Scalable wavelet-based active network detection of stepping stones

Joseph I. Gilbert; David J. Robinson; Jonathan W. Butts; Timothy H. Lacey

doi:10.1117/12.919571

8 May 2012 Scalable wavelet-based active network detection of stepping stones

Joseph I. Gilbert, David J. Robinson, Jonathan W. Butts, Timothy H. Lacey

Proceedings Volume 8408, Cyber Sensing 2012; 84080I (2012) https://doi.org/10.1117/12.919571
Event: SPIE Defense, Security, and Sensing, 2012, Baltimore, Maryland, United States

Abstract

Network intrusions leverage vulnerable hosts as stepping stones to penetrate deeper into a network and mask malicious actions from detection. Identifying stepping stones presents a significant challenge because network sessions appear as legitimate traffic. This research focuses on a novel active watermark technique using discrete wavelet transformations to mark and detect interactive network sessions. This technique is scalable, resilient to network noise, and difficult for attackers to discern that it is in use. Previously captured timestamps from the CAIDA 2009 dataset are sent using live stepping stones in the Amazon Elastic Compute Cloud service. The client system sends watermarked and unmarked packets from California to Virginia using stepping stones in Tokyo, Ireland and Oregon. Five trials are conducted in which the system sends simultaneous watermarked samples and unmarked samples to each target. The live experiment results demonstrate approximately 5% False Positive and 5% False Negative detection rates. Additionally, watermark extraction rates of approximately 92% are identified for a single stepping stone. The live experiment results demonstrate the effectiveness of discerning watermark traffic as applied to identifying stepping stones.

Citation Download Citation

Joseph I. Gilbert, David J. Robinson, Jonathan W. Butts, and Timothy H. Lacey "Scalable wavelet-based active network detection of stepping stones", Proc. SPIE 8408, Cyber Sensing 2012, 84080I (8 May 2012); https://doi.org/10.1117/12.919571

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available