ashishps1/clustering-ssh-attacks

This project is a tool for automatically sorting network traffic records into groups so that security teams can spot different types of SSH attacks without manually reviewing each one. SSH (Secure Shell) is a common method for remotely logging into servers, and attackers often use it to try to break into systems. By clustering similar attack patterns together, the tool helps reveal what kinds of attacks are happening. The tool uses a technique called K-Means clustering, which is a way to automatically group items that share similar characteristics. It starts by figuring out the right number of groups to use, comparing results to find the most natural grouping. Each network traffic record gets assigned to a group, and then the original raw data files are organized into folders based on which group they landed in. From there, the project uses a Java library called jNetPcap to dig deeper into each file, looking for useful patterns within each cluster. This would be useful for security analysts, network administrators, or anyone investigating a breach who has captured network traffic and needs to make sense of it. For example, if someone has hours of recorded network traffic from a server that was attacked, this tool could help them quickly separate brute-force password attacks from other attack types, rather than combing through everything by hand. The README doesn't go into detail about what specific attack patterns it identifies or how well the approach performs on real-world data. The project appears to be more of an academic or proof-of-concept implementation than a production-ready security product, and it depends on the jNetPcap library for reading the packet capture files.