Information Technology Reference
In-Depth Information
Fig. 12.
Sessionization Time Functions,
Original and With LCA, Model 1
Fig. 13.
Sessionization Time Functions,
Original and With LCA, Model 2
a user's browsing sessions, while fragments made up of multiple connections offer
a much larger window. This larger window provides the analyst with much more
semantic context, allowing him to infer user sessions more easily than he could
with individual TCP connections.
For example, some of the fragments in this experiment were rendered in a
web browser. These fragments revealed stock research pages, online education
seminars, and shopping pages. In a few cases, whole webmail sessions were con-
tained in one fragment and could be rendered in their entirety, including email
attachments.
7Con lu on
By reducing the high cost of sessionizing connections manually, the Link Chain-
ing Attack makes passive external surveillance of private networks a real possi-
bility. The results suggest a minimum ten-fold speed improvement for a human
analyst with acceptable accuracy. This number may be closer to 100 when using
a reasonable model of human sessionization speed.
The fact that the indegree heuristic performed more accurately than the
naive method of fragment isolation demonstrates that web trac contains an
exploitable relationship that is more descriptive than that marked by hyperlinks
alone. Web browsing is governed by a discernible pattern of user and browser
think times that can be used — together with tracing hyperlinks — to group
connections.
The Link Chaining Attack capitalizes on navigation and time oriented heuris-
tics to sessionize fragments of user sessions. Proposed improvements include the
tuning of user and browser think time thresholds, the identification of new im-
possibilities for link removal, and the discovery of impossible event sequences
spanning multiple connections. A method for assessing the likelihood of a link
based on a recursive calculation of the likelihood of its adjacent links is also
being considered.
