Detect Stepping-Stone Insider Attacks by Network Traffic Mining and Dynamic Programming

Stepping-stone is the most popular way used to attack other computers. Some insiders use stepping-stone to launch their attacks pretending to be outsiders. In this paper, we propose a novel algorithm to detect stepping-stone insider attacks through comparing outgoing and incoming connections. We modify the existing packet matching algorithm by introducing sliding window to make the algorithm more efficient and practicable. The algorithm to compute the similarity between two time-pair sequences through finding the longest common sub sequence is proposed. The stepping-stone insider attacks detection algorithm is easy to be implemented and to use since there is no threshold needed. The experimental results showed the effectiveness of the algorithm to detect stepping-stone insider attacks.