Detecting Encrypted Stepping-Stone Connections

Stepping-stone attacks are often used by network intruders to hide their identities. In a stepping-stone attack, attacking commands are sent indirectly to the victim through a chain of compromised hosts acting as "stepping stones." In defending against such attacks, it is necessary to detect stepping-stone connections at the compromised hosts. The use of encrypted connections by the attacker complicates the detection problem and the attacker's active timing perturbation and insertion of chaff make it even more challenging. This paper considers strategies to identify stepping-stone connections when the attacker is able to encrypt the attacking packets and perturb their timing. Furthermore, the attacker can also add chaff packets in the attacking stream. The paper first considers stepping-stone connections subject to packet-conserving transformations by the attacker. Two activity-based algorithms are proposed to detect stepping-stone connections with bounded memory or bounded delay perturbation, respectively. These algorithms are proven to have exponentially decaying false alarm probabilities if normal traffic can be modelled as Poisson processes. It is shown that the proposed algorithms improve the performance of an existing stepping-stone detection algorithm. This paper then addresses the detection of stepping-stone connections with both timing perturbation and chaff. Robust algorithms are developed to deal with chaff evasion. It is proven that the proposed robust algorithms can tolerate a number of chaff packets proportional to the size of the attacking traffic, and have vanishing false alarm probabilities for Poisson traffic. Simulations using synthetic data are used to validate the theoretical analysis. Further results using actual Internet traces are shown to demonstrate the performance of the proposed algorithms

[1]  Vern Paxson,et al.  Multiscale Stepping-Stone Detection: Detecting Pairs of Jittered Interactive Streams by Exploiting Maximum Tolerable Delay , 2002, RAID.

[2]  Dawn Xiaodong Song,et al.  Detection of Interactive Stepping Stones: Algorithms and Confidence Bounds , 2004, RAID.

[3]  Stuart Staniford-Chen,et al.  Holding intruders accountable on the Internet , 1995, Proceedings 1995 IEEE Symposium on Security and Privacy.

[4]  Douglas S. Reeves,et al.  Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays , 2003, CCS '03.

[5]  David R. Cox,et al.  The Theory of Stochastic Processes , 1967, The Mathematical Gazette.

[6]  Sally Floyd,et al.  Wide area traffic: the failure of Poisson modeling , 1995, TNET.

[7]  Xinyuan Wang The loop fallacy and serialization in tracing intrusion connections through stepping stones , 2004, SAC '04.

[8]  Bruce E. Hajek,et al.  An information-theoretic and game-theoretic study of timing channels , 2002, IEEE Trans. Inf. Theory.

[9]  Douglas S. Reeves,et al.  Inter-Packet Delay Based Correlation for Tracing Encrypted Connections through Stepping Stones , 2002, ESORICS.

[10]  Yong Guan,et al.  Detection of stepping stone attack under delay and chaff perturbations , 2006, 2006 IEEE International Performance Computing and Communications Conference.

[11]  Yin Zhang,et al.  Detecting Stepping Stones , 2000, USENIX Security Symposium.

[12]  Sally Floyd,et al.  Wide-area traffic: the failure of Poisson modeling , 1994 .

[13]  Douglas S. Reeves,et al.  Sleepy Watermark Tracing: An Active Network-Based Intrusion Response Framework , 2001, SEC.

[14]  Hiroaki Etoh,et al.  Finding a Connection Chain for Tracing Intruders , 2000, ESORICS.

[15]  Peng Ning,et al.  Active timing-based correlation of perturbed traffic flows with chaff packets , 2005, 25th IEEE International Conference on Distributed Computing Systems Workshops.

[16]  T. He,et al.  A Signal Processing Perspective to Stepping-stone Detection , 2006, 2006 40th Annual Conference on Information Sciences and Systems.