使用平均包间延迟建立攻击连接链关联

当存在主动延迟干扰时,Wang Xinyuan等提出的基于包间延迟检测连接链相关性的算法不能正确检测相关连接,通过引入平均包间延迟取整值的概念提出优化算法,在攻击者主动干扰包间延迟的连接链中仍能检测相关性.实验表明:通过适当调整参数值,可使算法在存在主动延迟干扰的长连接链中有较好的有效性及健壮性.

Constructing Correlations in Attack Connection Chains Using Inter-Packet Delay

When inter-packet delay exist, the algorithm of connection chain correlation check on interpacket delay which presented by Wang Xinyuan can not detect connection correlation correctly. Via presenting the concepts of inter-packet delay average, the optizimizing algorithm is designed specifically to be robust against timing perturbations over sufficiently long flows. The experiments show that this method is availability and robust in random packet timing perturbations by adjusting parameter.