Fig. 1

A sample connection chain. Host 0 is used by an intruder to launch an attack to Host N via compromised hosts Host 1, Host 2,..., Host N − 1. SSID can occur at one of the stepping-stones. It is assumed that the detection program resides in Host i which is called a (detecting) sensor. SSID is to determine whether the sensor Host i is used as a stepping-stone. The connection from Host i − 1 to Host i is called an incoming connection to Host i, and the connection from Host i to Host i + 1 is called an outgoing connection from Host i