Probabilistic proof of an algorithm to compute TCP packet round-trip time for intrusion detection

Authors:
Jianhua Yang;Yongzhong Zhang
Affiliations:
Department of Computer Science, University of Houston, Houston, TX;Department of Computer Science, Shanghai TV University, Shanghai, China
Venue:
ACNS'06 Proceedings of the 4th international conference on Applied Cryptography and Network Security
Year:
2006

Citing 7
Cited 1

Finding a Connection Chain for Tracing Intruders

ESORICS '00 Proceedings of the 6th European Symposium on Research in Computer Security
Holding intruders accountable on the Internet

SP '95 Proceedings of the 1995 IEEE Symposium on Security and Privacy
Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays

Proceedings of the 10th ACM conference on Computer and communications security
Matching TCP Packets and Its Application to the Detection of Long Connection Chains on the Internet

AINA '05 Proceedings of the 19th International Conference on Advanced Information Networking and Applications - Volume 1
Detecting stepping stones

SSYM'00 Proceedings of the 9th conference on USENIX Security Symposium - Volume 9
Detecting long connection Chains of interactive terminal sessions

RAID'02 Proceedings of the 5th international conference on Recent advances in intrusion detection
Multiscale stepping-stone detection: detecting pairs of jittered interactive streams by exploiting maximum tolerable delay

RAID'02 Proceedings of the 5th international conference on Recent advances in intrusion detection

Resistance analysis to intruders’ evasion of a novel algorithm to detect stepping-stone

ATC'06 Proceedings of the Third international conference on Autonomic and Trusted Computing

Quantified Score

Hi-index	0.00

Visualization

Abstract

Most network intruders tend to use stepping-stones to attack or invade other hosts to reduce the risks of being discovered. One typical approach for detecting stepping-stone intrusion is to estimate the number of connections of an interactive session by using the round-trip times (RTTs) of all Send packets. The key of this approach is to match TCP packets, or compute the RTT of each Send packet. Previous methods, which focus on matching each Send packet with its corresponding Echo packet to compute RTTs, have tradeoff between packet matching-rate and matching-accuracy. In this paper, we first propose and prove a clustering algorithm to compute the RTTs of the Send packets of a TCP interactive session, and show that this approach can compute RTTs with both high matching-rate and high matching-accuracy.