Multiscale Stepping-Stone Detection: Detecting Pairs of Jittered Interactive Streams by Exploiting Maximum Tolerable Delay (2002)
| Venue: | in Proc. of The 5th International Symposium on Recent Advances in Intrusion Detection (RAID |
| Citations: | 43 - 1 self |
BibTeX
@INPROCEEDINGS{Donoho02multiscalestepping-stone,
author = {David L. Donoho and Ana Georgina Flesia and Umesh Shankar and Vern Paxson Jason Coit and and Stuart Staniford and Jason Coit and Stuart Staniford},
title = {Multiscale Stepping-Stone Detection: Detecting Pairs of Jittered Interactive Streams by Exploiting Maximum Tolerable Delay},
booktitle = {in Proc. of The 5th International Symposium on Recent Advances in Intrusion Detection (RAID},
year = {2002},
pages = {17--35},
publisher = {Springer}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
Computer attackers frequently relay their attacks through a compromised host at an innocent site, thereby obscuring the true origin of the attack. There is a growing literature on ways to detect that an interactive connection into a site and another outbound from the site give evidence of such a "stepping stone." This has been done based on monitoring the access link connecting the site to the Internet (Eg. [7, 11, 8]). The earliest work was based on connection content comparisons but more recent work has relied on timing information in order to compare encrypted connections.
