Profiling distributed connection chains

Authors:
Ahmad Almulhem;Issa Traore
Affiliations:
ISOT Research Laboratory, Department of Electrical and Computer Engineering, University of Victoria, Victoria, BC V8W 3P6, Canada.;ISOT Research Laboratory, Department of Electrical and Computer Engineering, University of Victoria, Victoria, BC V8W 3P6, Canada
Venue:
International Journal of Communication Networks and Distributed Systems
Year:
2008

Citing 3
Cited 0

Data clustering: a review

ACM Computing Surveys (CSUR)
Machine learning in automated text categorization

ACM Computing Surveys (CSUR)
Holding intruders accountable on the Internet

SP '95 Proceedings of the 1995 IEEE Symposium on Security and Privacy

Quantified Score

Hi-index	0.00

Visualization

Abstract

A key challenge in network forensics arises because of 'attackers' ability to move around in the network, which results in creating a chain of connections; commonly known as connection chains. They are widely used by attackers to stay anonymous and/or to confuse the forensic process. Investigating connection chains can be further complicated when several IP addresses are used in the attack. In this paper, we highlight this challenging problem. We then propose a solution through hacker profiling. Our solution includes a novel hacker model that integrates information about a hacker's linguistic, operating system and time of activity. It also includes an algorithm to operate on the proposed model. We establish the effectiveness of the proposed approach through several simulations and an evaluation with a real attack data.