DocumentCode :
781873
Title :
Detecting Encrypted Stepping-Stone Connections
Author :
He, Ting ; Tong, Lang
Author_Institution :
Sch. of Electr. & Comput. Eng., Cornell Univ., Ithaca, NY
Volume :
55
Issue :
5
fYear :
2007
fDate :
5/1/2007 12:00:00 AM
Firstpage :
1612
Lastpage :
1623
Abstract :
Stepping-stone attacks are often used by network intruders to hide their identities. In a stepping-stone attack, attacking commands are sent indirectly to the victim through a chain of compromised hosts acting as "stepping stones." In defending against such attacks, it is necessary to detect stepping-stone connections at the compromised hosts. The use of encrypted connections by the attacker complicates the detection problem and the attacker\´s active timing perturbation and insertion of chaff make it even more challenging. This paper considers strategies to identify stepping-stone connections when the attacker is able to encrypt the attacking packets and perturb their timing. Furthermore, the attacker can also add chaff packets in the attacking stream. The paper first considers stepping-stone connections subject to packet-conserving transformations by the attacker. Two activity-based algorithms are proposed to detect stepping-stone connections with bounded memory or bounded delay perturbation, respectively. These algorithms are proven to have exponentially decaying false alarm probabilities if normal traffic can be modelled as Poisson processes. It is shown that the proposed algorithms improve the performance of an existing stepping-stone detection algorithm. This paper then addresses the detection of stepping-stone connections with both timing perturbation and chaff. Robust algorithms are developed to deal with chaff evasion. It is proven that the proposed robust algorithms can tolerate a number of chaff packets proportional to the size of the attacking traffic, and have vanishing false alarm probabilities for Poisson traffic. Simulations using synthetic data are used to validate the theoretical analysis. Further results using actual Internet traces are shown to demonstrate the performance of the proposed algorithms
Keywords :
Internet; security of data; stochastic processes; telecommunication traffic; Internet; Poisson processes; Poisson traffic; active timing perturbation; activity-based algorithms; encrypted stepping-stone connections; false alarm probabilities; packet-conserving transformations; stepping-stone detection algorithm; Cryptography; Delay; Detection algorithms; Government; Helium; Robustness; Signal processing algorithms; Telecommunication traffic; Timing; Traffic control; Intrusion detection; network security; nonparametric detection; testing on point processes;
fLanguage :
English
Journal_Title :
Signal Processing, IEEE Transactions on
Publisher :
ieee
ISSN :
1053-587X
Type :
jour
DOI :
10.1109/TSP.2006.890881
Filename :
4156390
Link To Document :
بازگشت