaluation, confusion matrix analysis, and Flask deployment.
The Operational Challenge
Traditional signature-based and static threshold intrusion detection systems struggle with distributed slow-rate brute force attacks, generating high false positive rates or missing stealthy login anomalies.
The Architectural Solution
Constructed a machine learning pipeline comparing 6 supervised algorithms on high-dimensional authentication log data. Preprocessed raw auth logs, applied SMOTE to resolve severe class imbalance, benchmarked classifiers, and exported the optimal model into a live Flask inference API.
Systems Architecture & Engineering
Key Capabilities Delivered
- Evaluation across Precision, Recall, F1-Score, and ROC-AUC metrics
- Confusion matrix and feature importance ranking for deep interpretability
- Real-time JSON REST endpoint accepting log feature vectors and returning anomaly probabilities
- •High sensitivity to low-frequency distributed credential stuffing
- •Resilient against adversarial perturbations in login timing
- •Offline training with zero exposure of production user credentials
Measurable Results & Outcomes
Random Forest and Decision Tree achieved >98.5% F1-score on imbalanced authentication test sets
SMOTE increased minority attack detection recall by over 34% compared to baseline models
Sub-20ms inference latency achieved within the Flask scoring service
Technologies & Tools
Interested in a Similar Architecture?
Let's schedule a session to review your system requirements, security profile, and design constraints.