SAFE-Former:一种针对SSH协议的中间人攻击检测方法OA

To address the limitations of traditional methods in secure shell(SSH)man-in-the-middle at‑tack detection,particularly insufficient generalization capability and low application efficiency,a de‑tection method incorporating temporal features and self-learning mechanisms is proposed.In the method,the feature tokenizer transformer(FT-Transformer)architecture is adopted and time series analysis is integrated with squeeze-and-excitation network(SE-Net)self-learning mechanisms to con‑struct the SAFE-Former detection model.Representative features are constructed from delay ratio and proportion characteristics of negotiation packets by analyzing critical packets during the key exchange and algorithm negotiation phases of SSH connection establishment.The feature tokenization mecha‑nism and SE-Net self-learning mechanism are utilized to capture temporal dependencies and anoma‑lous patterns in protocol interactions,enabling effective differentiation between normal and attack traf‑fic.Experimental results demonstrate that the method achieves an accuracy exceeding 98%on Internet environment test datasets.The effectiveness of the proposed features and model is validated through the ablation studies and multi-model comparative analysis.Compared with existing mainstream ap‑proaches,SAFE-Former exhibits significant advantages in SSH man-in-the-middle attack detection.