Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2003, Pages 20-29

  Wang, Xinyuan ^a   Reeves, Douglas S ^b  

^a North Carolina State University   (United States)

^b NORTH CAROLINA STATE UNIVERSITY   (United States)

Author keywords

Correlation; Intrusion Tracing; Robustness; Stepping Stones

Indexed keywords

CORRELATION METHODS; PACKET NETWORKS; PERTURBATION TECHNIQUES; RANDOM PROCESSES; RELIABILITY; ROBUSTNESS (CONTROL SYSTEMS); SECURITY SYSTEMS;

ENCRYPTED ATTACKS; INTERPACKET DELAYS; INTRUSION TRACING; STEPPING STONES;

CRYPTOGRAPHY;

EID: 2442556704     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/948109.948115     Document Type: Conference Paper

References (20)

1. I. J. Cox, M. L. Miller and J. A. Bloom. Digital Watermarking. Morgan-Kaufmann Publishers, 2002.
2. P. B. Danzig and S. Jamin. tcplib: A Library of TCP Internetwork Traffic Characteristics. USC Technical Report, USC-CS-91-495.
3. P. B. Danzig, S. Jamin, R. Cacerest, D. J. Mitzel and E. Estrin. An Empirical Workload Model for Driving Wide-Area TCP/IP Network Simulations. In Journal of Internetworking 3:1, pages 1-26 March 1992.
4. M. H. DeGroot. Probability and Statistics. Addison-Wesley Publishing Company, 1989.
5. th International Symposium on Recent Advances in Intrusion Detection (RAID 2002), October, 2002. Springer Verlag Lecture Notes in Computer Science, #2516.
6. M. T. Goodrich. Efficient Packet Marking for Large-Scale IP Traceback. In Proceedings of 9th ACM Conference on Computer and Communication Security CCS'02, pages 117-126, October 2002.
7. H. Jung, et al. Caller Identification System in the Internet Environment. In Proceedings of 4th USENIX Security Symposium, 1993.
8. S. Kent, R. Atkinson. Security Architecture for the Internet Protocol. IETF RFC 2401, September 1998.
9. NLANR Trace Archive. http://pma.nlanr.net/Traces/long/.
10. OpenSSH. http://www.openssh.com.
11. S. Savage, D. Wetherall, A. Karlin and T. Anderson. Practical Network Support for IP Traceback. In Proceedings of the ACM SIGCOMM 2000, April 2000.
12. S. Snapp, et al. DIDS (Distributed Intrusion Detection System) - Motivation, Architecture and Early Prototype. In Proceedings of 14th National Computer Security Conference, pages 167-176, 1991.
13. D. Song and A. Perrig. Advanced and Authenticated Marking Scheme for IP Traceback. In Proceedings of IEEE INFOCOM'01, April 2001.
14. S. Staniford-Chen, L. T. Heberlein. Holding Intruders Accountable on the Internet. In Proceedings of the IEEE Symposium on Security and Privacy, May 1995.
15. C. Stoll. The Cuckoo's Egg: Tracking Spy through the Maze of Computer Espionage. Pocket Books, October 2000.
16. th European Symposium on Research in Computer Security - ESORICS 2002, October 2002. Springer-Verlag Lecture Notes in Computer Science #2502.
17. X. Wang, D. S. Reeves, S. F. Wu and J. Yuill. Sleepy Watermark Tracing: An Active Network-Based Intrusion Response Framework. In Proceedings of 16th International Conference on Information Security (IFIP/Sec '01), June, 2001.
18. T. Ylonen, et al. SSH Protocol Architecture. IETF Internet Draft: draft-ietf-secsh-architecture-4.txt, July 2003.
19. th European Symposium on Research in Computer Security - ESORICS 2000, October 2000. Springer-Verlag Lecture Notes in Computer Science #1895
20. Y. Zhang and V. Paxson. Detecting Stepping Stones. In Proceedings of the 9th USENIX Security Symposium, pages 171-184, 2000.