Generation of SSH Network Traffic Data for IDS Testbeds

We develop an algorithm for generating secure shell (ssh) network traffic that can find use as a part of a testbed for evaluating anomaly detection and intrusion detection systems in cyber security. Given an initial dataset describing real network traffic, the generator produces synthetic traffic with characteristics close to the original. The objective is to match parameters of the original traffic such as traffic volumes, session durations, diurnal patterns, and relationships between hosts in terms of communicating pairs and subsets.