APPARATUS AND METHOD FOR DETECTING OF STEPPING STONE ATTACKS

摘要

An apparatus and a method for detecting a stepping stone are disclosed. According to the present invention, the apparatus for detecting a stepping stone comprises: a target connection information receiving unit for receiving information of a target connection from an invasion detection system (IDS); a fingerprint generating unit for generating a target connection fingerprint based on the information of the target connection, and generating one or more candidate connection fingerprints by using information of the one or more candidate connections corresponding to one or more flow information collectors; and a stepping stone detecting unit for detecting a stepping stone by comparing the target connection fingerprint with the candidate connection fingerprint reflecting the maximum allowable delay time.