Active timing-based correlation of perturbed traffic flows with chaff packets

  title={Active timing-based correlation of perturbed traffic flows with chaff packets},
  author={Pai Peng and Peng Ning and Douglas S. Reeves and Xinyuan Wang},
  journal={25th IEEE International Conference on Distributed Computing Systems Workshops},
Network intruders usually launch their attacks through a chain of intermediate stepping stone hosts in order to hide their identities. Detecting such stepping stone attacks is difficult because packet encryption, timing perturbations, and meaningless chaff packets can all be utilized by attackers to evade from detection. In this paper, we propose a method based on packet matching and timing-based active watermarking that can successfully correlate interactive stepping stone connections even if… CONTINUE READING
Highly Cited
This paper has 47 citations. REVIEW CITATIONS

From This Paper

Figures, tables, and topics from this paper.


Publications citing this paper.
Showing 1-10 of 22 extracted citations


Publications referenced by this paper.
Showing 1-10 of 13 references

Stepping stone attack attribution in non-cooperative IP networks

L. Zhang, A. Persaud, A. Johnson, Y. Guan
Technical Report 2005-02-1, • 2005
View 6 Excerpts
Highly Influenced

Detecting stepping stones

USENIX Security Symposium • 2000
View 2 Excerpts