Finding Connections in the Chain

We will describe the details of our method for tracing connections in this section. First, we formally define some terms.

See Fig. 1 for an illustration of the above definition. $H_0$ is the source of an intruder and $H_n$ is the target. $H_1,H_2,\ldots,$ and $H_{n-1}$ are step-through hosts the intruder logs in through sequentially. $C_i$ is a TCP connection established between $H_{i-1}$ and $H_i$.

Figure 1: Connection chain

At any particular point of time, a TCP connection is uniquely determined by a 4-tuple: source IP address, destination IP address, source port number, and destination port number, thus we can tell which connection a given packet belongs to by looking at the IP and TCP header of the packet. An individual packet will either travel upstream or downstream. If we denote a connection as a 4-tuple $(I_1,p_1,I_2,p_2)$, one direction is expressed as $(I_1:p_1) \rightarrow (I_2:p_2)$ and the other is expressed as $(I_1:p_1) \leftarrow (I_2:p_2)$.

There are two packet streams in one connection for each of the directions, but we currently treat each of them independently. Directions are defined with regards to an intruder's actual origin, so we say the direction of a packet stream is upstream if the packets are moving toward the intruder, and downstream if the packets are moving toward the target host.