Applying MMD Data Mining to Match Network Traffic for Stepping-Stone Intrusion Detection

A long interactive TCP connection chain has been widely used by attackers to launch their attacks and thus avoid detection. The longer a connection chain, the higher the probability the chain is exploited by attackers. Round-trip Time (RTT) can represent the length of a connection chain. In order to...

Descripción completa

Guardado en:
Detalles Bibliográficos
Autores principales: Jianhua Yang, Lixin Wang
Formato: article
Lenguaje:EN
Publicado: MDPI AG 2021
Materias:
MMD
Acceso en línea:https://doaj.org/article/75312d70c4874db4bbaed122063ca072
Etiquetas: Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
id oai:doaj.org-article:75312d70c4874db4bbaed122063ca072
record_format dspace
spelling oai:doaj.org-article:75312d70c4874db4bbaed122063ca0722021-11-25T18:56:38ZApplying MMD Data Mining to Match Network Traffic for Stepping-Stone Intrusion Detection10.3390/s212274641424-8220https://doaj.org/article/75312d70c4874db4bbaed122063ca0722021-11-01T00:00:00Zhttps://www.mdpi.com/1424-8220/21/22/7464https://doaj.org/toc/1424-8220A long interactive TCP connection chain has been widely used by attackers to launch their attacks and thus avoid detection. The longer a connection chain, the higher the probability the chain is exploited by attackers. Round-trip Time (RTT) can represent the length of a connection chain. In order to obtain the RTTs from the sniffed Send and Echo packets in a connection chain, matching the Sends and Echoes is required. In this paper, we first model a network traffic as the collection of RTTs and present the rationale of using the RTTs of a connection chain to represent the length of the chain. Second, we propose applying MMD data mining algorithm to match TCP Send and Echo packets collected from a connection. We found that the MMD data mining packet-matching algorithm outperforms all the existing packet-matching algorithms in terms of packet-matching rate including sequence number-based algorithm, Yang’s approach, Step-function, Packet-matching conservative algorithm and packet-matching greedy algorithm. The experimental results from our local area networks showed that the packet-matching accuracy of the MMD algorithm is 100%. The average packet-matching rate of the MMD algorithm obtained from the experiments conducted under the Internet context can reach around 94%. The MMD data mining packet-matching algorithm can fix the issue of low packet-matching rate faced by all the existing packet-matching algorithms including the state-of-the-art algorithm. It is applicable to network-based stepping-stone intrusion detection.Jianhua YangLixin WangMDPI AGarticlestepping-stoneintrusion detectionnetwork securityMMDdata miningpacket-matchingChemical technologyTP1-1185ENSensors, Vol 21, Iss 7464, p 7464 (2021)
institution DOAJ
collection DOAJ
language EN
topic stepping-stone
intrusion detection
network security
MMD
data mining
packet-matching
Chemical technology
TP1-1185
spellingShingle stepping-stone
intrusion detection
network security
MMD
data mining
packet-matching
Chemical technology
TP1-1185
Jianhua Yang
Lixin Wang
Applying MMD Data Mining to Match Network Traffic for Stepping-Stone Intrusion Detection
description A long interactive TCP connection chain has been widely used by attackers to launch their attacks and thus avoid detection. The longer a connection chain, the higher the probability the chain is exploited by attackers. Round-trip Time (RTT) can represent the length of a connection chain. In order to obtain the RTTs from the sniffed Send and Echo packets in a connection chain, matching the Sends and Echoes is required. In this paper, we first model a network traffic as the collection of RTTs and present the rationale of using the RTTs of a connection chain to represent the length of the chain. Second, we propose applying MMD data mining algorithm to match TCP Send and Echo packets collected from a connection. We found that the MMD data mining packet-matching algorithm outperforms all the existing packet-matching algorithms in terms of packet-matching rate including sequence number-based algorithm, Yang’s approach, Step-function, Packet-matching conservative algorithm and packet-matching greedy algorithm. The experimental results from our local area networks showed that the packet-matching accuracy of the MMD algorithm is 100%. The average packet-matching rate of the MMD algorithm obtained from the experiments conducted under the Internet context can reach around 94%. The MMD data mining packet-matching algorithm can fix the issue of low packet-matching rate faced by all the existing packet-matching algorithms including the state-of-the-art algorithm. It is applicable to network-based stepping-stone intrusion detection.
format article
author Jianhua Yang
Lixin Wang
author_facet Jianhua Yang
Lixin Wang
author_sort Jianhua Yang
title Applying MMD Data Mining to Match Network Traffic for Stepping-Stone Intrusion Detection
title_short Applying MMD Data Mining to Match Network Traffic for Stepping-Stone Intrusion Detection
title_full Applying MMD Data Mining to Match Network Traffic for Stepping-Stone Intrusion Detection
title_fullStr Applying MMD Data Mining to Match Network Traffic for Stepping-Stone Intrusion Detection
title_full_unstemmed Applying MMD Data Mining to Match Network Traffic for Stepping-Stone Intrusion Detection
title_sort applying mmd data mining to match network traffic for stepping-stone intrusion detection
publisher MDPI AG
publishDate 2021
url https://doaj.org/article/75312d70c4874db4bbaed122063ca072
work_keys_str_mv AT jianhuayang applyingmmddataminingtomatchnetworktrafficforsteppingstoneintrusiondetection
AT lixinwang applyingmmddataminingtomatchnetworktrafficforsteppingstoneintrusiondetection
_version_ 1718410530817835008