To avoid being traced, threat actors frequently exploit anonymity-enhancing technologies, such as VPNs, to obscure their digital identity. This study presents an innovative framework for the real-time identification of secure web traffic transmitted via VPNs, with a specific focus on the HTTPS and QUIC (HTTP/3) protocols. When accessing a web server through a VPN, two round-trip times (RTTs) are defined from the server’s perspective: one between the web server and the VPN, and another encompassing the entire path from the server to the VPN and then to the client. The proposed detection framework leverages inconsistencies in packet RTTs and employs active probing techniques targeting VPN servers from the web server. In regions with stringent internet controls, obfuscated VPNs enable users to bypass censorship without revealing their VPN usage. This obfuscation is often achieved by routing VPN traffic through proxy servers that reshape it to resemble standard HTTPS flows. Our framework can detect traffic under such obfuscation strategies. By applying machine learning to analyze RTT patterns, the system can effectively identify intrusions that involve VPN-based anonymity. This research lays the groundwork for developing robust and adaptive VPN detection systems, which are essential for safeguarding the integrity and privacy of digital infrastructure.

Malicious attackers often exploit anonymity networks like VPNs to conceal their identities. This paper introduces a novel real-time detection algorithm based on discrepancies in packet round-trip times (RTTs) and active probing of VPN servers. When a client accesses a target server via a VPN, two distinct RTTs emerge anchored on the target: target-VPN and target-VPN-client. The proposed detection algorithm determines whether one or two significantly different RTT clusters are present, with two clusters indicating the use of a VPN. The focus of this study is the detection of Secure Shell (SSH) connections through VPNs. While measuring the RTT between the target and the client is relatively straightforward due to the packet exchange of the TCP/SSH protocol, estimating the RTT between the target and the VPN presents challenges. An active probing method is proposed to calculate the RTT, accounting for the potential involvement of a malicious or compromised VPN. By employing machine learning to analyze these RTTs, the system can effectively detect intruders utilizing VPNs. This research serves as a foundation for developing secure and efficient VPN detection systems, which are critical for preserving the integrity and privacy of digital resources.

Audio fingerprinting techniques were developed to index and retrieve audio samples by comparing a content-based compact signature of the audio instead of the entire audio sample, thereby reducing memory and computational expense. Different techniques have been applied to create audio fingerprints; however, with the introduction of deep learning, new data-driven unsupervised approaches are available. This article presents Sequence-to-Sequence Autoencoder Model for Audio Fingerprinting (SAMAF), which improved hash generation through a novel loss function composed of terms: Mean Square Error, minimizing the reconstruction error; Hash Loss, minimizing the distance between similar hashes and encouraging clustering; and Bitwise Entropy Loss, minimizing the variation inside the clusters. The performance of the model was assessed with a subset of VoxCeleb1 dataset, a“speech in-the-wild” dataset. Furthermore, the model was compared against three baselines: Dejavu, a Shazam-like algorithm; Robust Audio Fingerprinting System (RAFS), a Bit Error Rate (BER) methodology robust to time-frequency distortions and coding/decoding transformations; and Panako, a constellation-based algorithm adding time-frequency distortion resilience. Extensive empirical evidence showed that our approach outperformed all the baselines in the audio identification task and other classification tasks related to the attributes of the audio signal with an economical hash size of either 128 or 256 bits for one second of audio.

In order to make apps functional, mobile operating systems, such as Android, allow applications to access some system data without asking for user permission. We demonstrate that by analyzing these system data and some side channel information, it is possible to gain insight into a smartphone user's behavior, thus putting their privacy at risk. With these real-time privacy information collected, a malicious attacker may launch spear fishing attacks with much higher yield rates. In this paper, we study a combination of power consumption, network traffic, and memory usage of several commonly used activities, and demonstrated that it is possible to classify a user's smartphone activities into one of six classes. We designed several experiments to test the classification which resulted in high success rates. We also present the possibility of detecting transitions of smartphone activities.

Routing packet traffic through a chain of hosts is a common technique for hackers to attack a victim server without exposing themselves. Generally, the use of a long connection chain to log in to a computer system is an indication of the presence of an intruder. This paper presents a new solution to the problem of detecting such long connection chains at the server side. Our hypothesis is that a long connection chain will cause Request and Response packets to cross each other along the chain. So even though we cannot directly observe the packet crossovers from the server side, we can observe some of their side effects. Thus, our detection algorithm is based on detecting this side effect of packet crossovers. We validated the algorithm using test data generated on the Internet. The results show a high detection rate of long connection chains of length three hops with a reasonable false positive rate.

This paper presents two new and novel methods to separate network connections between those that have originated behind the Tor network and those that have not. Our methods identify Tor inbound connections through the use of two distinct timing signatures, delay and round-trip time, that can be used to create effective metrics. In order to evaluate our methods' ability to correctly identify Tor connections, we present the results of two small-scale experiments, one testing performance with HTTP traffic and the other testing SSH. These experiments resulted in very high accuracy rates (100% and 98.99% respectively) when partitioning network connections into Tor and non-Tor originating connections. Through the use of our techniques, we believe that inbound connections that have traversed the Tor network can be identified on a per-connection basis rather than the current per-IP basis.

Hackers often use a chain of intermediate stepping-stone hosts to hide their identity before launching an attack. This type of stepping-stone attack can be detected by applying timing-based correlation algorithms on the connections in and out of a host. However, hackers can add chaff packets or jitter the original packets to decrease the detection rate of these correlation algorithms. This paper proposes a novel method to detect intrusions under the influence of packet jittering. Our study shows how the distribution of the inter-arrival time gaps of a jittered connection differs from connections without jittering. We study the impact of the jittering probability model on the detection rate as well as parameters of the model upon the detection rate. Our study suggests a way to detect stepping-stones and complements the existing correlation-based stepping-stone detection algorithms to form a much more robust solution.

A common technique hackers use to break into a computer host is to route their traffic through a chain of stepping-stone hosts. There is no valid reason to use a long connection chain for remote login such as SSH connections. One way to protect a host of being attacked is to identify long connection chains connecting into the host. This paper proposes a novel method to identify long connection chains from short chains using a pre-computed short chain profile. Each new connection will be compared to the profile. Any connection that differs significantly from the profile will be considered as a suspicious long connection. Several methods are used to adjust with user's different typing speed. Validation results show that more than 80% long chains can be correctly detected for chains of length 4 or higher.

Cyber criminals often use a sequence of intermediate "stepping-stone" hosts to attack a target machine in order to maintain anonymity. This type of attack of using a connection chain is called stepping-stone attack. Most existing algorithms to detect such attack is to use timing-based correlation on the connections. However, these timing-based approaches are vulnerable if the intruders add chaff packets to evade the detection. The stepping-stone detection rate decreases as the chaff rate increases. We developed a novel anomaly detection algorithm to detect the presence of chaff in a connection by monitoring the packet inter-arrival times. Our study shows the probability distribution of the inter-arrival time of a chaffed connection differs from that of one without chaff. Our experiments show the detection rate as a function of the chaff rate under a variety of complex circumstances. The new algorithm complements the existing correlation-based stepping-stone detection algorithms in providing a more robust solution to stepping-stone detection.

Abstract Network intruders usually launch attacks indirectly by constructing a long connection via intermediary hosts, called stepping‐stones, to hide their identities. In order to detect this type of malicious behavior, it is necessary to identify whether a host has been used as a stepping‐stone. More sophisticated intruders even add extra superfluous packets, called chaff packets, to evade detection. In this paper, we introduce the packet‐based approach to detect stepping‐stones with chaff perturbation based on the range of a random walk model. Two algorithms, size‐fluctuation and transformation, are proposed for this approach to distinguish the stepping‐stone connections from the normal connections. The results show that both algorithms are able to identify the stepping‐stone connections effectively under a larger number of chaff perturbation and with fewer monitored packets than the existing methods. Copyright © 2010 John Wiley & Sons, Ltd.

Stepping-stone attacks in network intrusion detection are attackers who use a sequence of stepping-stone hosts to initiate attacks in order to hide their origins. The goal of this paper is to find algorithms to correctly detect the attacks and have the ability to tolerate the clock skew or/and chaff while exhibiting low time complexity. We propose three novel algorithms for detecting correlation and similarity of two connections not only into and out of a single stepping stone host (consecutive streams), but also across multiple stepping-stone hosts. To evaluate the accuracy and efficiency, we conduct extensive experiments. We also evaluate how chaff packets and clock skew may affect these methods. We present a comparison of the algorithms in terms of false rates of detection, and identify one of the approaches that can efficiently achieve good performance under a variety of circumstances.

Stepping-stone attack in network intrusion detection are attackers who use a sequence of intermediate (or so called stepping-stone) hosts to initiate attacks in order to hide their origins. We investigate a number of dynamic programming based pattern recognition approaches and our novel algorithm for detecting correlation and similarity of two connections not only into and out of a single stepping stone host(consecutive streams), but also across multiple stepping-stone hosts. The goal of this paper is to find out which technique can be better adopted for detection applications. To evaluate their accuracy and efficiency, we conduct extensive experiments. We also evaluate how chaff packets and time skew may affect these methods. We compare the results from five methods with their false positive and false negative rates. We demonstrate that our proposed approach named OSSM returns very good performance even under a variety of complex circumstances.

A main concern for network intrusion detection systems is the ability of an intruder to evade the detection by routing through a chain of intermediate stepping-stone hosts. The intruders have developed some evasion techniques such as injecting chaff packets or timing jitter. Such evasion techniques cause most of the previous timing-based detection algorithms to fail. In this paper, we address these issues and devise a methodology to defeat these counter measures. Our algorithm uses modified association rule mining to detect stepping-stones. It is based on finding as many matched pairs of packets as possible within the fixed length intervals and then decide whether it is a stepping-stone connection by the matched rate. This algorithm allows checking multiple connections at once and therefore greatly increasing the efficiency compared to others. We examine the selected parameters and provide different trade-offs among false rates. Our experiments report a very good performance with very high detection rate and low false detection rate when using carefully selected parameter values.

It is generally agreed that there is no valid reason to use a long connection chain for remote login such as SSH connection. Most of the stepping-stone detection algorithms installed on a host were designed to protect the victim of a third party downstream from where the algorithm is running. It is much more important for a host to protect itself from being a victim. This project uses an approximated round-trip time to distinguish a long connection chain from a short one. Several measures were studied to distinguish long chains from short ones. An estimated roundtrip time was defined to measure the chain length. Preliminary result suggests shows that the proposed algorithm can distinguish long connection chains from short ones with relatively low false rate.

Masqueraders commonly impersonate legitimate userpsilas account to gain access to computer systems that they are not authorized to enter. Normally users exhibit some regularity in their behavior such as command usage. We propose a new approach to mine user command associations. Since each user may have different usage behavior, using the built behavior pattern to predict a masqueraderpsilas next command will result in low success rate. We devise an algorithm to identify masqueraders by evaluating the accuracy of the predictions. Furthermore our detection method can be used in real-time without having to wait for a log of a large number of commands. Experimental results show that the association rules mining performs very well in detecting masqueraders.

Most network intruders launch their attacks through stepping-stones to reduce the risks of being discovered. To uncover such intrusions, one prevalent, challenging, and critical way is to compare an incoming connection with outgoing connections to determine if a computer is used as a stepping-stone. In this paper, we present a way by using signal processing technology-correlation coefficient, such as Spearman Rank, Kendall Tau Rank, and Pearson Product-Moment, to correlate two sessions to identify stepping-stone intrusions. The contribution of this paper is that we are the first one to apply correlation coefficient to stepping-stone intrusion detection, and more importantly, it is not necessary to monitor a session for a long time to conclude a stepping-stone intrusion. The experiment results showed that a step-ping-stone intrusion can be detected while an intruder input the username and password. Further work needs to be done to test if this approach could resist intruders' evasion.

Flow has been widely used for the diagnosis of various diseases. We proposed an automated gating approach to analyze and cluster flow data and provide researchers and physicians a 3-D way of viewing flow data. This automated approach was designed to give reproducible results, which avoid the subjective and time-consuming human manipulation. Doublets problem will be eliminated by our tool, and the result were compared with the manual gating. In addition, a 3D visualization will not only give a user-friendly representation but also avert misclassification would occur in lower dimension. We demonstrated how the 3D approach can be used to augment the K-means method in classifying the data. To validate the feasibility of our proposed automatic approach, our result is compared with the result done at the Methodist Hospital in Houston.

A major concern for network intrusion detection systems is the ability of an intruder to evade the detection by routing through a chain of the intermediate hosts to attack a target machine and maintain the anonymity. Such an intermediate host is called a stepping-stone. The intruders have developed some evasion techniques such as injecting chaff packets. A number of algorithms have been proposed to detect stepping-stones, but some of them failed to detect correctly when the network traffic is somehow corrupted or with the chaff packets. We discuss the viability of solving those issues by improving a previous methodology. The algorithm is based on finding as many matched pairs of incoming and outgoing packets on the same host as possible and then decide whether it is a stepping-stone connection by the mismatched rate. We examine a number of tradeoffs in choosing the threshold values by simulating network traffic. Our experiments report a very good performance with very low false detection rates when using carefully selected parameter values.

Intruders often do not attack victim hosts directly from their own hosts so as not to reveal their identity. Instead, intruders perform their attacks through a sequence of intermediary hosts before attacking the target. This type of attack is known as a “stepping-stone attack”. Stepping-stone detection is to determine if a host machine is being used as a stepping-stone by attackers. In this paper, we propose an algorithm for stepping-stone detection using a pervious mapping-based detection method. The technique reduces the detection problem to finding a mapping between two streams of packets. If our algorithm cannot find the mapping, then no such mapping exists. But if there is a mapping, then the proposed algorithm is guaranteed to find one and the solution will always be the one with minimum indexed. We provide the proof of the correctness of the algorithms. Furthermore, the algorithm has a low time complexity. The paper also discusses the effect of chaff packets on the ability to detect stepping-stones.

One way to detect intruders on the Internet is to compare the similarity of two thumbprints. A thumbprint is a summary of a connection that characterizes the connection. The packet gap thumbprint consists of sequences of non-negative real number representing the time gaps between "send" packets. This paper formalized definitions of similarity between two non-negative real number sequences, by introducing /spl epsiv/-similarity, partial sum and longest /spl epsiv/-similar subsequence (LSS). Length of LSS is a measurement of similarity between two sequences. The longest /spl epsiv/-similar subsequence (LSS) problem is a generalization of the well known longest common subsequence (LCS) problem. The goal of this paper is to find an optimal solution to the LSS problem. We analyzed the property of partial sums and proposed to focus on the minimum matched partial sum which leads to an optimal solution to LSS while reduce the problem space. As the LSS problem has optimal structure, we proposed an algorithm based on dynamic programming technique. Time complexity of this algorithm is O(m/sup 2/n/sup 2/). By using a property of the partial sums, we reduced the time complexity to O(mn(m+n)).

An effective approach for detecting stepping-stone intrusion is to estimate the number of hosts compromised through estimating the length of a connection chain. This can be done by studying the changes in TCP packet round-trip time. In this paper, we propose a new algorithm by using maximum-minimum distance clustering and partitioning method to find the round-trip time from the time-stamps of TCP send and echo packets. Previous algorithms produce either good results on very few packets, or poor results on many packets. This method gives us better round-trip time and more packets than other algorithms proposed in the past.

Network attackers usually launch their attacks behind a long connection chain. One way to stop such attacks is to prevent the attackers from using computers as "stepping-stones" for their attacks. A "Step-Function" method has been proposed to detect the length of a connection chain from a host to the victim machine. The algorithm is based on the changes in packet round trip times. Due to many network protocol issues, it is impossible to match all such packets correctly. We propose two algorithms to match TCP packet in real-time. The first algorithm matched fewer packets but the matching is correct. The second one matches more packets with some uncertainty on the correctness. The two algorithms gave almost identical results in determining the length of a connection chain. The algorithm gives a way to stop stepping-stone intrusion on the Internet in real-time.

The expectation maximization algorithm is an iterative method frequently mentioned in solving the incomplete data problems since its birth in the 1970s. Despite its capability in data approximation, the method has not been widely used in practice due to the huge amount of data involved in the intensive matrix-vector multiplication. We propose a novel technique in speeding up the computation time by better manipulation of the probability matrix. The key idea is to pre-process the input matrix by extracting the non-zero elements along with their index information. We have tested the new algorithm on an IBM SP2 machine for its performance with various configuration settings. Significant amounts of computation time reductions are found in our study depending on the actual density information of the matrix. The new algorithm has the advantage of having a minimum overhead and no new constraint on the matrix structure. With the significant speedup gained from the reduction in computation, our study demonstrates the promising result for future use of the algorithm.

With its unique diagnostic capabilities for imaging metabolic body functions, positron emission tomography (PET) has become the superior system among all noninvasive modalities for quantitatively evaluating physiology. Commonly-used reconstruction algorithms such as filtered backprojection (FBP) have been adopted due to their rapid computation but may compromise the resulting image quantitatively with inherent noise amplification. Expectation maximization (EM), an algorithm that includes the stochastic nature of the count data, has been proposed and proved to generate better images, but remains hard to use because of the high complexity of the algorithm. The EM reconstruction algorithm is becoming more feasible with parallel computers which are widely available in research organizations. Different schemes and high-cost hardware platforms have been introduced to speed up the reconstruction process but often incur high costs with their ad-hoc approaches. We introduce a hardware-independent parallel PET image reconstruction system with portable software implementation. To reduce the cost that comes with most parallel platforms, commercial off-the-shelf hardware and software components can be used to build a system with a low cost/performance ratio. The system architecture is also shown to be scalable with increasing image size to meet future needs.

Estimation of the parameters of a probability distribution function is a complicated problem that is frequently encountered in many instances of real world problems. The Expectation Maximization (EM) algorithm often can be employed when there is a many-to-one mapping from all possible distribution patterns to the distribution governing the outcome. With its maximum likelihood (ML) formulation, optimal estimate can be made for the unknown variables after iterations until convergence. A variety of parallel methods have been proposed to boost its performance because of the complexity involved in the algorithm. Despite the efforts, the ML algorithm could not be easily adopted in practice primarily due to both intra- and inter-iteration data dependence problems resulting from the iterative nature of the algorithm. This research builds upon experimentation that demonstrated promising results in speeding up the algorithm in and between iterations using distributed memory message passing architecture.

Recurrence formulations for various problems, such as finding an optimal order of matrix multiplication, finding an optimal binary search tree, and optimal triangulation of polygons, assume a similar form. A. Gibbons and W. Rytter (1988) gave a CREW PRAM algorithm to solve such dynamic programming problems. The algorithm uses O(n/sup 6//log n) processors and runs in O(log/sup 2/ n) time. In this article, a modified algorithm is presented that reduces the processor requirement to O(n/sup 6//log /sup 5/n) while maintaining the same time complexity of O(log/sup 2/ n).>

Let G = h x w be a rectangular grid and H = s x s be the optimal sqaure grid for G, i.e., the least square grid which is no less than G in size. In this paper, an embedding scheme is presented for embedding G into H such that the dilation cost is at most 6. The significance of this result is that optimal expansion is always achieved, regardless of the aspect ratio of the rectangle, while keeping the dilation constant.

We study restricted classes of B-trees, called H(β, γ, δ) trees. A class is defined by three parameters: β, the size of a node; γ, the minimal number of grandsons a node must have; and δ, the minimal number of leaves bottom nodes must have. This generalizes the brother condition of 2-3 brother trees in a uniform way to B-trees of higher order. The class of B-trees of order m is obtained by choosing β = m, γ = (m/2) 2 and δ = m/2. An algorithm to construct H-trees for any given number of keys is given in Section 1. Insertion and deletion algorithms are given in Section 2. The costs of these algorithms increase smoothly as the parameters are increased. Furthermore, it is proved that the insertion can be done in time O(β + log N), where N is the number of nodes in the tree. Deletion can also be accomplished without reconstructing the entire tree. Properties of H-trees are given in Section 3. It is shown that the height of H-trees decreases as γ increases, and the storage utilization increases significantly as δ increases. Finally, comparisons with other restricted classes of B-trees are given in Section 4 to show the attractiveness of H-trees.

To study the relationship between key-comparison cost and utilization (space efficiency) of 2-3 trees, we define a class of 2-3 trees called kcu-optimal trees, which, out of all 2-3 trees with optimal key-comparison cost, have maximum utilization. A characterization theorem for this class is proved and the “average” utilization is found to be 64.7%, showing that these properties are not totally incompatible. Finally, a linear-time algorithm is given to create a kcu-optimal tree from a sorted array of keys.