Stepping Stone Detection Techniques: Classification and State-of-the-Art

Abstract

Today, the most common way to perform various attacks is to use stepping stone hosts in the attacking path. In stepping stone attacks, attacker creates a long chain of connections via intermediary previously compromised nodes, to execute attack. The only way to break this chain is to detect stepping stones and applying some security constraints on the traffic flowing through them, not to allow malicious traffic through them. In this paper, we present classification and state-of-the-art of existing schemes proposed for stepping stone detection in recent past. Moreover, we compare these techniques based on their merits and demerits, and discuss open issues and challenges that can be used for further research in this domain.