Performance of Neural Networks in Stepping-Stone Intrusion Detection
Han‐Ching Wu, Shou‐Hsuan Stephen Huang · 2008
Network intruders often launch attacks through a long connection chain via intermediary hosts, called stepping- stones in order to evade detection. An effective method to detect such intrusion is to estimate the number of stepping-stones. Artificial neural networks provide the potential to identify and classify network activities. In this paper, we proposed an approach that utilized the analytical strengths of neural networks to detect stepping-stone intrusion. Using collected packet variables, a scheme was developed for neural network investigation and the performance of neural networks was critically examined. It was found that neural networks were able to predict the number of stepping-stones for incoming packets by our method by monitoring a connection chain in a small time interval. Various transfer functions and learning rules were studied and it was determined that Sigmoid transfer function and Delta learning rule generally gave better predictions.