Stepping-Stone Intrusion Detection via Estimating Numbers of Upstream and Downstream Connections using Packet Crossover

Abstract

An effective approach to detect stepping-stone intrusion (SSI) is to estimate the length of a connection chain. This type of detection method is referred to as the network-based SSI detection (SSID). Previously known network-based approaches for SSID either do not work effectively in the Internet environment, or are inefficient as they require a large number of packets to be captured and analyzed, or have limited performance as the length of a connection chain must be predetermined. None of these existing methods to detect SSI can be used to estimate the length of upstream connection sub-chain, which has been a long-standing and challenging open problem in this research area. In this paper, we develop effective network-based methods for SSID using packet crossover that can be used to estimate the length of a downstream sub-chain as well as that of an upstream sub-chain. Since the number of packet crossovers can be easily calculated, our proposed algorithms for SSID are easy to use and implement. To the best of our knowledge, this is the first work that can effectively estimate the length of the whole connection chain, including the upstream sub-chain. Rigorous technical proofs and well-designed network experiments are provided to verify the correctness and effectiveness of our proposed algorithms for SSID.