Accession Number:

AD1029838

Title:

Detecting a Multi-Homed Device Using Clock Skew

Descriptive Note:

Technical Report

Corporate Author:

Naval Postgraduate School Monterey United States

Personal Author(s):

• Martin,Bryan J.

Report Date:

2016-09-01

Pagination or Media Count:

61.0

Abstract:

The aim of this thesis was to determine the feasibility of identifying a device connected to the Internet through multiple interfaces i.e., multi-homed using only the information provided by passively observing network traffic. Since multi-homed hosts allow an alternate means for outside entities to circumvent the security of a firewall and gain access to a network, it is important for a networks security to be able to detect and remove such devices. In this work, the idea of using clock skewwhich is the difference in perceived time between two system clocksas a unique signature is utilized to identify hosts on a network that are potentially multi-homed. Testing was done on a software-defined network that contained a multihomed host. After traffic between hosts was collected and analyzed, analysis of the confidence intervals of the devices clock skew was conducted to determine if IP addresses originating from the same host could be successfully detected solely from network traffic. Testing confirmed that the proposed scheme provided a valid means of detecting a multi-homed device on a network. This scheme was repeated on multiple hosts and on a device with multiple connections to the network.

Descriptors:

• network protocols
• communication systems
• computer network security
• operating systems
• gaussian distributions
• random variables
• signal processing
• crystal oscillators
• test beds
• probability

Subject Categories:

• Computer Systems Management and Standards

Distribution Statement:

APPROVED FOR PUBLIC RELEASE