Manual Técnico de Análise Cibernética - Implementação e Análise de Conexões SSH com Criptografia Clássica e Híbrida Pós-Quântica em Ambientes Monitorados

Abstract

This technical manual documents the implementation and operation of a controlled cybersecurity environment used to examine SSH connections employing classical cryptography and hybrid post-quantum mechanisms based on ML-KEM (Kyber). The material provides a reproducible setup of isolated network segments, installation and configuration of hosts, preparation of cryptographic environments, and execution of payload-generation and file-exfiltration procedures. It also presents the integration of monitoring tools such as Zeek, Suricata, and Splunk for traffic inspection and basic log analysis. The manual includes scripts, operational steps, and examples of collected metadata, enabling interested readers to replicate the environment and observe how cryptographic negotiation and data transfer processes behave under different configurations. Overall, this document offers a practical reference for understanding and experimenting with hybrid post-quantum SSH scenarios within a controlled and observable laboratory setting.