Flow-based Brute-force Attack Detection

Brute-force attacks are a prevalent phenomenon that is getting harderto successfully detect on a network level due to increasing volume and en-cryption of network traffic and growing ubiquity of high-speed networks.Although the research in this field advanced considerably, there still remainclasses of attacks that are undetectable. In this chapter, we present sev-eral methods for the detection of brute-force attacks based on the analysisof network flows. We discuss their strengths and shortcomings as well asshortcomings of flow-based methods in general. We also demonstrate thefragility of some methods by introducing detection evasion techniques.