Matching TCP Packets for Stepping-Stone Intrusion Detection Resistant to Intruders’ Chaff Perturbation

Hackers usually launch cyberattacks through several stepping-stone hosts to reduce the chance of being detected. With stepping-stone intrusion (SSI), the attacker’s identity is hidden behind a long interactive connection chain of stepping stones and thus is very difficult to reveal. Many algorithms for detecting SSI have been proposed since 1995. Most of these known detection algorithms for SSI only work for network traffic without intruders’ session manipulation. These known SSID algorithms are either weak to resisting intruders’ chaff-perturbation manipulation or have a very limited capability in resisting attacker’s session manipulation. This paper proposes an innovative SSID algorithm resistant to intruders’ chaff perturbation through matching TCP packets by using the crossover of packets. Our proposed SSID algorithm is verified by well-designed network experiments. Our experimental results show that the proposed SSID algorithm works effectively in detecting network intrusion as well as resisting intruders’ chaff perturbation.