Intruders on the Internet usually launch network attacks through compromised hosts, called stepping stones, in order to reduce the chance of being detected. With stepping-stone intrusions, an attacker uses tools such as SSH to log in several compromised hosts remotely and create an interactive connection chain and then sends attacking packets to a target system. An effective method to detect such an intrusion is to estimate the length of a connection chain. In this paper, we develop an efficient algorithm to detect stepping-stone intrusion by mining network traffic using the -means clustering. Existing approaches for connection-chain-based stepping-stone intrusion detection either are not effective or require a large number of TCP packets to be captured and processed and, thus, are not efficient. Our proposed detection algorithm can accurately determine the length of a connection chain without requiring a large number of TCP packets being captured and processed, so it is more efficient. Our proposed detection algorithm is also easier to implement than all existing approaches for stepping-stone intrusion detection. The effectiveness, correctness, and efficiency of our proposed detection algorithm are verified through well-designed network experiments.

中文翻译：

---

使用-Means聚类算法挖掘网络流量以进行步进石入侵检测

Internet上的入侵者通常通过被称为“踏脚石”的受感染主机发起网络攻击，以减少被检测到的机会。攻击者使用踏脚石入侵，使用SSH之类的工具远程登录多个受感染的主机，并创建一个交互式连接链，然后将攻击数据包发送到目标系统。检测这种入侵的有效方法是估计连接链的长度。在本文中，我们开发了一种通过使用-挖掘网络流量来检测踏脚石入侵的有效算法表示聚类。用于基于连接链的踏脚石入侵检测的现有方法要么无效，要么需要捕获和处理大量TCP数据包，因此效率不高。我们提出的检测算法可以准确地确定连接链的长度，而无需捕获和处理大量的TCP数据包，因此效率更高。我们提出的检测算法也比所有现有的踏脚石入侵检测方法更易于实现。通过精心设计的网络实验验证了我们提出的检测算法的有效性，正确性和效率。