Darknet and DoD Networks: Obfuscation, Spoof Detection, and Elimination
Shelley P. Gallup, Tom Anderson, Victor Garza, N. J. Irvine, Brian Wood · Calhoun: The Naval Postgraduate School Institutional Archive (Naval Postgraduate School) · 2016
There is no process or system capable of detecting obfuscated network traffic on DOD networks, and the quantity of obfuscated traffic on DOD networks is unknown. The presence of obfuscated traffic on a DOD network creates significant risk from both insider-threat and network-defense perspectives. This study used quantitative correlation and simple network-traffic analysis to identify common characteristics, relationships, and sources of obfuscated traffic. A set of concepts were identified and proposed as a set of testable Key Cyber Concepts (KCCs) for obfuscation behavior. Each characteristic was evaluated individually for its ability to detect obfuscated traffic and in combination in a set of Naive Bayes multi-attribute prediction models. The best performing evaluations used multi-attribute analysis and proved capable of detecting approximately 80 percent of obfuscated traffic in a mixed dataset. By applying the methods and observations of this study, the threat to DOD networks from obfuscation technologies can be greatly reduced (Abstract from LT Kevin Dougherty NPS 2017 thesis “Identification of low latency obfuscated traffic using multi-attribute analysis”.)