Improved Thumbprint and Its Application for Intrusion Detection

This paper proposes RTT-thumbprint to traceback intruders, and to detect stepping-stone intrusion; RTT-thumbprint is a sequence of timestamp pairs of a send packet and its corresponding echoed packets. Each pair of timestamps represents a round trip time (RTT) of a packet. Besides the advantages of efficiency, secrecy, and robustness, RTT-thumbprint has the ability to defeat intruder’s random delay and chaff manipulation. An exhaustive and a heuristic algorithm are proposed to correlate RTT-thumbprints. The results showed that the heuristic algorithm performs as good as the exhaustive one but is more efficient

• Type: Conference
• Year: 2005
• Where: ICCNMC
• Authors: Jianhua Yang, Shou-Hsuan Stephen Huang
• Keywords: Communications, Corresponding Echoed Packets, Heuristic Algorithm, ICCNMC 2005, Intruder’s Random Delay