Detecting a multi-homed device using clock skew
Loading...
Authors
Martin, Bryan J.
Subjects
software defined network
multi-homed host
network monitoring
network fingerprinting
multi-homed host
network monitoring
network fingerprinting
Advisors
Tummala, Murali
McEachen, John C.
Date of Issue
2016-09
Date
Publisher
Monterey, CA; Naval Postgraduate School
Language
Abstract
The aim of this thesis was to determine the feasibility of identifying a device connected to the Internet through multiple interfaces (i.e., multi-homed) using only the information provided by passively observing network traffic. Since multi-homed hosts allow an alternate means for outside entities to circumvent the security of a firewall and gain access to a network, it is important for a network's security to be able to detect and remove such devices. In this work, the idea of using clock skew—which is the difference in perceived time between two system clocks—as a unique signature is utilized to identify hosts on a network that are potentially multi-homed. Testing was done on a software-defined network that contained a multi-homed host. After traffic between hosts was collected and analyzed, analysis of the confidence intervals of the device's clock skew was conducted to determine if IP addresses originating from the same host could be successfully detected solely from network traffic. Testing confirmed that the proposed scheme provided a valid means of detecting a multi-homed device on a network. This scheme was repeated on multiple hosts and on a device with multiple connections to the network.
Type
Thesis
Description
Series/Report No
Organization
Identifiers
NPS Report Number
Sponsors
Funder
Format
Citation
Distribution Statement
Approved for public release; distribution is unlimited.
Rights
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.