Matching TCP Packets for Stepping-Stone Intrusion Detection Resistant to Intruders’ Chaff-Perturbation
Lixin Wang, Jianhua Yang, Kondwani Mphande, Yi Zhou · Preprints.org · 2025
Hackers usually launch cyberattacks through several stepping-stone hosts to reduce the chance of being detected. With stepping-stone intrusion (SSI), the attacker’s identity is hidden behind a long interactive connection chain of stepping-stones, and thus very difficult to reveal. Many algorithms to detect SSI have been proposed since 1995. Most of these known detection algorithms for SSI only worked for network traffic without intruders’ session manipulation. These known SSID algorithms are either weak to resist intruders’ chaff-perturbation manipulation or having very limited capability in resisting attacker’s session manipulation. This paper proposes an innovative SSID algorithm resistant to intruders’ chaff-perturbation through matching TCP packets by using crossover of packets. Our proposed SSID algorithm is verified by well-designed network experiments. Our experimental results show that the proposed SSID algorithm works effectively in detecting network intrusion as well as resisting intruders’ chaff-perturbation.