Multiscale Stepping-Stone Detection: Detecting Pairs of Jittered Interactive Streams by Exploiting Maximum Tolerable Delay

Abstract

Computer attackers frequently relay their attacks through a compromised host at an innocent site, thereby obscuring the true origin of the attack. Previous work has developed ways to detect when an interactive connection into a site and another outbound from the site give evidence of such a "stepping stone." This was done based on monitoring the access link connecting the site to the Internet [7,8].In this paper we anticipate intruder evasion which attempts to defeat such detectors by transforming the stream as it passes through the site to reduce correlations between the two interactive connections. The evasion we focus on here is the local jittering of packet arrival times (without addition and subtraction of packets).To counter such evasion, we assume that the intruder has a "maximum delay tolerance." By using wavelets and similar multiscale methods, we show that we can separate the shortterm behavior of the streams -where the jittering indeed masks the correlation -from the long-term behavior of the streams -where the correlation remains.It therefore appears that there is an effective countermeasure to this particular evasion tactic, at least for sufficiently long-lived connections.

The Need for Flow Fingerprints to Link Correlated Network Flows

“…In fact, this approach is passive traffic analysis, which has extensively been studied in the literature [3,9,25]. Unfortunately, this approach may result in high rates of false detection, especially when the evaluated flows are cross-correlated.…”

“…Early traffic analysis schemes [5,9,20,24,26,28] work in a passive manner, i.e., they record the communication characteristics of incoming flows and correlate them with that of the observed outgoing flows. The right place to do this is often at the border router of an enterprise, so the overhead of this technique is the space used to store the stream characteristics long enough to check against correlated relayed streams, and the CPU time needed to perform the correlations.…”

Detecting Encrypted Interactive Stepping-Stone Connections

“…There are a few results on detecting encrypted, perturbed steppingstone connections; see [2,7,8]. The key assumption of these approaches is that there is a limit on the attacker's ability to alter the traffic.…”

“…The key assumption of these approaches is that there is a limit on the attacker's ability to alter the traffic. Specifically, in [2] it is assumed that there is a maximum tolerable delay for attacking packets, in [7] the attacker's timing perturbation is independent and identically distributed across packets, and in [8] there are constraints not only on the maximum delay, but also on the maximum number of packets that can be sent during the delay. From an algorithmic point of view, Blum, Song and Venkataraman [8] develop the first detection algorithms which require provable (polynomial) sample sizes to achieve certain false alarm probabilities.…”

“…To address this issue, Donoho et al propose in [2] to install stepping-stone monitors at each gateway node to detect steppingstone pairs 1 by examining the incoming/outgoing traffic. In practice, the monitor has to make decisions by observing live traffic, which may not include the beginning or the end of the connection.…”