Dataset: Enabling SSH Protocol Visibility in Flow Monitoring

Dataset contains SSH flows from Masaryk University campus network. Captured during August 2018. IP addresses are hashed using salted SHA-256.

The header for both data files is as follows:

Date flow start|Date flow end|Src IP|sPort|Dst IP|dPort|Proto|Packets|Bytes|Flags|SSH Client Version|SSH Client Application|SSH Server Version|SSH Server Application|SSH Login Attempts|SSH Login|SSH Kex|SSH Host Key|SSH Client Encryption|SSH Server Encryption|SSH Client MAC|SSH Server MAC|SSH Client Compression|SSH Server Compression

When using this dataset, please cite the original work as follows:

@inproceedings{1519096,
   author = {Celeda, Pavel and Velan, Petr and Kral, Benjamin and Kozak, Ondrej},
   address = {Washington DC, USA},
   booktitle = {IFIP/IEEE International Symposium on Integrated Network Management (IM 2019)},
   keywords = {SSH; flow; monitoring; network; dataset},
   howpublished = {online},
   language = {eng},
   location = {Washington DC, USA},
   isbn = {978-3-903176-15-7},
   pages = {569-574},
   publisher = {IFIP Open Digital Library},
   title = {Enabling SSH Protocol Visibility in Flow Monitoring},
   url = {http://dl.ifip.org/db/conf/im/im2019exp/189410.pdf},
   year = {2019}
}