Analýza síťových útoků na službu SSH s využitím technologie Honeypot

This bachelor thesis analyzes current network attacks on the Secure Shell protocol and proposes specific security recommendations for enterprise practice. The main objective of the research was to map the behavior of automated threats using honeypot technology. In the practical part medium interaction Cowrie systems were deployed in three geographically separated cloud nodes located in Frankfurt, San Francisco and Singapore. Over two and a half million malicious events were captured and analyzed during a one month measurement. The results demonstrate a massive prevalence of optimized dictionary attacks over pure password guessing. A key finding is that the majority of offensive actions do not originate from residential networks but from compromised commercial datacenters. The thesis details the phase after the initial breach where attackers aggressively delete native monitoring agents and lock the system against competing malicious networks. The final section formulates a set of proactive measures for Linux server administrators.