A Survey of Research in Stepping-Stone Detection

Robert Shullich ； Jie Chu ； Ping Ji ； Wei-Feng Chen

《International Journal of Electronic Commerce Studies》 2卷2期 (2011/12) Pp. 103-126

並列摘要

Stepping-stone is a method that directs network connections from an attacker to a victim through one or more intermediate compromised systems or devices. The objective of this scheme is to hide the attacker's identity (provide anonymity) and make traceback either difficult or impossible. Evasion techniques that are used to hide this process include encryption, introduction of dummy packets (chaff) into the stream, introducing delay into the timing of the packet stream, using multiple compromised hosts in long connection chains (many hops), and intermixing command and control traffic with multimedia traffic to mask traffic characteristics. This paper provides a survey that focuses on characteristic based, interactive stepping-stone detection and analysis techniques. An overview of the field of research is presented with critique of some of the methods used. We also provide some interesting topics for additional research.

並列關鍵字

Network Security ； Intrusion Detection ； Stepping-Stone ； Connection Chain ； Chaff ； Watermarking ； Information Flow Detection ； Flow Correlation ； Stepping-Stone Intrusion

參考文獻

H.-C. Wu, and S.-H. Huang, Performance of neural networks in stepping-stone intrusion detection. IEEE International Conference on Networking, Sensing and Control, Hainan, China, April 6-8, 2008.

H.-C. Wu, and S.-H. S. Huang, Neural networks-based detection of stepping-stone intrusion. Expert Systems with Applications, 37(2),p1431-1437, 2010.

A. Almulhem, and I. Traore, Detecting connection-chains: A data mining approach. International Journal of Network Security, 10(1), p62-74, 2008.

S.-H. Huang, R. Lychev, and J. Yang, Stepping-Stone detection via Request-Response traffic analysis. Leture Notes in Computer Science. 276-285, 4610, 2007

Y. J. Pyun, Y. H. Park, X. Wang, D. S. Reeves, and P. Ning, Tracing traffic through intermediate hosts that repacketize flows. IEEE International Conference on Computer Communications, Anchorage, Alaska, USA, May 6-12 , 2007.