Mobile Agents for Detecting Network Attacks Using Timing Covert Channels

Jędrzej Bieniasz (Warsaw University of Technology, Poland)

Monika Stępkowska (Warsaw University of Technology, Poland)

Artur Janicki (Warsaw University of Technology, Poland)

Krzysztof Szczypiorski (Warsaw University of Technology, Poland)

Abstract: This article addresses the problem of network attacks using steganographic techniques based on the manipulation of time relationships between IP packets. In the study, an efficient method to detect such attacks is presented. The proposed algorithm is based on the Change Observation Theory, and employs two types of agents: base and flying ones. The agents observe the time parameters of the network traffic, using proposed meta-histograms and trained machine learning algorithms, in the node where they were installed. The results of experiments using various machine learning algorithm are presented and discussed. The study showed that the Random Forest and MLP classifiers achieved the best detection results, yielding an area under the ROC curve (AUC) above 0.85 for the evaluation data. We showed a proof-of-concept for an attack detection method that combined the classification algorithm, the proposed anomaly metrics and the mobile agents. We claim that due to a unique feature of self-regulation, realized by destroying unnecessary agents, the proposed method can establish a new type of multi-agent intrusion detection system that can be applied to a wider group of IT systems.

Keywords: anomaly detection, intrusion detection, multi-agent systems, network security, steganography, traffic analysis

Categories: C.2.0, I.2.0, K.6.5