Stepping-stone detection technique for recognizing legitimate and attack connections

• Main Authors: Daud, Ali Yusny, Ghazali, Osman, Omar, Mohd Nizam
• Format: Conference or Workshop Item
• Language: English
• Published: 2015
• Subjects: QA75 Electronic computers. Computer science
• Online Access: http://repo.uum.edu.my/15597/1/PID189.pdf; http://repo.uum.edu.my/15597/; http://www.icoci.cms.net.my/proceedings/2015/TOC.html
• Institution: Universiti Utara Malaysia

A stepping-stone connection has always been assumed as an intrusion since the first research on stepping-stone connections twenty years ago. However, not all stepping-stone connections are malicious.This paper proposes an enhanced stepping-stone detection (SSD) technique which is capable to identify legitimate connections from stepping-stone connections.Stepping-stone connections are identified from raw network traffics using timing-based SSD approach.Then, they go through an anomaly detection technique to differentiate between legitimate and attack connections.This technique has a promising solution to accurately detecting intrusions from stepping-stone connections.It will prevent incorrect responses that punish legitimate users.