Architecture for multi-stage network attack traceback

Proceedings - Conference on Local Computer Networks, LCN

Volumn 2005, Issue , 2005, Pages 776-783

  Strayer, W Timothy ^a   Jones, Christine E ^a   Schwartz, Beverly I ^a   Mikkelson, Joanne ^a   Livadas, Carl ^a  

^a BBN TECHNOLOGIES   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

INGRESS ROUTER; OBFUSCATION; SOURCE PATH ISOLATION ENGINE (SPIE); STEALTHY TRACING ATTACKERS RESEARCH LIGHT TRACE (STARLITE);

COMPUTATIONAL METHODS; COMPUTER CRIME; COMPUTER SCIENCE; PACKET NETWORKS; ROUTERS; SOFTWARE PROTOTYPING;

COMPUTER NETWORKS;

EID: 33751394438     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/LCN.2005.33     Document Type: Conference Paper

References (18)

1. Howard, J. D., "An Analysis of Security Incidents on the Internet, 1989-1995," PhD Thesis, Apr. 1997.
2. Lawrence A. Gordon, Martin P. Loeb, William Lucyshyn, and Robert Richardson, "2004 CSI/FBI Computer Crime and Security Survey," Ninth Annual Report, Computer Security Institute, Aug 2004.
3. S. Bellovin, "ICMP Traceback," Message to the IETF ICMP Traceback WG, http://www.research.att.com/~smb
4. S. Savage, D. Wetherall, A. Karlin, and T. Anderson, "Practical Network Support for IP Traceback," Proc. ACM SIGCOMM '00, August 2000.
5. H. Burch, B. Cheswick, "Tracing Anonymous Packets to Their Approximate Source," Proceedings of USENIX LISA '00, December 2000.
6. D. Song and A. Perrig, "Advanced and Authenticated Marking Schemes for IP Traceback," Proc. IEEE INFOCOM 2002, April 2001.
7. A.C. Snoeren, C. Partridge, L.A. Sanchez, C.E. Jones, F. Tchakountio, B. Schwartz, S.T. Kent, and W.T. Strayer, "Single-Packet IP Traceback," ACM/IEEE Transactions on Networks, Dec 2002.
8. Egevang, K., and Francis, P., "The IP Network Address Translator," RFC 1631, May 1994.
9. Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G. J., and Lear, E., "Address Allocation for Private Internets," RFC 1918, February 1996.
10. Staniford-Chen, S., and Heberlein, L. T., "Holding Intruders Accountable on the Internet," Proceedings of the IEEE Symposium on Security and Privacy '95.May 1995, pp. 39-49.
11. Wang, X., and Reeves, D. S., "Robust Correlation of Encrypted Attack Traffic through Stepping Stones by Manipulation of Interpacket Delays," Proceedings of the ACM Symposium on Computer and Communications Security (CCS), October 2003.
12. Zhang, Y., and Paxson, V., "Detecting Stepping Stones," Proceedings of the USENIX Security Symposium '00, August 2000, pp. 171-184.
13. Yoda, K., and Etoh, H., "Finding a Connection Chain for Tracing Intruders," Proceedings of the European Symposium on Research in Computer Security, October 2000, pp. 191-205.
14. Donoho, D. L., Flesia, A. G., Shankar, U., Paxson, V., Coit, J., and Staniford, S., "Multiscale Stepping-Stone Detection: Detecting Pairs of Jittered Interactive Streams by Exploiting Maximum Tolerable Delay," Proceedings of the International Symposium on Recent Advances in Intrusion Detection (Oct. 2002), pp. 17-35.
15. Avrim Blum, Dawn Song, and Shobha Venkataraman, "Detection of Interactive Stepping Stones: Algorithms and Confidence Bounds," Proceedings of the Conference of Recent Advance in Intrusion Detection (RAID) 2004.
16. W.T. Strayer, C.E. Jones, I. Castineyra, J. Levin, and R. Rosales Hain, "An Integrated Architecture for Attack Attribution," BBN Report 8384, Dec 31, 2003.
17. Paxson, V., "Bro: A System for Detecting Network Intruders in Real-time," Proceedings of the USENIX Security Symposium, January 1998, pp. 1-11.
18. C.E. Jones, J. Mikkelson, B. Schwartz, C. Livadas, and W.T. Strayer, "STARLITE Experiment Results," BBN Technical Memo 2010, May 2005.