Correlating TCP/IP Packet contexts to detect stepping-stone intrusion

Stepping-stone intrusion is one of the most popular techniques for attacking other computers, and detecting this form of intrusion and resisting intruders’ evasion are critical security issues. In this paper, we propose a new approach to this problem by introducing packet context to help detect stepping-stone intrusion. Pearson product-moment correlation coefficient is introduced to correlate packet context. The proposed approach does not need a threshold, and it is easily implemented. The experimental results show that the proposed approach can detect stepping-stone intrusion and resist intruders’ time-jittering and chaff-perturbation manipulation to an extent.