A detection algorithm based on a stochastic model of stepping stone connections in a WLAN is developed and analyzed. Assuming that an attacker uses a compromised stepping stone to make a random number of camouflaged interactions with the victim (target) until the stepping stone is detected, the probability density function of the time of detection of the stepping stone is explicitly found. This density is used to obtain the mean time of detection of the stepping stones.

intrusion, stepping stone attack, maximum tolerance delay, false-positive probability, stochastic point process, probability density function, mean number.