Publication details

Flow-based detection of RDP brute-force attacks



Year of publication 2013
Type Article in Proceedings
Conference Security and Protection of Information 2013
MU Faculty or unit

Institute of Computer Science

Field Informatics
Keywords Remote Desktop Protocol; RDP; brute-force attack; intrusion detection; NetFlow; NfSen; bidirectional flow; dictionary attack
Attached files
Description This paper describes a design and evaluation of a network-based detection of brute-force attacks on authentication of Microsoft Windows RDP. The network flow data provides sufficient information about communication of two nodes in network, even though the RDP communication is encrypted. An analysis was based on the network flow data collected in the Masaryk University network and host-based data from logs of a server with opened Remote Desktop Connection. These data helped us to improve the flow detection using the information gathered from the server event log. Despite the fact that RDP is encrypted, flow data gives us a sufficient amount of information to determine whether the connection is an authentication or regular remote desktop session. We implemented the attacks detection as a plugin for the widely used NfSen collector. The plugin is involved in the active defense of the network of Masaryk University.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.

More info