期刊文献+

使用平均包间延迟建立攻击连接链关联

Constructing Correlations in Attack Connection Chains Using Inter-Packet Delay
下载PDF
导出
摘要 当存在主动延迟干扰时,Wang Xinyuan等提出的基于包间延迟检测连接链相关性的算法不能正确检测相关连接,通过引入平均包间延迟取整值的概念提出优化算法,在攻击者主动干扰包间延迟的连接链中仍能检测相关性.实验表明:通过适当调整参数值,可使算法在存在主动延迟干扰的长连接链中有较好的有效性及健壮性. When inter-packet delay exist, the algorithm of connection chain correlation check on interpacket delay which presented by Wang Xinyuan can not detect connection correlation correctly. Via presenting the concepts of inter-packet delay average, the optizimizing algorithm is designed specifically to be robust against timing perturbations over sufficiently long flows. The experiments show that this method is availability and robust in random packet timing perturbations by adjusting parameter.
作者 刘琨 薛万欣
出处 《河南理工大学学报(自然科学版)》 CAS 2007年第2期212-216,共5页 Journal of Henan Polytechnic University(Natural Science)
关键词 反向追踪 连接链 阶石 关联 tracebacking connection chain stepping stones correlation
  • 相关文献

参考文献15

  • 1LEE S C,SHIELDS C.Tracing the Source of Network Attack:A Technical,Legal and Societal Problem[C].Proceedings of the 2001 IEEE Workshop on Information Assurance and Security,June 2001:239-247. 被引量:1
  • 2ZHANG Y,PAXSON V.Detecting Stepping Stones[C].Proceedings of 9 th USENIX Security Symposium.Denver,Colorado:USENIX Association,Berkeley,CA,2000. 被引量:1
  • 3DONOHO D,FLESIA A G,SHANKA U,et al.Multiscale Stepping Stone Detection:Detecting Pairs of Jittered Interactive Streams by Exploiting Maximum Tolerable Delay[C].Proceedings of the 5 th International Symposium on Recent Advances in Intrusion Detection (RAID 2002).New York:Springer,2002. 被引量:1
  • 4National Laboratory for Applied Network Research.NLANR Trace Archive[EB/OL].[2004-04-09].http:∥pma.nlanr.net/Traces/long/. 被引量:1
  • 5JUNG H,KIM H L,SEO Y M,et al.Caller Identification System in the Internet Environment[C].Proceedings of 4 th USENIX Security Symposium.Santa Clara,California:USENIX Association,Berkeley,CA,1993. 被引量:1
  • 6STANIFORD CHEN S,HEBERLEIN L T.Holding Intruders Accountable on the Internet[C].Proceedings of IEEE Symposium on Security and Privacy.Washington D C:IEEE Computer Society,2001. 被引量:1
  • 7WANG X,REEVES D,WU S F.Inter-packet Delay Based Correlation for Tracing Encrypted Connections Through Stepping Stones[C].Proceedings of European Symposium on Research in Computer Security (ESORICS 2002).Zurich,Switzerland:IEEE Press,2002. 被引量:1
  • 8WANG X,REEVES D S.Robust Correlation of Encrypted Attack Traffic Through Stepping Stones by Manipulation of Interpacket Delays[C].Proceedings of ACM Conference on Computer and Communications Security (CCS 2003).Washington:ACM Press,2003. 被引量:1
  • 9WANG X,REEVES D,WU S F,YUILL J.Sleepy Watermark Tracing:An Active Network-Based Intrusion Response Framework[C].Proceedings of IFIP Conferrence on Security 2001.New York:Kluwer Press,2001. 被引量:1
  • 10KWONG,H YUNG.Detecting Long Connection Chains of Interactive Terminal Sessions[C].Proceedings of the 5 th International Symposium on Recent Advances in Intrusion Detection(RAID 2002).New York:Springer,2002. 被引量:1

二级参考文献19

  • 1王金磊,王杰,刘刚.自组织神经网络在入侵检测系统中的应用[J].计算机与现代化,2004(10):88-90. 被引量:2
  • 2PAUL E.PROCTOR.入侵检测使用手册[M].邓琦皓,许鸿飞,张斌,译.北京:中国电力出版社,2002. 被引量:1
  • 3BRIAN CASWELLJAY,BEALEJAMES C FOSTER.Snort 2.0 Intrusion Detection[M].北京:国防工业出版社,2004. 被引量:1
  • 4Lee S C, Shields C. Technical, Legal, and Societal Challenges to Automated Attack Traceback [ J ]. IEEE IT Professional, 2002, 4(3): 12-18. 被引量:1
  • 5Zhang Y, Paxson V. Detecting Stepping Stones [ C ]//Proceedings of 9th USENIX Security Symposium. Denver,Colorado: USENIX Association, Berkeley, CA, 2000: 117-184. 被引量:1
  • 6Donoho D, Flesia A G, Shanka U, et al. Muhiscale Stepping Stone Detection: Detecting Pairs of Jittered Interactive Streams by Exploiting Maximum Tolerable Delay [ C ]//Proceedings of the 5th Intemational Symposium on Recent Advances in Intrusion Detection (RAID 2002). New York: Springer, 2002: 17-35. 被引量:1
  • 7Wang X, Reeves D S. Robust Correlation of Encrypted Attack Traffic Through Stepping Stones by Manipulation of Interpacket Delays [ C ]//Proceedings of ACM Conference on Computer and Communications Security (CCS 2003 ).Washington: ACM Press, 2003: 20-29. 被引量:1
  • 8National Laboratory for Applied Network Research. NLANR Trace Archive [ EB/OL]. 2004. http: //pma. nlanr. net/Tracea/long/. 被引量:1
  • 9Wang X, Reeves D, Wu S F, et al. Sleepy Watermark Tracing: an Active Network-based Intrusion Response Framework[ C ]//Proceedings of IFIP Conference on Security 2001. New York: Kluwer Press, 2001 : 369-384. 被引量:1
  • 10Jung H, Kim H L, Seo Y M, et al. Caller identification System in the Intemet Environment [ C ]//Proceedings of 4th USENIX Security Symposium. Santa Clara, Califomia: USENIX Association, Berkeley, CA, 1993. 被引量:1

共引文献9

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部