Result on each type of SSD will be discussed in each of the following sub-section.
As described before, we have chosen to use SOM as the intelligent approach. As a result, the SOM graph will represent each compared solution.
6.1 Intelligence Network Stepping Stone Detection (I-NSSD)
In I-NSSD, the results are obtained from the execution of SOM approach through the arrival time for the overall captured data in the network. In this case, only one graph has been produced. It is different from I-HSSD that needs one graph for each host involved. Figure4shows the result.
In contrast to the I-HSSD approach that depends on the number of possible straight lines which can be created to determine the number of connection chains, the I-NSSD approach is based on the number of possible groups generated. In Fig.4, four possible groups of SOM nodes can be counted (labeled as a, b, c and d).
Thus, there are four connection chains involved in the experiment. However, the true number of connection chains involved in this research is only three. Therefore,
88 M.N. Omar and R. Budiarto
there exist false positive reports in the I-HSSD experiment. By using formula (1), FPR for I-NSSD is 33.3%. For TPR, I-NSSD shows 100% achievement.
6.2 Intelligence Host-Based Stepping Stone Detection (I-HSSD)
As described previously, I-HSSD involves every host that has been listed in I-NSSD. In this case, arrival time for each host is run by using the SOM approach.
Each result is an output from the execution.
Figure5 shows that three possible directions can be traced (e, f and g). That means there are three possible connections which exist in the originating host, Host 1. Based on the value from Table1, Host 1 obtains 100% TPR and 0% FPR.
Figure6on the other hand shows that there are two connection chains (h and i) that could possibly exist in Host 2 as the monitored host. Based on the number of connection chains from Table1, Host 2 got 100% TPR and 0% FPR.
In Fig. 7, similar to Fig. 6, there are two connection chains (j and k) that could possibly exist in this graph. Based on the number of connection chains from Table1, Host 3 also got 100% TPR and 0% FPR.
Figure8shows the last node of SOM that needs to be observed. From the graph, there are two possible obtainable directions. That means that two connection chains Fig. 4 Node of SOM in I-NSSD
7 Hybriding Intelligent Host-Based and Network-Based Stepping Stone Detections 89
Fig. 5 Node of SOM on Host 1
Fig. 6 Node of SOM on Host 2
90 M.N. Omar and R. Budiarto
Fig. 7 Node of SOM on Host 3
Fig. 8 Node of SOM on Host 4
7 Hybriding Intelligent Host-Based and Network-Based Stepping Stone Detections 91
(l and m) have been detected. However, based on the number of connection chains in Table1, three connection chains should have been detected in Host 4. For that reason, I-HSSD in Host 4 miss-detects another connection. In this case, the TPR becomes 66.7%. The FPR on the other hand also gives 0%.
From the result on each host, it shows that only the result of Host 4 does not achieve 100% TPR. This can be considered as a weakness of the I-HSSD.
Table2shows the result of the I-HSSD experiment.
Based on the overall result of the I-HSSD experiment, connection chains have been successfully detected in Host 1, Host 2 and Host 3. In Host 4, although the connection chains have also been successfully detected, the number of connection chains detected is less than the actual number involved. This makes the TPR at just 66.7%. On the other hand, the FPR is the same for all hosts.
6.3 Hybrid Intelligence Stepping Stone Detection (HI-SSD)
As described earlier, HI-SSD is constructed from the combination of I-HSSD and I-NSSD. Therefore, the information from I-HSSD and I-NSSD is still used in the HI-SSD. As shown in Fig.2, the information obtained from I-HSSD and I-NSSD are rearranged so as to generate a more accurate stepping stone detection result compared to the use of I-HSSD or I-NSSD alone.
For this purpose, the first information acquired from I-NSSD is observed. From the result, four connection chains are detected. At this level, false detection still not has been discovered. All information needed is distributed to the related hosts. The host which is related to the list then runs the I-HSSD function by itself. This is to check whether or not the host is used as a stepping stone. In this case, Host 1, Host 2, and Host 3 have successfully detected the number of existing connection chains. However, Host 4 has just detected two connection chains compared to three connection chains that should have been detected.
Although miss-detection has occurred here, the number of maximum possible hosts from Host 1 helps a lot to balance the Host 4 result. From the I-HSSD result, it is shown that there are only three connection chains involved compared to four proposed by I-NSSD. Combining I-HSSD and I-NSSD avoids false and miss-detections. By using both I-HSSD and I-NSSD, it is shown that 100% TPR and Table 2 I-HSSD experiment
0% FPR has been achieved. For a clear picture on the overall HI-SSD, the related
activate I-HSSD on selected host based on l for 1 to n
execute SOM
count the possible straight line,
identify the existence of connection chain for the host, e end for
End
Result of the experiment according to the percentage of TPR and FPR obtained from I-NSSD, I-HSSD and HI-SSD respectively is tabulated in Table3.
Table 3 shows the experiment result of I-NSSD, I-HSSD and HI-SSD. As described previously, HI-SSD is a combination of I-NSSD and I-HSSD. Therefore, the TPR and FPR for HI-SSD is the combination of I-NSSD’s TPR and FPR and I-HSSD’s TPR and FPR. In the other words, the average TPR and FPR of I-NSSD and I-HSSD become the result of HI-SSD. In this case, 100% TPR and 0% FPR for HI-SSD is better than the use of I-NSSD or I-HSSD alone. Although I-NSSD shows 100% TPR, but the 33.3% FPR can adversely affect the overall function of stepping stone detection. In the I-HSSD, 100% FPR makes this approach free of false detection. However, 91.67% TPR is not enough to render this approach to be fully-functional. As a result, combining both I-NSSD and I-HSSD to form the HI-SSD will balance the TPR and the FPR at the same time.