A Review on Detecting Stepping Stone Intrusion
Intsar Ibraheem Ahmed Alhaj, Mohd Aizaini Maarof, Kamalrulnizam Abu Bakar · 2008
based attackers do not launch the attack from their own host, instead they use intermediary previously compromised hosts to login remotely to some host and from that host logging to another host and so on, and they launch the attack on behalf of the last host in the chain. Those hosts are called stepping stones and this type of attack is known as stepping stones intrusion. They complicated the detection by enlarge this host chain. Many algorithms had bee proposed and they vary on how to detect those hosts that used as a stepping stone according to detect the intrusion. This paper review the stepping stones intrusion and the algorithms used to detect such type of intrusion and how they vary in detecting stepping stone and their resistance to time jittering and chaff attack perturbation.