Identification of low-latency obfuscated traffic using multi-attribute analysis
Dougherty, Kevin R.
MetadataShow full item record
There is no process or system capable of detecting obfuscated network traffic on Department of Defense (DOD) networks, and the quantity of obfuscated traffic on DOD networks is unknown. The presence of this traffic on a DOD network creates significant risk from both insider-threat and network-defense perspectives. This study used quantitative correlation and simple network-traffic analysis to identify common characteristics, relationships, and sources of obfuscated traffic. Each characteristic was evaluated individually for its ability to detect obfuscated traffic and in combination in a set of Naive Bayes multi-attribute prediction models. The best performing evaluations used multi-attribute analysis and proved capable of detecting approximately 80 percent of obfuscated traffic in a mixed dataset. By applying the methods and observations of this study, the threat to DOD networks from obfuscation technologies can be greatly reduced.
Approved for public release; distribution is unlimited
Showing items related by title, author, creator and subject.
Wang, Beng Wei (Monterey, California. Naval Postgraduate School, 2007-03);Wireless sensor networks have been widely researched for use in both military and commercial applications. They are especially of interest to the military planners as they can be deployed in hostile environments to collect ...
Turksoyu, Faith (2001-03);Traffic modeling is an important component of the design of any communication network. This is even more crucial emerging networks, which are expected to operate in high speed and high bandwidth environments. As the design ...
Carvey, Harlan A. (Monterey, California. Naval Postgraduate School, 1997-03);In this thesis the nature of variable bit rate (VBR) traffic, as generated by a video teleconferencing application, in an Ethernet environment is studied. Analysis of the data retrieved from a testbed using metrics such ...