A lightweight, ML-powered SSH anomaly detection system designed specifically for Small and Medium Enterprises. Monitor threats, detect attacks, respond automatically.
git clone https://gitlab.com/sohell.ranaa/ssh-guardian.git
Advanced threat detection capabilities without the complexity or cost of enterprise solutions.
Random Forest classifier with 50+ engineered features achieves 96.9% accuracy in detecting SSH attacks including brute force, credential stuffing, and advanced threats.
Live event stream processing with instant threat classification. Monitor authentication events, track IP behavior, and visualize security trends in real-time.
Integration with AbuseIPDB, VirusTotal, IPQualityScore, and Shodan. Automatic Tor exit node, VPN, and datacenter detection.
Intelligent rule-based and ML-driven blocking with UFW and Fail2ban integration. Configurable thresholds and automatic unblocking.
Comprehensive security analytics with trends, geographic visualization, risk scoring, and exportable reports. Mobile-responsive design.
Multi-channel alerts via Email and Telegram with customizable rules. Get notified of high-risk events, off-hours access, and anomalies.
A distributed architecture designed for scalability and real-time processing.
Deploy in minutes, protect your servers 24/7 with intelligent automation.
Install lightweight Python agent on your servers. Monitors auth.log for SSH events with minimal resource usage.
ML pipeline enriches events with threat intelligence, extracts features, and classifies threats in real-time.
Automatic blocking of malicious IPs, instant notifications, and detailed analytics for security insights.
Clean, intuitive interface designed for security professionals and SME administrators.
Real-time metrics, threat distribution, and event timeline
Geographic visualization and comprehensive IP reputation data
Historical analysis and exportable security reports
Real-time Telegram alerts for security events and threats
See how SSH Guardian stacks up against other SSH security solutions.
| Feature | SSH Guardian | Fail2ban | OSSEC | CrowdSec |
|---|---|---|---|---|
| ML-Based Detection | ✓ 96.9% Accuracy | ✗ | ✗ | ◐ Basic |
| Threat Intelligence APIs | ✓ 4 Sources | ✗ | ◐ Limited | ✓ Community |
| Web Dashboard | ✓ Full Analytics | ✗ | ✓ | ✓ |
| Real-time Alerts | ✓ Telegram + Email | ◐ Email only | ✓ | ✓ |
| Geographic Analysis | ✓ Interactive Maps | ✗ | ◐ | ✓ |
| SME-Focused | ✓ Designed for SMEs | ✓ | ✗ Complex | ◐ |
| Setup Time | ✓ ~10 minutes | ✓ ~5 minutes | ✗ Hours | ◐ ~30 min |
| Cost | ✓ Free & Open Source | ✓ Free | ✓ Free | ✓ Free |
This project is part of a Masters research thesis at Asia Pacific University.
A Lightweight Machine Learning-Integrated Security Framework designed to provide enterprise-grade SSH protection without the complexity and cost barriers that typically exclude SMEs from advanced security solutions.
📄 Read Full ThesisDesign Science Research with experimental validation on 600K+ synthetic attack scenarios
Common questions about SSH Guardian answered.
Reliable, proven technologies chosen for performance and maintainability.