The Enhancement of the Session Token Protocol (STOP) for TCP Traceback

Yu-Xue Chen, Masters Student

Dept of CSSE, University of Canterbury

Fri Dec 10 15:35:00 NZDT 2004 in Room 031, MSCS

Abstract

With the widespread use of the Internet and the availability of various scanning software tools, unauthorized access and malicious computer attacks have been increasing. One common characteristic of these attacks is that attackers usually log into and compromise a chain of hosts to hide their real network addresses before breaking into their intended targets. This method makes it harder to trace intruders back to their origins. Not only does this mean the intruders avoid taking responsibility for their actions, but they also continue to mount such attacks. TCP traceback is a technique used to determine the sources of attacking traffic on networks. This seminar will present a protocol, Session TOken Protocol, used to trace the source of offending packets, and discuss future enhancements to make the protocol more effective.