Stepping stone detection at the server side
Ruei-Min Lin, Yi-Chun Chou, Kuan-Ta Chen · 2011
Proxy server was originally invented to enhance the performance of web browsing; however, it has been commonly used to perform online crime and malicious activities without being traced. Nevertheless, there is no general method available for detecting the use of stepping stones from the server's perspective. In this paper, based on Nagle's algorithm, we propose a server-based scheme to detect whether a host that establishes a TCP connection to the server is a stepping stone or not. Via Internet experiments on the PlanetLab, we show that our scheme achieves an average of 92% detection rate whenever our scheme applies. We believe the scheme, as a strong complement to current methods, can secure critical Internet services from being jeopardized by anonymous attacks.