Abstract: A method is proposed for detecting stepping stones by actively perturbing inter-packet delay of connections, by which the average value of the packets in the detecting window is set to increase periodically within the attacker’s perturbation range. The correlations in attacking connection ch ains can be constructed by analyzing the increase of the average value of the inter-packet delay between the two connection chains. The complexity of correlatio n computations can be reduced and the efficiency of detecting stepping stones can be improved by means of the method.

Key words: traceback, connection chain, active delay