Detection of Interactive Stepping Stones: Algorithms and Confidence Bounds

  • Avrim Blum
  • Dawn Song
  • Shobha Venkataraman
Conference paper

DOI: 10.1007/978-3-540-30143-1_14

Part of the Lecture Notes in Computer Science book series (LNCS, volume 3224)
Cite this paper as:
Blum A., Song D., Venkataraman S. (2004) Detection of Interactive Stepping Stones: Algorithms and Confidence Bounds. In: Jonsson E., Valdes A., Almgren M. (eds) Recent Advances in Intrusion Detection. RAID 2004. Lecture Notes in Computer Science, vol 3224. Springer, Berlin, Heidelberg

Abstract

Intruders on the Internet often prefer to launch network intrusions indirectly, i.e., using a chain of hosts on the Internet as relay machines using protocols such as Telnet or SSH. This type of attack is called a stepping-stone attack. In this paper, we propose and analyze algorithms for stepping-stone detection using ideas from Computational Learning Theory and the analysis of random walks. Our results are the first to achieve provable (polynomial) upper bounds on the number of packets needed to confidently detect and identify encrypted stepping-stone streams with proven guarantees on the probability of falsely accusing non-attacking pairs. Moreover, our methods and analysis rely on mild assumptions, especially in comparison to previous work. We also examine the consequences when the attacker inserts chaff into the stepping-stone traffic, and give bounds on the amount of chaff that an attacker would have to send to evade detection. Our results are based on a new approach which can detect correlation of streams at a fine-grained level. Our approach may also apply to more generalized traffic analysis domains, such as anonymous communication.

Keywords

Network intrusion detection Evasion Stepping stones Interactive sessions Random walks 

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2004

Authors and Affiliations

  • Avrim Blum
    • 1
  • Dawn Song
    • 1
  • Shobha Venkataraman
    • 1
  1. 1.Carnegie Mellon UniversityPittsburghUSA

Personalised recommendations