Detecting Hidden Causality in Network Connections

Abstract Upon success, certain network attacks manifest by caus- ing the victim host to change its network-visible con- nection behavior, such as by starting a new service that the attacker probes to conrm success, ìphoning homeî to a host controlled by the attacker, or further propagat- ing the attack (e.g., worms or spam relays). One charac- teristic of such change in network behavior is the pres- ence of unusual causal relationships between,connec-