Resistance analysis to intruders’ evasion of a novel algorithm to detect stepping-stone

Authors:
Yongzhong Zhang;Jianhua Yang;Chunming Ye
Affiliations:
College of Management, the University of Shanghai for Science and Technology, Shanghai, China;Department of Computer Science, University of Houston, Houston, TX;College of Management, the University of Shanghai for Science and Technology, Shanghai, China
Venue:
ATC'06 Proceedings of the Third international conference on Autonomic and Trusted Computing
Year:
2006

Citing 9
Cited 0

Holding intruders accountable on the Internet

SP '95 Proceedings of the 1995 IEEE Symposium on Security and Privacy
Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays

Proceedings of the 10th ACM conference on Computer and communications security
A real-time algorithm to detect long connection chains of interactive terminal sessions

InfoSecu '04 Proceedings of the 3rd international conference on Information security
Matching TCP Packets and Its Application to the Detection of Long Connection Chains on the Internet

AINA '05 Proceedings of the 19th International Conference on Advanced Information Networking and Applications - Volume 1
Active Timing-Based Correlation of Perturbed Traffic Flows with Chaff Packets

ICDCSW '05 Proceedings of the Second International Workshop on Security in Distributed Computing Systems (SDCS) (ICDCSW'05) - Volume 02
Detecting stepping stones

SSYM'00 Proceedings of the 9th conference on USENIX Security Symposium - Volume 9
Detecting long connection Chains of interactive terminal sessions

RAID'02 Proceedings of the 5th international conference on Recent advances in intrusion detection
Multiscale stepping-stone detection: detecting pairs of jittered interactive streams by exploiting maximum tolerable delay

RAID'02 Proceedings of the 5th international conference on Recent advances in intrusion detection
Probabilistic proof of an algorithm to compute TCP packet round-trip time for intrusion detection

ACNS'06 Proceedings of the 4th international conference on Applied Cryptography and Network Security

Quantified Score

Hi-index	0.01

Visualization

Abstract

Most intruders used to make use of stepping-stones to launch their attacks for safety reason. Some of them even evade stepping-stone detection by conducting manipulations. Most of the approaches proposed to detect stepping-stone are vulnerable in detecting intruders’ evasion, such as time perturbation, and chaff perturbation. In this paper, we propose a new algorithm to detect stepping-stone by comparing the self and cross packet matching rates of a session. The analysis and simulation results show that this algorithm detects not only stepping-stone without misdetection, but also intruder’s evasion with less limitation. It can resist to intruders’ time perturbation completely, as well as chaff perturbation.