Mining Network Traffic Efficiently to Detect Stepping-Stone Intrusion
Yingjie Sheng, Yongzhong Zhang, Jianhua Yang · 2012
More and more intruders are used to using stepping-stone to launch the attacks on their interested targets because exploiting stepping-stones can hide them deeply and make them feel safe. Clustering-Partitioning approach was proposed to detect stepping-stone intrusion and resist intruders' evasion. The biggest issue of this approach is that it mines network traffic in a very inefficient way. Double the mining dataset size quadruples the running time of Clustering-Partitioning approach. In this paper, we propose a new approach CDA to generate mining dataset and reduce its size. The analysis in this paper show that applying CDA can save the running time of Clustering-Partitioning and make stepping-stone intrusion detection more efficient.