Work

Matching TCP Packets for Stepping-Stone Intrusion Detection Resistant to Intruders’ Chaff Perturbation

Year: 2025

Type: article

Abstract: Hackers usually launch cyberattacks through several stepping-stone hosts to reduce the chance of being detected. With stepping-stone intrusion (SSI), the attacker’s identity is hidden behind a long interactive connection chain of stepping stones and thus is very difficult to reveal. Many algorithms for detecting SSI have been proposed since 1995. Most of these known detection algorithms for SSI only work for network traffic without intruders’ session manipulation. These known SSID algorithms are either weak to resisting intruders’ chaff-perturbation manipulation or have a very limited capability in resisting attacker’s session manipulation. This paper proposes an innovative SSID algorithm resistant to intruders’ chaff perturbation through matching TCP packets by using the crossover of packets. Our proposed SSID algorithm is verified by well-designed network experiments. Our experimental results show that the proposed SSID algorithm works effectively in detecting network intrusion as well as resisting intruders’ chaff perturbation.

Source: Electronics

DOI: 10.3390/electronics14061190

Authors: Lixin Wang, Jianhua Yang, Kondwani Mphande, Yi Zhou

Institution: Columbus State University

Language: English

Topic: Network Security and Intrusion Detection

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

Open Access status: gold

Estimated APC paid: $2,896

Funders: National Security Agency, Columbus State University