Stepping stones are compromised hosts in a network which can be used by hackers and other malicious attackers to hide the origin of connections. Attackers hop from one compromised host to another to form a chain of stepping stones before launching attack on the actual victim host. Various timing and content based detection techniques have been proposed in the literature to trace back through a chain of stepping stones in order to identify the attacker. This has naturally led to evasive strategies such as shaping the trac di erently at each hop. The evasive techniques can also be detected. Our study aims to adapt some of the existing stepping stone detection and antievasion techniques to software-dened networks which use network function virtualization. We have implemented the stepping-stone detection techniques in a simulated environment and use sFlow for the trac monitoring at the switches. We evaluate the detection algorithms on di erent network topologies and analyze the results to gain insight on the e ectiveness of the detection mechanisms. The selected detection techniques work well on relatively high packet sampling rates. However, new solutions will be needed for large SDN networks where the packet sampling rate needs to be lower.
| Identifer | oai:union.ndltd.org:UPSALLA1/oai:DiVA.org:kth-190121 |
| Date | January 2016 |
| Creators | Bhattacherjee, Debopam |
| Publisher | KTH, Skolan för informations- och kommunikationsteknik (ICT) |
| Source Sets | DiVA Archive at Upsalla University |
| Language | English |
| Detected Language | English |
| Type | Student thesis, info:eu-repo/semantics/bachelorThesis, text |
| Format | application/pdf |
| Rights | info:eu-repo/semantics/openAccess |
| Relation | TRITA-ICT-EX ; 2016:115 |
Page generated in 0.0017 seconds