Work

Explore Utilizing Network Traffic Distribution to Detect Stepping-Stone Intrusion

Year: 2024

Type: article

Abstract: In the past three decades, stepping-stone intrusion has become a professional and primary way used by intruders to launch their attacks since they can be protected behind a long TCP connection chain. Many different algorithms have been proposed to detect stepping-stone intrusion since 1995. But most algorithms cannot resist intruders’ session manipulation. In this paper, we propose a novel approach using the distribution of round-trip time (RTT) of network traffic to detect stepping-stone intrusion. This approach can resist intruders’ chaff-perturbation since the round-trip time of network packets can fairly be affected by chaffed packets. The ratio between the standard deviation of the RTTs between Send and Echo packets and the standard deviation of the RTTs between Send and Ack packets can be used to predict if a stepping-stone intrusion exists. The closer to 0 the ratio, the more suspicious a stepping-stone intrusion.

Source: Electronics

DOI: 10.3390/electronics13163258

Authors: Jianhua Yang, Lixin Wang

Institution: Columbus State University

Language: English

Topic: Network Security and Intrusion Detection

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

Open Access status: gold

Estimated APC paid: $2,728

Funder: National Security Agency