A New Model to Detect Stepping-Stone Intrusion

Most researchers do not distinguish stepping-stone detection and stepping-stone intrusion detection, thus introduce more false positive errors in detecting stepping-stone intrusion. Those approaches proposed to detect stepping-stone intrusion are vulnerable to intruders´ evasion. In this paper we analyze the problems of the current model used to detect stepping-stone, and propose a new model based on computing the length of an interactive TCP/IP session to detect stepping-stone intrusion. Besides the advantage of low false positive rate, we demonstrate that an approach based on the new model can resist intruders´ evasion, such as time-jittering, and chaff-perturbation.