使用主动延迟建立攻击连接链的关联

网络攻击者通常在攻击最后目标前使用双向交互式连接一系列中间主机（跳板机）掩盖其真实攻击路径。本文提出一个主动干扰跳板机连接中数据包间隔延迟的方法，在攻击者所能干扰跳板机连接数据包延迟间隔允许范围之内，通过分析指定时间窗口内连接数据包的活跃程度，在网络出口检测数据包的到达延迟的周期特征，确定攻击连接链的关联。这个方法可以有效地减少连接关联计算量，提高跳板机检测的有效性。

Constructing Correlations in Attack Connection Chains Using Active Delay

Usually network attackers conceal their real attacking paths by establishing interactive connections along a series of intermediate hosts (stepping stones) before they attack the final target. We propose a method for detecting stepping stones by actively perturbing inter-packet delay of connections. Within the attacker's perturbation range, the method can construct correlations in attack connection chains by analyzing activity degree of correlation window and monitoring period characteristic of packets delay. The method can reduce the complexity of correlation computations and improve the efficiency of detecting stepping stones.