<![CDATA[Secure Shell (SSH) is widely used for remote server administration; however, its exposure to public networks makes it a frequent target of cyberattack activities. This article presents an attack classification framework for Cowrie SSH Honeypot logs, using a hybrid Random Forest–Support Vector Machine approach. The raw logs were processed through log auditing, data cleaning, session reconstruction, class labeling, feature construction, feature selection, and model evaluation. The dataset consisted of 38 log files, 213,494 valid records, 29,099 unique sessions, and 1,618 unique source IP addresses. The analyzed attack categories included failed authentication, other suspicious interactions, successful compromise, and command execution. Random Forest ranked ten candidate behavioral features, selected the five highest-ranked features within each rolling fold, and generated time-aware out-of-fold class-probability estimates. The selected features and RF probability outputs were combined, standardized, and passed to a support vector machine with a radial basis function (RBF) kernel as the stage-1 classifier; sessions predicted as successful interactions were then refined into successful compromise or command execution based on observed command activity. Evaluation using eight rolling time-based folds achieved an accuracy of 99.65% ± 0.38%, a balanced accuracy of 97.02% ± 5.77%, and a macro F1-score of 97.84% ± 4.37% for the final four-class classification. The event_count, username_diversity, interarrival_std, and password_diversity features were selected in all folds. Theoretically, RF–SVM provides a stable session-level representation; in practice, it supports honeypot log triage and the prioritization of higher-risk SSH sessions.]]>
