This paper proposes RTT-thumbprint to traceback intruders, and to detect stepping-stone intrusion; RTT-thumbprint is a sequence of timestamp pairs of a send packet and its corresponding echoed packets. Each pair of timestamps represents a round trip time (RTT) of a packet. Besides the advantages of efficiency, secrecy, and robustness, RTT-thumbprint has the ability to defeat intruder's random delay and chaff manipulation. An exhaustive and a heuristic algorithm are proposed to correlate RTT-thumbprints. The results showed that the heuristic algorithm performs as good as the exhaustive one but is more efficient.
展开▼
