Detection of stepping stone attack under delay and chaff perturbations

IEEE Trans. Signal Process.

2007

Abstract-Stepping-stone attacks are often used by network intruders to hide their identities. In a stepping-stone attack, attacking commands are sent indirectly to the victim through a chain of compromised hosts acting as "stepping stones." In defending against such attacks, it is necessary to detect stepping-stone connections at the compromised hosts. The use of encrypted connections by the attacker complicates the detection problem and the attacker's active timing perturbation and insertion of chaff make it even more challenging. This paper considers strategies to identify stepping-stone connections when the attacker is able to encrypt the attacking packets and perturb their timing. Furthermore, the attacker can also add chaff packets in the attacking stream. The paper first considers stepping-stone connections subject to packet-conserving transformations by the attacker. Two activity-based algorithms are proposed to detect stepping-stone connections with bounded memory or bounded delay perturbation, respectively. These algorithms are proven to have exponentially decaying false alarm probabilities if normal traffic can be modelled as Poisson processes. It is shown that the proposed algorithms improve the performance of an existing stepping-stone detection algorithm. This paper then addresses the detection of stepping-stone connections with both timing perturbation and chaff. Robust algorithms are developed to deal with chaff evasion. It is proven that the proposed robust algorithms can tolerate a number of chaff packets proportional to the size of the attacking traffic, and have vanishing false alarm probabilities for Poisson traffic. Simulations using synthetic data are used to validate the theoretical analysis. Further results using actual Internet traces are shown to demonstrate the performance of the proposed algorithms.

Section: B Summary Of Results and Organizationmentioning

confidence: 99%

Section: A Related Workmentioning

confidence: 99%

Detecting Encrypted Stepping-Stone Connections

IEEE Trans. Signal Process.

2007

“…Donoho et al [2] also mentioned about the chaff insertion with the claim that their algorithm can detect a flow if the chaff portion is independent of the flow. The independent chaff insertion was also considered by Zhang et al [4] with the assumption that only one node is allowed to insert chaff transmissions.…”

Section: A Related Workmentioning

confidence: 99%

“…, where c i is the ith smallest element among the elements of two sequences 4 . Then, we mathematically define a flow between a pair of nodes as follows.…”

Section: Mathematical Formulationmentioning

confidence: 99%

Detection of time-varying flows in wireless networks

Kim

2010 - Milcom 2010 Military Communications Conference

2010

Abstract-The problem of detecting the presence of timevarying flows in multi-hop wireless networks is considered. In particular, from transmission timing measurements, a test is constructed to determine whether there is a flow of data packets between a pair of nodes. It is assumed that the packet flows may have time-varying (piecewise constant) flow rates.First, a timing-based detector is proposed to detect a flow in the given measurements, and its performance analysis follows. Then, based on the detector, a sliding window technique is proposed for continuous monitoring. The techniques are tested using the MSN Voice over IP (VoIP) traffic and the synthetic Poisson traffic.

“…The drawback is that the increase of threshold causes increased false alarm probability, and the attacker can still evade de-tection by adding a fixed number of chaff packets. In a recent paper [11], Zhang et al proposed packet matching schemes to detect stepping-stone traffic with bounded delay perturbation and chaff. They proposed to match every arrival with the first departure subject to causality and the delay constraint.…”

Section: Related Workmentioning

confidence: 99%

Packet Scheduling Against Stepping-Stone Attacks with Chaff

Venkitasubramaniam

2006

Milcom 2006

We consider scheduling packet transmissions in a network so that the efficiency of stepping-stone attacks can be severely restrained with the help of stepping-stone monitors. We allow the attacker to encrypt and pad the packets, perturb the timing of packets, and insert chaff packets, but the timing perturbation is subject to a maximum delay constraint. We show that if we randomize packet transmissions, then the attacker has to insert a large amount of chaff to evade detection completely. In particular, if all transmissions are scheduled as Poisson processes, then the fraction of attacking packets in the attacker's traffic decreases exponentially with the length of the intrusion path.