Digital Forensic Investigation of Linux SSH Authentication Logs Using NIST SP 800-86 with GeoIP and ASN Enrichment

Danur Wijayanto; Ahmad Widad Saksana

doi:10.61255/decoding.v4i3.1758

Authors

Danur Wijayanto Universitas Aisyiyah Yogyakarta
Ahmad Widad Saksana Universitas Aisyiyah Yogyakarta

DOI:

https://doi.org/10.61255/decoding.v4i3.1758

Keywords:

ASN, Digital forensics, GeoIP enrichment, NIST SP 800-86, SSH authentication logs

Abstract

Purpose – This study applies the National Institute of Standards and Technology Special Publication (NIST SP 800-86) framework to investigate SSH authentication logs from the Lensa UNISA Server while preserving evidence integrity and enriching forensic findings using GeoIP and Autonomous System Number (ASN) information.
Methods – The investigation followed the Collection, Examination, Analysis, and Reporting phases of NIST SP 800-86. The auth.log.1 file was acquired using Secure Copy Protocol (SCP), verified through SHA-256 hashing, and analyzed using standard Linux utilities. GeoIP and ASN information was obtained using MaxMind GeoLite2 and RDAP.
Findings – SHA-256 verification confirmed identical hashes between the original evidence and working copy. The analysis identified 96,182 OpenSSH-related events, including 15,522 failed authentication attempts, 4,604 invalid-user messages, and eight successful sessions. Systematic username enumeration targeting institutional account names was observed. GeoIP and ASN enrichment showed that substantial authentication activity originated from source IP addresses in the Netherlands and Turkey, particularly AS43350, AS48090, and AS154383, consistent with activity associated with hosting infrastructure.
Research Implications – The findings demonstrate the practical applicability of NIST SP 800-86 for SSH log investigation using standard Linux tools. GeoIP and ASN enrichment provide additional context for interpreting authentication artifacts.
Originality – This study presents an operational forensic case study integrating NIST SP 800-86, Linux-based log analysis, and GeoIP–ASN enrichment

Abstract views: 29 ,

PDF downloads: 33

Downloads

Download data is not yet available.

References

A. Z. Agghey, L. J. Mwinuka, S. M. Pandhare, M. A. Dida, and J. D. Ndibwile, “Detection of username enumeration attack on ssh protocol: Machine learning approach,” Symmetry (Basel)., vol. 13, no. 11, p. 2192, Nov. 2021, doi: 10.3390/sym13112192.

P. Khandait, N. Tiwari, and N. Hubballi, “Who is Trying to Compromise Your SSH Server ? An Analysis of Authentication Logs and Detection of Bruteforce Attacks,” in ACM International Conference Proceeding Series, Association for Computing Machinery, Jan. 2021, pp. 127–132. doi: 10.1145/3427477.3429772.

OpenSSH Project, “OpenSSH,” OpenBSD Project. Accessed: Aug. 04, 2026. [Online]. Available: https://www.openssh.com/

G. Giridhara Maanas, P. Hegde, and G. Kannan Sadasivam, “Detection of SSH Password Guessing Attacks using Classification Algorithms,” International Journal on Recent and Innovation Trends in Computing and Communication, vol. 11, no. 9, pp. 4277–4283, Sep. 2023, doi: 10.17762/ijritcc.v11i9.9883.

Y. Wu, P. M. Cao, A. Withers, Z. T. Kalbarczyk, and R. K. Iyer, “Mining Threat Intelligence from Billion-scale SSH Brute-Force Attacks,” in Proceedings 2020 Workshop on Decentralized IoT Systems and Security, Reston, VA: Internet Society, 2020, doi: 10.14722/diss.2020.23007.

M. Davis, B. McInnes, and I. Ahmed, “Forensic investigation of instant messaging services on linux OS: Discord and Slack as case studies,” Forensic Science International: Digital Investigation, vol. 42, Jul. 2022, doi: 10.1016/j.fsidi.2022.301401.

S. Sentanoe and H. P. Reiser, “SSHkex: Leveraging virtual machine introspection for extracting SSH keys and decrypting SSH network traffic,” Forensic Science International: Digital Investigation, vol. 40, p. 301337, Apr. 2022, doi: 10.1016/j.fsidi.2022.301337.

K. Rasmus, T. Kokkonen, and T. Hämäläinen, “Distribution of Invalid Users on an SSH Server,” 2024, pp. 139–151. doi: 10.1007/978-3-031-60227-6_12.

A. Azahari and D. Balzarotti, “On the inadequacy of open-source application logs for digital forensics,” Forensic Science International: Digital Investigation, vol. 49, p. 301750, Jun. 2024, doi: 10.1016/J.FSIDI.2024.301750.

K. Kent, S. Chevalier, T. Grance, and H. Dang, “Special Publication 800-86 Guide to Integrating Forensic Techniques into Incident Response Recommendations of the National Institute of Standards and Technology,” 2006.

R. A. Ramadhan, P. Rachmat Setiawan, and D. Hariyadi, “Digital Forensic Investigation for Non-Volatile Memory Architecture by Hybrid Evaluation Based on ISO/IEC 27037:2012 and NIST SP800-86 Framework,” IT Journal Research and Development, pp. 162–168, Feb. 2022, doi: 10.25299/itjrd.2022.8968.

F. Al Rasyid and B. Parga Zen, “Dead Forensic Analysis Of Qutebrowser And Librewolf Browsers Using The Nist 800-86 Method,” Jurnal Teknik Informatika (Jutif), vol. 4, no. 5, pp. 1009–1019, Oct. 2023, doi: 10.52436/1.jutif.2023.4.5.688.

P. Balqis and R. Rahman, “Analisis Keamanan Layanan SSH terhadap Brute Force Attack,” Jurnal Riset Sistem Informasi dan Teknik Informatika, vol. 3, no. 4, 2025, doi: 10.61132/merkurius.v3i4.949.

M. F. M. Fuzi, M. F. Mazlan, M. N. F. Jamaluddin, and I. H. A. H. Halim, “Performance analysis of network intrusion detection using T-Pot honeypots,” Journal of Computing Research and Innovation, vol. 9, no. 2, pp. 348–360, Sep. 2024, doi: 10.24191/jcrinn.v9i2.477.

C. Munteanu, Y. B. Suriyanarayanan, G. Smaragdakis, A. Feldmann, and T. Fiebig, “Attacks Come to Those Who Wait: Long-Term Observations in an SSH Honeynet,” Association for Computing Machinery (ACM), Oct. 2025, pp. 628–644. doi: 10.1145/3730567.3764475.

M. Rabzelj and U. Sedlar, “Beyond the Leak: Analyzing the Real-World Exploitation of Stolen Credentials Using Honeypots,” Sensors, vol. 25, no. 12, Jun. 2025, doi: 10.3390/s25123676.

M. C. Ghanem, E. Almeida Palmieri, W. Sowinski-Mydlarz, S. Al-Sudani, and D. Dunsin, “Weaponized IoT: A Comprehensive Comparative Forensic Analysis of Hacker Raspberry Pi and PC Kali Linux Machine,” Internet of Things, vol. 6, no. 1, Mar. 2025, doi: 10.3390/iot6010018.

A. Ali Hamza and J. s Urayh Al-Janabi, “Detecting Brute Force Attacks on SSH and FTP Protocol Using Machine Learning: A Survey,” Journal of Al-Qadisiyah for Computer Science and Mathematics, vol. 16, no. 1, Mar. 2024, doi: 10.29304/jqcsm.2024.16.11432.

J. Lee and H. Lee, “An SSH predictive model using machine learning with web proxy session logs,” Int. J. Inf. Secur., vol. 21, no. 2, pp. 311–322, Apr. 2022, doi: 10.1007/s10207-021-00555-6.

R. Flynn and O. Olukoya, “Using approximate matching and machine learning to uncover malicious activity in logs,” Comput. Secur., vol. 151, p. 104312, Apr. 2025, doi: 10.1016/J.COSE.2025.104312.

A. Firdonsyah and D. Wijayanto, “Analisis Forensik Rekayasa Dokumen PDF dengan Metode NIST,” Informatics Journal, vol. 7, no. 2, p. 121, 2022.

Inc. MaxMind, “GeoLite2 Free Geolocation Data,” MaxMind. Accessed: Aug. 02, 2026. [Online]. Available: https://dev.maxmind.com/geoip/geolite2-free-geolocation-data

X. Xiang, H. Liu, L. Zeng, H. Zhang, and Z. Gu, “IPAttributor: Cyber Attacker Attribution with Threat Intelligence-Enriched Intrusion Data,” Mathematics, vol. 12, no. 9, May 2024, doi: 10.3390/math12091364.

J. Jow, J.-W. Park, S.-H. Kim, and B. Cho, “A Study on Dynamic Configuration of Attacker Blocking Time through Linux Log Analysis,” The Journal of Korean Institute of Communications and Information Sciences, vol. 49, no. 10, pp. 1397–1409, Oct. 2024, doi: 10.7840/kics.2024.49.10.1397.

M. B. Jiménez, D. Fernández, J. Eduardo Rivadeneira, and R. Flores-Moyano, “A Filtering Model for Evidence Gathering in an SDN-Oriented Digital Forensic and Incident Response Context,” IEEE Access, vol. 12, pp. 75792–75808, 2024, doi: 10.1109/ACCESS.2024.3405588.

Bruce Nikkel, Practical Linux Forensics: A Guide for Digital Investigators. San Francisco, CA: No Starch Press, 2021.

H. Studiawan and F. Sohel, “Anomaly detection in a forensic timeline with deep autoencoders,” Journal of Information Security and Applications, vol. 63, p. 103002, Dec. 2021, doi: 10.1016/J.JISA.2021.103002.

H. Touil, F. Hdioud, N. E. L. Akkad, and K. Satori, “The Security of SSH Protocol Public Key Sharing in the Post-Quantum Era,” International Journal of Computing, vol. 23, no. 3, pp. 317–323, 2024, doi: 10.47839/ijc.23.3.3650.

A. D. Batistuta, A. H. Hendrawan, and Ritzkal, “Analisis Keamanan Jaringan Server Terhadap Serangan Dictionary Menggunakan Tools Fail2ban Dengan Notifikasi Telegram,” INFOTECH journal, vol. 10, no. 1, pp. 64–73, Feb. 2024, doi: 10.31949/infotech.v10i1.8730.