Tracing traffic through intermediate hosts that repacketize flows

Proceedings - IEEE INFOCOM

Volumn , Issue , 2007, Pages 634-642

  Pyun, Young June ^a   Park, Young Hee ^a   Wang, Xinyuan ^b   Reeves, Douglas S ^a   Ning, Peng ^a  

^a North Carolina State University   (United States)

^b Krasnow Institute for Advanced Study   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

PACKET NETWORKS; PERTURBATION TECHNIQUES; STATISTICAL METHODS;

FALSE POSITIVE RATES; REPACKETIZATION; TRAFFIC TRACING;

TELECOMMUNICATION TRAFFIC;

EID: 34548314612     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOM.2007.80     Document Type: Conference Paper

References (27)

1. W. T. Strayer, C. E. Jones, I. Castineyra, J. B. Levin, and R. R. Hain, "An Integrated Architecture for Attack Attribution," BBN Technologies, 10 Moulton Street, Cambridge, MA 02138, Tech. Rep. BBN REPORT-8384, Dec. 2003.
2. L. T. Heberlein and M. Bishop, "Attack Class: Address Spoofing," in Proc. of the 19th National Information Systems Security Conference (NISSC), Oct. 1996, pp. 371-377.
3. S. Staniford-Chen and L. T. Heberlein, "Holding Intruders Accountable on the Internet," in Proc. of the 1995 IEEE Symposium on Security and Privacy (S&P), May 1995, pp. 39-49.
4. D. Goldschlag, M. Reed, and P. Syverson, "Onion Routing for Anonymous and Private Internet Connections," Communications of the ACM, vol. 42, no. 3, pp. 39-4-1, Feb. 1999.
5. T. Ylonen, "The Secure Shell (SSH) Protocol Architecture," IETF RFC:4251, Jan. 2006. [Online]. Available: http://www.ietf.org/rfc/rfc4251.txt
6. S. Savage, D. Wetherall, A. R. Karlin, and T. Anderson, "Practical Network Support for IP Traceback," in Proc. of ACM SIGCOMM, Sep. 2000, pp. 295-306.
7. A. C. Snoeren, C. Partridge, L. A. Sanchez, C. E. Jones, F. Tchakountio, B. Schwartz, S. T. Kent, and W. T. Strayer, "Hash-Based IP Traceback," in Proc. of ACM SIGCOMM, Sep. 2001, pp. 3-14.
8. D. L. Donoho, A. G. Flesia, U. Shankar, V. Paxson, J. Coit, and S. Staniford, "Multiscale Stepping-Stone Detection: Detecting Pairs of Jittered Interactive Streams by Exploiting Maximum Tolerable Delay," in Proc. of the 5th International Symposium on Recent Advances in Intrusion Detection (RAID), Oct. 2002, pp. 17-35.
9. Y. Zhang and V. Paxson, "Detecting Stepping Stones," in Proc. of the 9th USENIX Security Symposium, Aug. 2000, pp. 171-184.
10. A. Blum, D. X. Song, and S. Venkataraman, "Detection of Interactive Stepping Stones: Algorithms and Confidence Bounds," in Proc. of the 7th International Symposium on Recent Advances in Intrusion Detection (RAID), Oct. 2004, pp. 258-277.
11. X. Wang and D. S. Reeves, "Robust Correlation of Encrypted Attack Traffic through Stepping Stones by Manipulation of Interpacket Delays," in Proc. of the 10th ACM conference on Computer and Communications Security (CCS), Oct. 2003, pp. 20-29.
12. X. Wang, S. Chen, and S. Jajodia, "Tracking Anonymous Peer-to-Peer VoIP Calls on the Internet," in Proc. of the 12th ACM conference on Computer and Communications Security (CCS), Nov. 2005, pp. 81-91.
13. J. Postel, "Transmission Control Protocol," IETF RFC:793, Sep. 1981. [Online], Available: http://www.ietf.org/rfc/rfc793.txt
14. X. Wang, D. S. Reeves, S. F. Wu, and J. Yuill, "Sleepy Watermark Tracing: An Active Network-Based Intrusion Response Framework," in Proc. of the 16th International Conference on Information Security (IFIP/Sec), Jun. 2001, pp. 369-384.
15. K. Yoda and H. Etoh, "Finding a Connection Chain for Tracing Intruders," in Proc. of the 6th European Symposium on Research in Computer Security (ESORICS), Oct. 2000, pp. 191-205.
16. X. Wang, D. S. Reeves, and S. F. Wu, "Inter-Packet Delay Based Correlation for Tracing Encrypted Connections through Stepping Stones," in Proc. of the 7th European Symposium on Research in Computer Security (ESORICS), Oct. 2002, pp. 244-263.
17. L. Zhang, A. Persaud, A. Johnson, and Y. Guan, "Stepping Stone Attack Attribution in Non-Cooperative IP Networks," Iowa State University, Tech. Rep. TR-2005-02-1, Feb. 2005.
18. P. Peng, P. Ning, D. S. Reeve, and X. Wang, "Active Timing-Based Correlation of Perturbed Traffic Flows with Chaff Packets," in Proc. of the 2nd International Workshop on Security in Distributed Computing Systems (SDCS), Jun. 2005, pp. 107-113.
19. M. Arnold, M. Schmucker, and S. D. Wolthusen, Techniques and Applications of Digital Watermarking and Content Protection, ser. Computer Security. Boston: Artech House, 2003.
20. B. Chen and G. W. Wornell, "Quantization Index Modulation: A Class of Provably Good Methods for Digital Watermarking and Information Embedding," IEEE Transaction on Information Theory, vol. 47, no. 4, pp. 1423-1443, May 2001.
21. W. Bender, D. Gruhl, N. Morimoto, and A. Lu, "Techniques for Data Hiding," IBM Systems Journal, vol. 35, no. 3 & 4, pp. 313-336, 1996.
22. G. Langelaar, J. van der Lubbe, and J. Biemond, "Copy Protection for Multimedia Data based on Labeling Techniques," in Proc. of the 17th Symposium on Information Theory in the Benelux, Enschede, The Netherlands, May 1996, pp. 33-39.
23. V. Paxson and S. Floyd, "Wide-Area Traffic: The Failure of Poisson Modeling," IEEE/ACM Transactions on Networking, vol. 3, no. 3, pp. 226-244, Jun. 1995.
24. P. B. Danzing and S. Jamin, "tcplib: A Library of TCP Internetwork Traffic Characteristic," Computer Science Department, University of Southern California, Report CS-SYS-91-01, 1991.
25. D. D. Wackerly, W. Mendenhall III, and R. L. Scheaffer, Mathematical Statistic with Application, 6th ed. Duxbury, 2002.
26. P. Peng, P. Ning, and D. S. Reeves, "On the Secrecy of Timing-Based Active Watermarking Trace-Back Techniques," in Proc. of the 2006 IEEE Symposium on Security and Privacy (SaP), May 2006, pp. 334-349.
27. Netfilter iptables. [Online]. Available: http://www.netfilter.org