Resistance to Chaff Attack through TCP/IP Packet Cross-Matching and RTT-Based Random Walk

Many approaches have been proposed to detect stepping-stone intrusion, but few of them can effectively be resistant to intruders' manipulation, such as chaff perturbation, and time-jittering evasion techniques. In this paper, we propose a new approach to not only detect stepping-stone intrusion, but also resist intruders' chaff attack evasion through TCP/IP packet cross-matching and random walk. Unlike other approaches which can just resist intruders' chaff attack to a certain degree, this approach can be immune to any number packets injected. The theory analysis and simulation results show that more injection packets, the higher the probability that the chaff attack is detected.