Robust Correlation of Encrypted Attack Traffic through Stepping Stones by Manipulation of Interpacket Delays (2003)
| Venue: | In Proceedings of the 10th ACM Conference on Computer and Communications Security (CCS 2003 |
| Citations: | 56 - 6 self |
BibTeX
@INPROCEEDINGS{Wang03robustcorrelation,
author = {Xinyuan Wang and Douglas S. Reeves},
title = {Robust Correlation of Encrypted Attack Traffic through Stepping Stones by Manipulation of Interpacket Delays},
booktitle = {In Proceedings of the 10th ACM Conference on Computer and Communications Security (CCS 2003},
year = {2003},
pages = {20--29},
publisher = {ACM}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
Abstract — Network based intruders seldom attack their victims directly from their own computer. Often, they stage their attacks through intermediate “stepping stones ” in order to conceal their identity and origin. To identify the source of the attack behind the stepping stone(s), it is necessary to correlate the incoming and outgoing flows or connections of a stepping stone. To resist attempts at correlation, the attacker may encrypt or otherwise manipulate the connection traffic. Timing based correlation approaches have been shown to be quite effective in correlating encrypted connections. However, timing based correlation approaches are subject to timing perturbations that may be deliberately introduced by the attacker at stepping stones. In this paper we propose a novel watermark-based correlation scheme that is designed specifically to be robust against timing
