Abstract

An effective approach of detecting stepping-stone intrusion is to estimate the number of hosts compromised through estimating the length of a connection chain. This can be done by studying the changes in TCP packet round-trip time. In this paper, we propose a new algorithm by using data mining method to find the round-trip time from the timestamps of TCP send and echo packets. Previous algorithms produce either good packet matches on very few packets, or poor matches on many packets. This method gives us better round-trip time and more matched packets than other algorithms proposed in the past. It can estimate the length of a connection more accurate than other methods and has largely decreased false positive error and false negative error in detecting stepping-stone intrusion comparing with existing methods.

Keywords: Network security; Intrusion detection; Round-trip time; Stepping-stone; Clustering; Partitioning

Article Outline

1. Introduction

2. Packet round-trip time

3. Clustering–partitioning algorithm

4. Testing and performance of the algorithm

4.1. Effectiveness of the clustering–partitioning algorithm

4.2. Comparison with the previous methods

4.3. The effect of the window size

5. Conclusion and future work

References

Vitae