The loop fallacy and deterministic serialisation in tracing intrusion connections through stepping stones

International Journal of Security and Networks

Volumn 1, Issue 3-4, 2006, Pages 184-197

  Wang, Xinyuan ^a  

^a GEORGE MASON UNIVERSITY   (United States)

Author keywords

correlation; intrusion tracing; serialisation; stepping stones

Indexed keywords

EID: 77955716028     PISSN: 17478405     EISSN: 17478413     Source Type: Journal    
DOI: 10.1504/ijsn.2006.011778     Document Type: Article

References (21)

1. Blum, A., Song, D. and Venkataraman, S. (2004) ‘Detection of interactive stepping stones: algorithms and confidence bounds’, Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection (RAID 2004) LNCS-3224, Springer, October pp.258–277.
2. Donoho, D., Flesia, A.G., Shanka, U., Paxson, V., Coit, J. and Staniford, S. (2002) ‘Multiscale stepping stone detection: detecting pairs of jittered interactive streams by exploiting maximum tolerable delay’, Proceedings of the Fifth International Symposium on Recent Advances in Intrusion Detection (RAID 2002) LNCS-2516, Springer, October pp.17–35.
3. Goodrich, M.T. (2002) ‘Efficient packet marking for large-scale IP traceback’, Proceedings of the Ninth ACM Conference on Computer and Communications Security (CCS 2002), ACM, October pp.117–126.
4. Jung, H., et al. (1993) ‘Caller identification system in the internet environment’, Proceedings of the Fourth USENIX Security Symposium, pp.69–78.
5. Kohno, T., Broido, A. and Claffy, K. (2005) ‘Remote physical device fingerprinting’, Proceedings of IEEE Symposium on Security and Privacy, IEEE, pp.211–225.
6. Li, J., Sung, J., Xu, J. and Li, L. (2004) ‘Large scale IP traceback in high-speed internet: practical techniques and theoretical foundation’, Proceedings of the 2004 IEEE Symposium on Security and Privacy, IEEE, pp.115–129.
7. Machover, M. (1996) Set Theory, Logic and Their Limitations, Cambridge University Press.
8. Savage, S., Wetherall, D., Karlin, A. and Anderson, T. (2000) ‘Practical network support for IP traceback’, Proceedings of the ACM SIGCOMM 2000, ACM, September pp.295–306.
9. Snapp, S., et al. (2001) ‘DIDS (Distributed intrusion detection system) - motivation, architecture and early prototype’, Proceedings of the 14th National Computer Security Conference, pp.167–176.
10. Snoeren, A., et al. (2001) ‘Hash-based IP traceback’, Proceedings of ACM SIGCOMM 2001, ACM, September, pp.3–14.
11. Staniford-Chen, S. and Heberlein, L.T. (1995) ‘Holding intruders accountable on the internet’, Proceedings of the 1995 IEEE Symposium on Security and Privacy, pp.39–49.
12. Stoll, C. (2000) The Cuckoo’s Egg: Tracking Spy through the Maze of Computer Espionage, Pocket Books, October.
13. Wang, X. (2004) ‘The loop fallacy and serialization in tracing intrusion connections through stepping stones’, Proceedings of the 19th ACM Symposium on Applied Computing (SAC 2004 Track on Computer Security), March, pp.404–411.
14. Wang, X. and Reeves, D.S. (2003) ‘Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays’, Proceedings of the 10th ACM Conference on Computer and Communications Security (CCS 2003), October, pp.20–29.
15. Wang, X., Reeves, D.S. and Wu, S.F. (2002) ‘Inter-packet delay based correlation for tracing encrypted connections through stepping stones’, D. Gollmann, G. Karjoth and M. Waidner, (Eds). Seventh European Symposium on Research in Computer Security (ESORICS’2002) LNCS-2502, October, pp.244–263.
16. Wang, X., Reeves, D.S., Wu, S.F. and Yuill, J. (2001a) ‘Sleepy watermark tracing: an active network-based intrusion response framework’, Proceedings of 16th International Conference on Information Security (IFIP/Sec’01), June, pp.369–384.
17. Yoda, K. and Etoh, H. (2000) ‘Finding a connection chain for tracing intruders’, F. Guppens, Y. Deswarte, D. Gollmann and M. Waidner, (Eds). Sixth European Symposium on Research in Computer Security (ESORICS’2000) LNCS-1895, October, pp.191–205.
18. Yung, K.H. (2002) ‘Detecting long connection chains of interactive terminal sessions’, Proceedings of the Fifth International Symposium on Recent Advances in Intrusion Detection (RAID’2002) LNCS-2516, October, pp.1–16.
19. Zhang, Y. and Paxson, V. (2001) ‘Detecting stepping stones’, Proceedings of the Ninth USENIX Security Symposium, pp.171–184.
20. Since we assume we have a perfect correlation solution that gives us all and only those connections in a connection chain.
21. We will define subsequence later in the section.