A precise termination condition of the probabilistic packet marking algorithm
Publication in refereed journal


摘要The probabilistic packet marking (PPM) algorithm is a promising way to discover the Internet map or an attack graph that the attack packets traversed during a distributed denial-of-service attack. However, the PPM algorithm is not perfect, as its termination condition is not well defined in the literature. More importantly, without a proper termination condition, the attack graph constructed by the PPM algorithm would be wrong. In this work, we provide a precise termination condition for the PPM algorithm and name the new algorithm the rectified PPM(RPPM) algorithm. The most significant merit of the RPPM algorithm is that when the algorithm terminates, the algorithm guarantees that the constructed attack graph is correct, with a specified level of confidence. We carry out simulations on the RPPM algorithm and show that the RPPM algorithm can guarantee the correctness of the constructed attack graph under 1) different probabilities that a router marks the attack packets and 2) different structures of the network graph. The RPPM algorithm provides an autonomous way for the original PPM algorithm to determine its termination, and it is a promising means of enhancing the reliability of the PPM algorithm.
著者Wong TY, Wong MH, Lui CS
期刊名稱IEEE Transactions on Dependable and Secure Computing
頁次6 - 21
關鍵詞network-level security and protection; probabilistic computation
Web of Science 學科類別Computer Science; Computer Science, Hardware & Architecture; COMPUTER SCIENCE, HARDWARE & ARCHITECTURE; Computer Science, Information Systems; COMPUTER SCIENCE, INFORMATION SYSTEMS; Computer Science, Software Engineering; COMPUTER SCIENCE, SOFTWARE ENGINEERING

上次更新時間 2021-22-01 於 00:46