Search papers, labs, and topics across Lattice.
This paper introduces Stitch, a host-based system designed to detect pivot attacks in real time by leveraging programmable kernel capabilities to analyze host-traversing flows. By integrating process tracing with both system and network-level information, Stitch significantly enhances the detection of pivoting characteristics, achieving a 31% improvement in accuracy over existing solutions while maintaining an exceptionally low false positive rate of 0.006%. The findings highlight Stitch's potential as an effective and lightweight alternative to traditional perimeter-based defenses, addressing a critical gap in pivot attack detection.
Stitch achieves a remarkable 31% boost in pivot attack detection accuracy while keeping false positives to an astonishing 0.006%.
Perimeter-based security appliances, such as firewalls or Intrusion Detection Systems, are ineffective against modern attacks that use pivoting, wherein attackers"pivot"traffic through compromised hosts to gain access to additional targets that would otherwise be inaccessible. Due to the legitimate appearance of the relayed traffic, pivoting is extremely difficult to detect. Although the consequences of these attacks are known to be severe, existing defenses suffer from drawbacks such as high processing delays, low accuracy, or reliance on network-wide participation, making them inconvenient or even ineffective. This work presents Stitch, a host-based system that uses the programmable kernel to detect pivoting in real time. By observing host-traversing flows, Stitch uses process tracing to effectively combine system and network-level information, connecting incoming and outgoing communications and identifying pivoting characteristics between them. Showing 31% gains in accuracy over state-of-the-art pivoting defenses and a maximum false positive rate of 0.006% over two separate real-world deployments, Stitch covers the gap in current pivot detection solutions by providing accurate, lightweight, and independent coverage for vulnerable hosts in a network.
