Flow watermarks efficiently link packet flows in a network in order to thwart various attacks such as stepping stones. We study the problem of designing good flow watermarks. Earlier flow watermarking schemes mostly considered substitution errors, neglecting the effects of packet insertions and deletions that commonly happen within a network. More recent schemes considered packet deletions but often at the expense of the watermark visibility. We present an invisible flow watermarking scheme capable of enduring a large number of packet losses and insertions. To maintain invisibility, our scheme uses quantization-index-modulation (QIM) to embed the watermark into interpacket delays, as opposed to time intervals including many packets. As the watermark is injected within individual packets, packet losses and insertions may lead to watermark desynchronization and substitution errors. To address this issue, we add a layer of error-correction coding to our scheme. Experimental results on both synthetic and real network traces demonstrate that our scheme is robust to network jitter, packet drops, and splits, while remaining invisible to an attacker.

Invisible Flow Watermarks for Channels With Dependent Substitution, Deletion, and Bursty Insertion Errors

Flow watermarks efficiently link packet flows in a network in order to thwart various attacks such as stepping stones. We study the problem of designing good flow watermarks. Earlier flow watermarking schemes mostly considered substitution errors, neglecting the effects of packet insertions and deletions that commonly happen within a network. More recent schemes consider packet deletions but often at the expense of the watermark visibility. We present an invisible flow watermarking scheme capable of enduring a large number of packet losses and insertions. To maintain invisibility, our scheme uses quantization index modulation (QIM) to embed the watermark into inter-packet delays, as opposed to time intervals including many packets. As the watermark is injected within individual packets, packet losses and insertions may lead to watermark desynchronization and substitution errors. To address this issue, we add a layer of error-correction coding to our scheme. Experimental results on both synthetic and real network traces demonstrate that our scheme is robust to network jitter, packet drops and splits, while remaining invisible to an attacker.

Invisible Flow Watermarks for Channels with Dependent Substitution, Deletion, and Bursty Insertion Errors

A remote wireless monitoring terminal design, using ARM microprocessor as its core controller, is proposed in this paper. The whole system includes two sections. The first is the acquiring of physical signal design as monitoring terminal, which is composed of Blood Pressure Module, Blood Oxygen Module, ECG (Electrocardiogram), and respiration. The second is a method to achieve the function of remote monitoring based on 3G wireless network and SSH (Secure Shell). The whole software is run in embedded Linux system including driver and the corresponding applications. Experimental results showed that the design of telemonitoring system is reasonable, effective, meeting requirements basically.

Design of medical remote monitoring system base on embedded Linux

The Coronavirus pandemic and the work-from-anywhere has created a shift toward cloud-based services. The pandemic is causing an explosion in cloud migration, expected that by 2025, 95% of workloads will live in the cloud. One of the challenges of the cloud is data security. It is the responsibility of cloud service providers to protect user data from unauthorized access. Historically, a third-party auditor (TPA) is used to provide security services over the cloud. With the tremendous growth of demand for cloud-based services, regulatory requirements, there is a need for a semi to fully automated self sovereign identity (SSI) implementation to reduce cost. It’s critical to manage cloud data strategically and extend the required protection. At each stage of the data migration process, such as data discovery, classification, and cataloguing of the access to the mission-critical data, need to be secured. Cloud storage services are centralized, which requires users must place trust in a TPA. With the SSI, this can become decentralized, reducing the dependency and cost. Our current work involves replacing TPA with SSI. A cryptographic technique for secure data migration to and from the cloud using SSI implemented. SSI facilitate peer-to-peer transactions, meaning that the in-between presence of TPA needs no longer be involved. The C2C migration performance is recorded and found the background or foreground replication scenario is achievable. Mathematically computed encrypted and decrypted ASCII values for a word matched with the output by the algorithm. The keys generated by the algorithm are validated with an online validator to ensure the correctness of the generated keys. RSA based mutual TLS algorithm is a good option for SSI based C2C migration. SSI is beneficial because of the low maintenance cost, and users are more and more using a cloud platform. The result of the implemented algorithm shows that the SSI based implementation can provide a 13.32 Kbps encryption/decryption rate which is significantly higher than the TPA method of 1 Kbps.

/pdf/cloud-to-cloud-data-migration-using-self-sovereign-identity-2byaadjzqs.pdf

Cloud to cloud data migration using self sovereign identity for 5G and beyond

Routing packet traffic through a chain of hosts is a common technique for hackers to attack a victim server without exposing themselves. Generally, the use of a long connection chain to log in to a computer system is an indication of the presence of an intruder. This paper presents a new solution to the problem of detecting such long connection chains at the server side. Our hypothesis is that a long connection chain will cause Request and Response packets to cross each other along the chain. So even though we cannot directly observe the packet crossovers from the server side, we can observe some of their side effects. Thus, our detection algorithm is based on detecting this side effect of packet crossovers. We validated the algorithm using test data generated on the Internet. The results show a high detection rate of long connection chains of length three hops with a reasonable false positive rate.

Detecting Stepping-Stone Intruders by Identifying Crossover Packets in SSH Connections

A common technique hackers use to break into a computer host is to route their traffic through a chain of stepping-stone hosts. There is no valid reason to use a long connection chain for remote login such as SSH connections. One way to protect a host of being attacked is to identify long connection chains connecting into the host. This paper proposes a novel method to identify long connection chains from short chains using a pre-computed short chain profile. Each new connection will be compared to the profile. Any connection that differs significantly from the profile will be considered as a suspicious long connection. Several methods are used to adjust with user's different typing speed. Validation results show that more than 80% long chains can be correctly detected for chains of length 4 or higher.

Detecting Intruders Using a Long Connection Chain to Connect to a Host

It is generally agreed that there is no valid reason to use a long connection chain for remote login such as SSH connection. Most of the stepping-stone detection algorithms installed on a host were designed to protect the victim of a third party downstream from where the algorithm is running. It is much more important for a host to protect itself from being a victim. This project uses an approximated round-trip time to distinguish a long connection chain from a short one. Several measures were studied to distinguish long chains from short ones. An estimated roundtrip time was defined to measure the chain length. Preliminary result suggests shows that the proposed algorithm can distinguish long connection chains from short ones with relatively low false rate.

/pdf/detecting-stepping-stone-intruders-with-long-connection-4z8fcxwcnz.pdf

Detecting Stepping-Stone Intruders with Long Connection Chains

Remote user authentication is a mechanism in which the remote server verifies the legitimacy of a user over an open and insecure communication channel. Password authentication using a smart card has been one of the commonly adopted methods to protect the password during transmission. Recently, many researchers have proposed a series of dynamic ID-based remote user authentication schemes with the feature that the user's identity is changed in every transaction session. In this paper, we introduce three recent proposed authentication schemes using smart cards, and point out some weaknesses in these schemes such as smart card forge attacks, impersonation attack, message forge attack, replay attack and resembling account attack, etc. Furthermore, some advanced topics about dynamic ID-based authentication scheme are discussed and demonstrated which is useful for the authentication scheme designers.

Cryptanalysis of three dynamic ID-based remote user authentication schemes using smart cards

Hackers often use a chain of intermediate stepping-stone hosts to hide their identity before launching an attack. This type of stepping-stone attack can be detected by applying timing-based correlation algorithms on the connections in and out of a host. However, hackers can add chaff packets or jitter the original packets to decrease the detection rate of these correlation algorithms. This paper proposes a novel method to detect intrusions under the influence of packet jittering. Our study shows how the distribution of the inter-arrival time gaps of a jittered connection differs from connections without jittering. We study the impact of the jittering probability model on the detection rate as well as parameters of the model upon the detection rate. Our study suggests a way to detect stepping-stones and complements the existing correlation-based stepping-stone detection algorithms to form a much more robust solution.

Detecting stepping-stones under the influence of packet jittering

Stepping-stone attack in network intrusion detection are attackers who use a sequence of intermediate (or so called stepping-stone) hosts to initiate attacks in order to hide their origins. We investigate a number of dynamic programming based pattern recognition approaches and our novel algorithm for detecting correlation and similarity of two connections not only into and out of a single stepping stone host(consecutive streams), but also across multiple stepping-stone hosts. The goal of this paper is to find out which technique can be better adopted for detection applications. To evaluate their accuracy and efficiency, we conduct extensive experiments. We also evaluate how chaff packets and time skew may affect these methods. We compare the results from five methods with their false positive and false negative rates. We demonstrate that our proposed approach named OSSM returns very good performance even under a variety of complex circumstances.

Wei Ding

Papers

Detecting Intruders Using a Long Connection Chain to Connect to a Host

Detecting Stepping-Stone Intruders with Long Connection Chains

Cryptanalysis of three dynamic ID-based remote user authentication schemes using smart cards

Detecting stepping-stones under the influence of packet jittering

Using Dynamic Programming Techniques to Detect Multi-hop Stepping-Stone Pairs in a Connection Chain