Constructing Correlations in Attack Connection Chains Using Active Delay
Qian Li · 2005
Usually network attackers conceal their real attacking paths by establishing interactive connections along a series of intermediate hosts (stepping stones) before they attack the final target. We propose a method for detecting stepping stones by actively perturbing inter-packet delay of connections. Within the attacker's perturbation range, the method can construct correlations in attack connection chains by analyzing activity degree of correlation window and monitoring period characteristic of packets delay. The method can reduce the complexity of correlation computations and improve the efficiency of detecting stepping stones.