Applying MMD Data Mining to Match Network Traffic for Stepping-Stone Intrusion Detection.

Area of Science:

• Computer Science
• Network Security
• Data Mining

Background:

• Attackers utilize long interactive TCP connection chains to evade detection.
• The length of these connection chains correlates with the probability of exploitation.
• Round-trip Time (RTT) is a key metric for assessing connection chain length.

Purpose of the Study:

• To model network traffic using RTTs to represent connection chain length.
• To propose and evaluate a novel data mining algorithm for matching TCP Send and Echo packets.
• To address the limitations of existing packet-matching algorithms in detecting network intrusions.

Main Methods:

• Modeling network traffic as a collection of RTTs.
• Applying the MMD (Maximum Mean Discrepancy) data mining algorithm for TCP packet matching.
• Comparing the MMD algorithm's performance against existing packet-matching techniques.

Main Results:

• The MMD algorithm significantly outperforms existing methods in packet-matching rate.
• Achieved 100% packet-matching accuracy in local area networks.
• Reached an average packet-matching rate of approximately 94% in Internet context experiments.

Conclusions:

• The MMD data mining algorithm effectively resolves the issue of low packet-matching rates in intrusion detection.
• This algorithm is highly applicable for network-based stepping-stone intrusion detection systems.
• Improved packet matching enhances the ability to identify and mitigate advanced network attacks.