信息工程大学学报2026，Vol.27Issue(2)：216-222,230,8.DOI:10.3969/j.issn.1671-0673.2026.02.012
SAFE-Former:一种针对SSH协议的中间人攻击检测方法
SAFE-Former:a Method for SSH Man-in-the-Middle Attack Detection
摘要
Abstract
To address the limitations of traditional methods in secure shell(SSH)man-in-the-middle at‑tack detection,particularly insufficient generalization capability and low application efficiency,a de‑tection method incorporating temporal features and self-learning mechanisms is proposed.In the method,the feature tokenizer transformer(FT-Transformer)architecture is adopted and time series analysis is integrated with squeeze-and-excitation network(SE-Net)self-learning mechanisms to con‑struct the SAFE-Former detection model.Representative features are constructed from delay ratio and proportion characteristics of negotiation packets by analyzing critical packets during the key exchange and algorithm negotiation phases of SSH connection establishment.The feature tokenization mecha‑nism and SE-Net self-learning mechanism are utilized to capture temporal dependencies and anoma‑lous patterns in protocol interactions,enabling effective differentiation between normal and attack traf‑fic.Experimental results demonstrate that the method achieves an accuracy exceeding 98%on Internet environment test datasets.The effectiveness of the proposed features and model is validated through the ablation studies and multi-model comparative analysis.Compared with existing mainstream ap‑proaches,SAFE-Former exhibits significant advantages in SSH man-in-the-middle attack detection.关键词
SSH协议/中间人攻击检测/时序特征/自学习机制/FT-TransformerKey words
SSH protocol/man-in-the-middle attack detection/temporal features/self-learning mecha‑nism/FT-Transformer分类
信息技术与安全科学引用本文复制引用
刘騉,林伟,靳迪,李玎,陈迪..SAFE-Former:一种针对SSH协议的中间人攻击检测方法[J].信息工程大学学报,2026,27(2):216-222,230,8.基金项目
国家自然科学基金青年基金(62302520) （62302520）
国家自然科学基金(62402524) （62402524）
