Stepping-Stone Detection Using Timing Perturbation Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing stepping-stone detection systems are ineffective against attackers who use timing perturbation techniques to evade detection, particularly in interactive services like SSH, making it difficult to identify attack sessions and backtrack intermediate hosts and attack sources in real time.
Innovation Solution
A stepping-stone detection apparatus and method that generates a target connection fingerprint based on ON and OFF time durations, calculates a total matched time ratio by comparing with candidate connection fingerprints, and determines a stepping stone by exceeding preset thresholds, while accounting for maximum allowable delay times to overcome timing perturbation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If timing perturbation is used to evade detection, then detection reliability deteriorates, but attacker's ability to hide intermediate hosts improves
Solution Approach 1:
The patent changes the parameter of time tolerance by introducing a maximum allowable delay time threshold. Instead of requiring exact timing matches, the system accepts timing variations within a predefined threshold, thereby maintaining detection reliability despite attacker-induced timing perturbations. This transforms the detection mechanism from being sensitive to exact timing to being robust within acceptable timing ranges.
Solution Approach 2:
The patent performs preliminary action by pre-defining the maximum allowable delay time threshold before detection occurs. This preparatory step establishes the tolerance level for timing variations in advance, enabling the system to handle timing perturbations without compromising detection accuracy. The threshold is set based on expected legitimate timing variations, allowing the system to distinguish between normal fluctuations and actual attacks.
2Reliability
If maximum allowable delay time is introduced, then detection robustness improves, but false positive rate may increase
Solution Approach 1:
The patent applies partial action by using the maximum allowable delay time threshold as a filtering mechanism rather than an absolute criterion. The threshold allows partial timing variations to pass through while blocking excessive deviations. This partial acceptance of timing variations maintains robustness while minimizing false positives, as only connections with timing variations within the threshold are considered potential matches.
3Adaptability or versatility
If fingerprint comparison with timing tolerance is used, then detection of delayed attacks improves, but computational complexity increases
Solution Approach 1:
The patent segments the timing comparison process by dividing it into discrete time intervals or slots based on the maximum allowable delay time. Instead of performing continuous timing comparison, the system checks timing variations at segmented intervals, significantly reducing computational complexity while maintaining detection coverage for delayed attacks. This segmentation transforms a complex continuous comparison into manageable discrete checks.
Data Source
AI summary
Disclosed herein are a stepping-stone detection apparatus and method. The stepping-stone detection apparatus includes a target connection information reception unit for receiving information about a target connection from an intrusion detection system (IDS), a fingerprint generation unit for generating a target connection fingerprint based on the information about the target connection, and generating one or more candidate connection fingerprints using information about one or more candidate connections corresponding to one or more flow information collectors, and a stepping-stone detection unit for detecting a stepping stone by comparing the target connection fingerprint, in which a maximum allowable delay time is reflected, with the candidate connection fingerprints.