Stepping-stone Detection Technique Forrecognizing Legitimate and Attack Connections
نویسندگان
چکیده
A stepping-stone connection has always been assumed as an intrusion since the first research on stepping-stone connections twenty years ago. However, not all stepping-stone connections are malicious. This paper proposes an enhanced stepping-stone detection (SSD) technique which is capable to identify legitimate connections from stepping-stone connections. Stepping-stone connections are identified from raw network traffics using timing-based SSD approach. Then, they go through an anomaly detection technique to differentiate between legitimate and attack connections. This technique has a promising solution to accurately detecting intrusions from stepping-stone connections. It will prevent incorrect responses that punish legitimate users.
منابع مشابه
An Integrated Architecture for Attack Attribution
Anonymity is important to perpetrators of network-based attacks. One of the simplest ways to remain anonymous is to hide the source of an attack by chaining together multiple connections into an extended connection. This is typically done by logging into a remote host, then from there logging into a third and fourth and so on until, at the final host, an attack is launched. These intermediate h...
متن کاملDetecting Anomalies in Active Insider Stepping Stone Attacks
Network attackers frequently use a chain of compromised intermediate nodes to attack a target machine and maintain anonymity. This chain of nodes between the attacker and the target is called a stepping stone chain. Various classes of algorithms have been proposed to detect stepping stones, timing correlation based algorithms being a recent one that is attracting significant research interest. ...
متن کاملImproving Stepping Stone Detection Algorithms using Anomaly Detection Techniques
Network attackers frequently use a chain of compromised intermediate nodes to attack a target machine and maintain anonymity. This chain of nodes between the attacker and the target is called a stepping stone chain. Various algorithms have been proposed to detect stepping stones, timing correlation based algorithms being one of them. However, the existing timing based algorithms are susceptible...
متن کاملInter-Packet Delay Based Correlation for Tracing Encrypted Connections through Stepping Stones
Network based intrusions have become a serious threat to the users of the Internet. Intruders who wish to attack computers attached to the Internet frequently conceal their identity by staging their attacks through intermediate “stepping stones”. This makes tracing the source of the attack substantially more difficult, particularly if the attack traffic is encrypted. In this paper, we address t...
متن کاملF-STONE: A Fast Real-Time DDOS Attack Detection Method Using an Improved Historical Memory Management
Distributed Denial of Service (DDoS) is a common attack in recent years that can deplete the bandwidth of victim nodes by flooding packets. Based on the type and quantity of traffic used for the attack and the exploited vulnerability of the target, DDoS attacks are grouped into three categories as Volumetric attacks, Protocol attacks and Application attacks. The volumetric attack, which the pro...
متن کامل