Packet-based algorithms for stepping-stone detection with chaff perturbation

Network intruders usually launch attacks indirectly by constructing a long connection via intermediary hosts, called stepping-stones, to hide their identities. In order to detect this type of malicious behavior, it is necessary to identify whether a host has been used as a stepping-stone. More sophisticated intruders even add extra superfluous packets, called chaff packets, to evade detection. In this paper, we introduce the packet-based approach to detect stepping-stones with chaff perturbation based on the range of a random walk model. Two algorithms, size-fluctuation and transformation, are proposed for this approach to distinguish the stepping-stone connections from the normal connections. The results show that both algorithms are able to identify the stepping-stone connections effectively under a larger number of chaff perturbation and with fewer monitored packets than the existing methods. Copyright © 2010 John Wiley & Sons, Ltd.