Sniffing Detection Based on Network Traffic Probing and Machine Learning

Abstract

Cyber attacks are on the rise and each day cyber criminals are developing more and more sophisticated methods to compromise the security of their targets. Sniffing is one of the most important techniques that enables the attacker to collect information on the vulnerabilities of the devices, protocols and applications that can be exploited within the targeted network. It relies mainly on passively analyzing the traffic exchanged within the network, and due to its nature, such an activity is difficult to discover. That is why, in this article, we first revisit existing techniques and tools that can be used to perform sniffing as well as the corresponding mitigation methods. Based on this background, we propose a novel measurement-based detection method that infers whether the sniffing software is active on the suspected machine by network traffic probing and machine learning techniques. The presented experimental results prove that the proposed solution is effective.

Active Eavesdroppers Detection System in Multi-hop Wireless Sensor Networks

“…Most of the work in the literature has tried to mitigate the effectiveness of passive eavesdroppers. For instance, papers [7], [10], [13], [14] focused on how to decrease the probability of sniffing packets via eavesdroppers in wireless networks by using information theory, jamming, or power control techniques. However, these techniques, like power transmission control [13], may increase the probability of capturing packets by the active eavesdroppers, or even they are fruitless in the face of them [12].…”

“…From a broad perspective, there are two major methods to detect sniffers or eavesdroppers in all types of networks [14]:…”

“…In order to do this, we can provoke or stimulate the suspicious nodes by sending them some special packets. For example, in a normal condition, nodes usually do not respond to packets that are not destined to them, but when they are in sniffing mode, they might respond to unrelated packets wrongly [14].…”

“…Since there are some flaws or bugs in the kernel of sniffers, they will send the captured packets into the above layers. Then the OS responds to them wrongly, so the detectors are monitoring their responses, and if there is a response for the challenged packets, the detectors will send an alarm of sniffing detection [14], [32].…”

Attackdet: Combining web data parsing and real-time analysis with machine learning

“…We faced several main is-sues at this point, which gave us a hard time [29]. The irst dif iculty was sending the parsed packets captured by way of snif ing the network instantaneously [30,31] to the web application and displaying them as graphs. Because no other process can be performed when the network is sniffed.…”