NetFlow-Based Connection Fingerprinting for Stepping-Stone Traceback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies for tracing back cyber hacking attacks face significant overhead and practical limitations, particularly in real networks, as they require dedicated monitoring devices and are ineffective against IP spoofing, making it difficult to detect attackers' origins.
Innovation Solution
A method for connection fingerprint generation and stepping-stone traceback based on NetFlow information, which utilizes routers to minimize overhead and detect stepping stones in interactive services like Telnet and SSH, allowing tracing back of attack origins without dedicated monitoring devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dedicated monitoring devices are installed in a distributed manner over the network, then traceback capability is improved, but device complexity and implementation difficulty increase significantly
Solution Approach 1:
The patent uses NetFlow data as an intermediary to enable traceback without installing dedicated monitoring devices. Routers export NetFlow information that captures connection metadata, which then serves as the basis for generating connection fingerprints and tracing attack origins. This intermediary approach eliminates the need for specialized hardware while maintaining traceback functionality.
Solution Approach 2:
Instead of installing physical monitoring devices, the patent creates a virtual copy of network traffic information through NetFlow data. The connection fingerprints are generated from copied metadata (source IP, destination IP, source port, destination port, protocol) rather than requiring direct observation of actual packets, thereby reducing implementation complexity while preserving traceback capability.
2Measurement precision
If all network traffic packets and communication connections are monitored, then detection precision is improved, but overhead increases significantly
Solution Approach 1:
The patent extracts only the essential metadata fields needed for traceback from the full network traffic: source IP address, destination IP address, source port, destination port, and protocol. By taking out only these critical elements rather than monitoring complete packet contents, the system achieves sufficient detection precision while dramatically reducing processing overhead and resource consumption.
Solution Approach 2:
The patent applies partial action by monitoring only the specific NetFlow fields necessary for connection fingerprint generation and traceback, rather than performing exhaustive analysis of all network traffic. This selective approach processes a subset of information (connection metadata) that is sufficient for the traceback function, reducing overhead while maintaining detection precision for attack origin identification.
3Reliability
If host-based TCP connection traceback modules are installed in all systems, then traceback capability is improved, but device complexity and Internet service provider overhead increase
Solution Approach 1:
The patent makes routers universal by enabling them to perform both their traditional packet forwarding function and the additional function of exporting NetFlow data for traceback. Instead of requiring specialized traceback modules in each host system, the router serves multiple purposes: routing traffic and providing traceback information through standard NetFlow exports, thereby reducing ISP overhead and simplifying deployment.
Solution Approach 2:
The patent uses NetFlow data as an intermediary between network traffic and traceback analysis. Rather than installing traceback modules in every host system, the router collects connection information and exports it as NetFlow data, which then serves as the intermediary source for generating connection fingerprints and performing traceback, eliminating the need for distributed host-based modules.
Data Source
AI summary
The method for tracking a cyber hacking is provided. The method of connection fingerprint generation and stepping-stone traceback based on NetFlow includes receiving a traceback request including IP packet attribute information of a victim and an attacker which corresponds to a target connection that is the last connection on a connection chain, generating a fingerprint for an associated connection based on the IP packet attribute information and requesting a NetFlow collector for relevant information, detecting a stepping-stone connection to the target connection which is generated at the time of generation of the fingerprint and instructing to check whether sorted candidate connections are present on the same connection chain as the target connection, and determining an order of the candidate connections based on an attacker host when the candidate connections are determined to be present on the same connection chain as the target connection.