Detection of Rogue ICMP Traffic Using Fuzzy Logic

Internet Control Message Protocol (ICMP) is a network-layer protocol used in IP networks for reporting errors and providing feedback about the condition and status of a network defined by RFC 792. ICMP is generally allowed in all networks since it is used for diagnostic purposes. Moreover, ICMP can be modified, to extend its usage. However, this rises challenges of separating malicious from legitimate traffic. As a modifiable protocol, it is ideal for being used in covert channels in addition to flooding attacks. In this paper, a technique for detecting rogue ICMP traffic using fuzzy logic is proposed. The proposed method allows for a smart decision-making approach implemented in Python and achieves a detection rate of 100% against rogue and covert channel ICMP traffic used in exfiltration.