By Topic

Matching TCP packets and its application to the detection of long connection chains on the Internet

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$33 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

2 Author(s)
J. Yang ; Dept. of Comput. Sci., Houston Univ., TX, USA ; S. -H. S. Huang

Network attackers usually launch their attacks behind a long connection chain. One way to stop such attacks is to prevent the attackers from using computers as "stepping-stones" for their attacks. A "Step-Function" method has been proposed to detect the length of a connection chain from a host to the victim machine. The algorithm is based on the changes in packet round trip times. Due to many network protocol issues, it is impossible to match all such packets correctly. We propose two algorithms to match TCP packet in real-time. The first algorithm matched fewer packets but the matching is correct. The second one matches more packets with some uncertainty on the correctness. The two algorithms gave almost identical results in determining the length of a connection chain. The algorithm gives a way to stop stepping-stone intrusion on the Internet in real-time.

Published in:

19th International Conference on Advanced Information Networking and Applications (AINA'05) Volume 1 (AINA papers)  (Volume:1 )

Date of Conference:

28-30 March 2005