Abstract
This paper discusses the idea of hybriding intelligent host-based and network-based stepping stone detections (SSD) in order to increase detection accuracy. Experiments to measure the True Positive Rate (TPR) and False Positive Rate (FPR) for both Intelligent-Network SSD (I-NSSD) and Intelligent-Host SSD (I-HSSD) are conducted. In order to overcome the weaknesses observed from each approach, a Hybrid Intelligent SSD (HI-SSD) is proposed. The advantages of applying both approaches are preserved. The experiment results show that HI-SSD not only increases the TPR but at the same time also decreases the FPR. High TPR means that accuracy of the SSD approach increases and this is the main objective of the creation of HI-SSD.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
C. Chamber, J. Dolske, J. Iyer, “TCP/IP Security”, Department of Computer and Information Science (Ohio State University, Ohio 43210). Available at: http://www.linuxsecurity.com/resource_files/documentation/tcpip-security.html
K.D. Mitnick, W.L. Simon, The art of intrusion: the real stories behind the exploits of hackers, intruders & deceivers” (Wiley, 10475 Crosspoint Boulevard, Indianapolis, IN 46256, 2005)
S. Staniford-Chen, L.T. Herberlein, Holding intruders accountable on the Internet, in Proceedings of the 1995 IEEE Symposium on Security and Privacy, Oakland, CA, 1995, pp. 39–49
H. Wu, S.S. Huang, Neural network-based detection of stepping-stone intrusion. Exp. Sys. Appl. 37(2), 1431–1437 (March 2010)
A. Blum, D. Song, S. Benkataraman, Detection of Interactive Stepping Stone: Algorithm0020and Confidence Bounds, vol 3224/2004. Lecture Notes in Computer Science (Springer Berlin/Heidelberg, 1 Oct 2004), pp. 258–277
X. Wang, Tracing Intruder BStepping Stone. Ph.D. Thesis, North Carolina State University, Raleigh, 2004.
M.N. Omar, R. Budiarto, Intelligent host-based stepping stone detection approach, in Proceeding of The World Congress on Engineering and Computer Science 2009, vol II, San Francisco, USA, 20–22 Oct 2009, pp. 815–820
M.N. Omar, R. Budiarto, Intelligent network-based stepping stone detection approach. Int. J. Appl. Sci. Eng. Technol. 53–135, 834–841 (2009)
A. Almulhem, I. Traore, Detecting connection-chains: a data mining approach. Int. J. Netw. Security. 11(1), 62–74 (Jan 2010)
Y. Zhang, V. Paxson, Detecting stepping stones, in Proceedings of the 9th USENIX Security Symposium, Denver, CO, 2000, pp. 67–81.
K. Yoda, H. Etoh, Finding connection chain for tracing intruders, in Proceedings of the 6th European Symposium on Research in Computer Security (LNCS 1985), Toulouse, France, 2000, pp. 31–42
J.L. Themes, R. Abler, A. Saad, Hybrid intelligent system for network security. ACM southeast regional conference 2006, 2006.
N. Bashah, I.B. Shanmugam, A.M. Ahmed, Hybrid intelligent intrusion detection system, Proc. World Acad. Sci. Eng. Technol. 6 (2005)
M.N. Omar, L. Serigar, R. Budiarto, Hybrid stepping stone detection method. in Proceeding of 1st International Conference on Distrubuted Framework and Application (DFmA 2008), Universiti Sains Malaysia, Penang, 21–22 Oct 2008, pp. 134–138
Wareseeker (2008) [Online] Available: http://wareseeker.com/freeware/telnet-scripting-tool-1.0/19344/TST10.zip 8 Feb 2008
Y. Jianhua, S.H. Shou-Hsuan, A real-time algorithm to detect long connection chains of interactive terminal session”, in Proceedings of the 3rd International Conference on Information Security, China, 2004, pp. 198–203
Wireshark (2009). [Online] Available: http://www.wireshark.org 8 Feb 2009
H. Duane, L. Bruce, Mastering MATLAB A Comprehensive Tutorial and Reference (Prentice-Hall, New Jersey, 1996)
K.H. Yung, Detecting long connection chains of interactive terminal sessions, in Proceedings of the International Symposium on Recent Advance in Intrusion Detection (RAID 2002), Zurich, Switzerland, 2002, pp. 1–16
J. Yang, S.S. Huang, A real-time algorithm to detect long connection chains of interactive terminal sessions, in Proceedings of the 3rd International Conference on Information Security (INFOSECU 2004), Shanghai, China, 2004, pp. 198–203.
J. Yang, S.S. Huang, Matching TCP packets and its application to the detection of long connection chains on the internet, in Proceedings of the 19th International Conference on Advance Information Networking and Applications (AINA 2005), Tamkang University, Taiwan, 2005, pp. 1005–1010
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2010 Springer Science+Business Media B.V.
About this chapter
Cite this chapter
Omar, M.N., Budiarto, R. (2010). Hybriding Intelligent Host-Based and Network-Based Stepping Stone Detections. In: Ao, SI., Rieger, B., Amouzegar, M. (eds) Machine Learning and Systems Engineering. Lecture Notes in Electrical Engineering, vol 68. Springer, Dordrecht. https://doi.org/10.1007/978-90-481-9419-3_7
Download citation
DOI: https://doi.org/10.1007/978-90-481-9419-3_7
Published:
Publisher Name: Springer, Dordrecht
Print ISBN: 978-90-481-9418-6
Online ISBN: 978-90-481-9419-3
eBook Packages: EngineeringEngineering (R0)