Multiscale Stepping-Stone Detection: Detecting pairs of jittered interactive streams by exploiting maximum tolerable delay

DONOHO,D.L.;; FLESIA, A.G.;; SHANKAR,U.;; PAXON, V.; COIT, J;; STUART, S.

LECTURE NOTES IN COMPUTER SCIENCE

Springer-Verlag

Lugar: New York; Año: 2002 vol. 2516 p. 17 - 35

0302-9743

Computer attackers frequently relay their attacks through a compromised host at an innocent site, thereby obscuring the true origin of the attack. There is a growing literature on ways to detect that an iterative connection into a site and another outbound from the site give evidence of such a "stepping stone". This have been done based on monitoring the access link connecting the site to the Internet. The earliest work was based on connection content comparisons but more recent work has relied on timing information in order to compare encrypted connections.Past work on this problem has not yet attempted to cope with the ways in which intruders might attempt to modify their traffic to defeat stepping stone detection. In this paper we give the first consideration to constraining such intruder evasion. We present some unexpected results that show there are theoretical limits on the ability of attackers to disguise their traffic in this way for sufficiently long connections.We consider evasions that consists of local jittering of packets arrival times (without addition and substraction of packets), and also the addition of superfluous packets which will be removed later in the connection chain (chaff).To counter such evasion, we assume that the intruder has a "maximum delay tolerance". By using wavelets and similar multiscale methods, we show that we can separate the short term behavior of the streams where the jittering or chaff indeed masks the correlation from long term behavior of the streams where the correlation remains.It therefore appears, at least in principle, that there is an effective countermeasure to this particular evasion tactic, at least for sufficiently long lived interactive connections.