Mining TCP/IP packets to detect stepping-stone intrusion
An effective approach of detecting stepping-stone intrusion is to estimate the number of hosts compromised through estimating the length of a connection chain. This can be done by studying the changes in TCP packet round-trip time. in this paper, we propose a new algorithm by using data mining method to find the round-trip time from the time-stamps of TCP send and echo packets. Previous algorithms produce either good packet matches on very few packets, or poor matches on many packets. This method gives us better round-trip time and more matched packets than other algorithms proposed in the past. it can estimate the length of a connection more accurate than other methods and has largely decreased false positive error and false negative error in detecting stepping-stone intrusion comparing with existing methods. (c) 2007 Elsevier Ltd. All rights reserved.
stepping-stone round-trip time network security intrusion detection clustering partitioning