Effective algorithms to detect stepping-stone intrusion by removing outliers of packet RTTs

An effective method to detect stepping-stone intrusion (SSI) is estimate the length of a connection chain. This type detection referred as network-based approach. Existing SSI methods are either ineffective in context Internet because presence outliers packet round-trip times (RTTs) or inefficient, many packets must be captured and processed. Because high fluctuation caused by intermediate routers on Internet, it unavoidable that RTTs contain outlier values. In this paper, we first propose an efficient algorithm eliminate most possible RTT environment. We then develop mining network traffic using improved version k-Means clustering. Our proposed for accurate, effective, Internet. Well-designed experiments conducted environment verify effectiveness, correctness, efficiency our algorithms. show rate higher than 85.7%