Constructing Correlations in Attack Connection Chains via Increasing Delay
Jiubin Ju · Journal of Jilin University(Science Edition) · 2006
A method is proposed for detecting stepping stones by actively perturbing inter-packet delay of(connections),by which the average value of the packets in the detecting window is set to increase periodically(within) the attacker's perturbation range.The correlations in attacking connection chains can be constructed by(analyzing) the increase of the average value of the inter-packet delay between the two connection chains.The complexity of correlation computations can be reduced and the efficiency of detecting stepping stones can be improved by means of the method.