A more accurate completion condition for attack-graph reconstruction in Probabilistic Packet Marking algorithm

摘要: Probabilistic Packet Marking (PPM) is one of the most promising scheme for IP Traceback in case DDoS attack. PPM reconstructs attack graph order to trace back attackers' network. Finding precise completion condition (i.e. number packets required reconstruct graph) very important. Without correct condition, victim might a wrong or incomplete attack-graph. On other extreme if it waits too long (much more than required) collect marked packets, real attacker would get ample time destroy logs, traces and records easily evade detection. Our work gives that guarantees when reconstructed, with high probability. The main contribution our - increases reliability correctness algorithm improves chances exact origin detection instead just tracing results show relying on upper bound expected equation which implicitly accepted as not accurate even upto 37% cases whereas has error rate around 7% minimal increase packets.