Correlating TCP/IP Packet contexts to detect stepping-stone intrusion
Stepping-stone intrusion is one of the most popular techniques for attacking other computers, and detecting this form of intrusion and resisting intruders evasion are critical security issues. In this paper, we propose a new approach to this problem by introducing packet context to help detect stepping-stone intrusion. Pearson product-moment correlation coefficient is introduced to correlate packet context. The proposed approach does not need a threshold, and it is easily implemented. The experimental results show that the proposed approach can detect stepping-stone intrusion and resist intruders time-jittering and chaff-perturbation manipulation to an extent.
packet context stepping-stone time-jittering chaff-perturbation network security intrusion detection