TSYS School Researchers Address Deficiencies in Internet-Based Intrusion Detection Methods

New research by TSYS School computer scientists Jianhua Yang and Lixin Wang addresses deficiencies in network-based stepping-stone intrusion detection methods using packet crossover.  As they point out in the study, which appears in the December 2022 issue of Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, previously known network-based approaches for stepping-stone intrusion detection either do not work effectively in the Internet environment, are inefficient as they require a large number of packets to be captured and analyzed, or have limited performance as the length of a connection chain must be predetermined.  In explaining the vexing nature of the issue, Yang points out that “none of these existing methods to detect stepping-stone intrusion can be used to estimate the length of upstream connection sub-chain, which has been a long-standing and challenging open problem in this research area.  [W]e develop effective network-based methods for [stepping-stone intrusion detection] using packet crossover that can be used to estimate the length of a downstream sub-chain as well as that of an upstream sub-chain.  Since the number of packet crossovers can be easily calculated, our proposed algorithms for [stepping-stone intrusion detection] are easy to use and implement.”  Working alongside Austin Lee, a computer science student at CSU, and Peng-Jun Wan, a computer scientist at the Illinois Institute of Technology, the researchers provide rigorous technical proofs and well-designed network experiments that verify the effectiveness of their proposed method of dealing with stepping-stone intrusion detection.  According to Yang, “To the best of our knowledge, this is the first work that can effectively estimate the length of the whole connection chain, including the upstream sub-chain.”