Detecting Stepping Stones

By Yin Zhang, Vern Paxson. USENIX Security Symposium, 2000

468 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Differentially-private network trace analysis (2010, background): “For instance, worm fingerprinting [27] (a packet-level analysis) requires raw packet payloads; stepping stone detection [33] (a flow-level analysis) requires addresses and ports in traffic flows; and anomaly detection [13] (a graph-level analysis) requires information on the amount of traffic at ind”
A Taxonomy of Botnet Structures (2007, background): “Some researchers have already investigated zombie detection via stepping stone analysis, or the detection of messages being relayed through victim proxies [59].”
Performance debugging for distributed systems of black boxes (2003, methodology): “[27] Y. Zhang and V. Paxson.”
Internet intrusions: global characteristics and prevalence (2003, background): “Thus, analyzing source IPs of portscans can provide valuable insight into the geographic distribution of malicious host subnets or stepping stones [26].”
Low-cost traffic analysis of Tor (2005, background): “Others have also looked at detecting stepping stones (relays) for intrusion detection [7] [41] .”
SIMPLE-fying middlebox policy enforcement using SDN (2013, methodology): “We were inspired in part by the success of flow correlation techniques used in the security literature to detect stepping stones and information leakage [46].”