Holding intruders accountable on the Internet

摘要: This paper addresses the problem of tracing intruders who obscure their identity by logging through a chain multiple machines. After discussing previous approaches to this problem, we introduce thumbprints which are short summaries content connection. These can be compared determine whether two connections contain same text and therefore likely part connection chain. We enumerate properties thumbprint needs have work in practice, then define class local desired properties. A methodology from multivariate statistics called principal component analysis is used infer best choice thumbprinting parameters data. Currently our require 24 bytes per minute develop an algorithm compare these allows for possibility that data may leak one time-interval next. present experimental showing scheme works on area network. >