A real-time algorithm to detect long connection chains of interactive terminal sessions

摘要

Most computer intruders usually chain many computers so as to hide themselves before launching an attack on a target computer. One way to stop such attacks is to prevent the hackers from using computers as stepping-stones for their attack. In this paper, we propose an algorithm to detect the length of the connection chain. By monitoring packets of outgoing and incoming connections, we are able to compute the roundtrip time gap between a client's "request" and the server's "reply." From the changes in the gaps, we can estimate the number of hosts from the current machine to the destination machine. Our algorithm has two advantages compare to the previous results [3]: (1) the estimation of the connection chain is more accurate, and (2) the algorithm can be used in real-time to detect long connection chains.