Detecting stepping-stone intrusion and resisting evasion through TCP/IP packets cross-matching

Abstract

In this paper, we propose a cross-matching algorithm that can detect stepping-stone intrusion. The theoretical analysis of this algorithm shows that it can completely resist intruder's time-jittering evasion. The results of the experiments and the simulation show that this algorithm can also resist intruders' chaff-perturbation with chaff-rate up to 80%. Compared with A. Blum's approach, which can resist chaff-perturbation with every x inserted packets out of 8*(x+1), this approach has promising performance in terms of resistance to intruders' manipulation. © 2008 Springer-Verlag Berlin Heidelberg.