NDLI: Detecting Chaff Perturbation on Stepping-Stone Connection

Content Provider	IEEE Xplore Digital Library
Author	Huang, S.-S.S. Ying-Wei Kuo
Copyright Year	2011
Abstract	Cyber criminals often use a sequence of intermediate "stepping-stone" hosts to attack a target machine in order to maintain anonymity. This type of attack of using a connection chain is called stepping-stone attack. Most existing algorithms to detect such attack is to use timing-based correlation on the connections. However, these timing-based approaches are vulnerable if the intruders add chaff packets to evade the detection. The stepping-stone detection rate decreases as the chaff rate increases. We developed a novel anomaly detection algorithm to detect the presence of chaff in a connection by monitoring the packet inter-arrival times. Our study shows the probability distribution of the inter-arrival time of a chaffed connection differs from that of one without chaff. Our experiments show the detection rate as a function of the chaff rate under a variety of complex circumstances. The new algorithm complements the existing correlation-based stepping-stone detection algorithms in providing a more robust solution to stepping-stone detection.
Starting Page	660
Ending Page	667
File Size	745765
Page Count	8
File Format	PDF
ISBN	9781457718755
ISSN	15219097
e-ISBN	9780769545769
DOI	10.1109/ICPADS.2011.51
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2011-12-07
Publisher Place	Taiwan
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Feature extraction Detection algorithms Testing Mathematical model Correlation Data models Classification algorithms distributed computing Stepping-stone intrusion detection network security chaff evasion technique packet inter-arrival time model
Content Type	Text
Resource Type	Article
Subject	Hardware and Architecture

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in