Detecting encrypted stepping-stone connections

IEEE Transactions on Signal Processing

Volumn 55, Issue 5 I, 2007, Pages 1612-1623

  He, Ting ^a   Tong, Lang ^a  

^a School of Operations Research and Industrial Engineering   (United States)

Author keywords

Intrusion detection; Network security; Nonparametric detection; Testing on point processes

Indexed keywords

COMPUTER SIMULATION; INTERNET; INTRUSION DETECTION; NETWORK SECURITY; PACKET NETWORKS; PERTURBATION TECHNIQUES; POISSON DISTRIBUTION; TELECOMMUNICATION TRAFFIC;

BOUNDED DELAY PERTURBATION; NONPARAMETRIC DETECTION; STEPPING-STONE CONNECTIONS;

CRYPTOGRAPHY;

EID: 34247844336     PISSN: 1053587X     EISSN: None     Source Type: Journal    
DOI: 10.1109/TSP.2006.890881     Document Type: Article

References (15)

1. S. Staniford-Chen and L. Heberlein, "Holding intruders accountable on the internet," in Proc. IEEE Syrup. Security Privacy, 1995, pp. 39-49.
2. D. Donoho, A. Flesia, U. Shankar, V. Paxson, J. Coit, and S. Staniford, "Multiscale stepping-stone detection: Detecting pairs of jittered interactive streams by exploiting maximum tolerable delay," in Proc. 5th Int. Symp. Recent Adv. Intrusion Detection, Lecture Notes Comput. Sci. 2516, 2002, pp. 17-35.
3. X. Wang, D. Reeves, S. Wu, and J. Yuill, "Sleepy watermark tracing: An active network-based intrusion response framework," in Proc. 16th Int. Inf. Security Conf., 2001, pp. 369-384.
4. Y. Zhang and V. Paxson, "Detecting stepping stones," in Proc. 9th USENIX Security Syrup., 2000, pp. 171-184.
5. K. Yoda and H. Etoh, "Finding a connection chain for tracing intruders," in Proc. 6th Eur. Symp. Res. Comput. Security, Lecture Notes Comput. Sci. 1895, 2000, pp. 191-205.
6. X. Wang, D. Reeves, and S. Wu, "Inter-packet delay-based correlation for tracing encrypted connections through stepping stones," in Proc. 7th Eur. Syrup. Research Comput. Security, Lecture Notes Comput. Sci. 2502, 2002, pp. 244-263.
7. X. Wang and D. Reeves, "Robust correlation of encrypted attack traffic through stepping stones by manipulation of inter-packet delays," in Proc. ACM Conf. Comput. Commun. Security, 2003, pp. 20-29.
8. A. Blum, D. Song, and S. Venkataraman, "Detection of interactive stepping stones: Algorithms and confidence bounds," in Proc. Conf. Adv. Intrusion Detection (RAID), 2004, pp. 258-277.
9. P. Peng, P. Ning, D. Reeves, and X. Wang, "Active timing-based correlation of perturbed traffic flows with chaff packets," in Proc. 25th IEEE Int. Conf. Distrib. Comput. Syst. Workshops, 2005, pp. 107-113.
10. L. Zhang, A. Persaud, A. Johson, and Y. Guan, "Detection of stepping stone attack under delay and chaff perturbations," presented at the 25th IEEE Int. Perform. Comput. Commun. Conf. (IPCCC), Phoenix, AZ, 2006.
11. T. He and L. Tong, "A signal processing perspective to stepping-stone detection," presented at the Conf. Inf. Set. Syst., Princeton, NJ, 2006.
12. J. Giles and B. Hajek, "An information-theoretic and game-theoretic study of timing channels," IEEE Trans. Inf. Theory, vol. 48, no. 9, pp. 2455-2477, Sep. 2002.
13. V. Paxson and S. Floyd, "Wide-area traffic: The failure ofpoisson modeling," IEEE/ACM Trans. Netw., vol. 3, pp. 226-244, Jun. 1995.
14. X. Wang, "The loop fallacy and serialization in tracing intrusion connections through stepping stones," in Proc. ACA Symp. Appl. Comput., 2004, pp. 404-411.
15. D. Cox and H. Miller, The Theory of Stochastic Processes. New York: Wiley, 1965.