查看文章

Probabilistic Packet Marking (PPM) is one of the most promising scheme for IP Traceback in case of DDoS attack. PPM reconstructs the attack graph in order to trace back to the attackers' network. Finding precise completion condition (i.e. number of packets required to reconstruct the attack graph) is very important. Without correct completion condition, victim might reconstruct a wrong or incomplete attack-graph. On the other extreme if it waits too long (much more than required) to collect marked packets, the real attacker would get ample time to destroy logs, traces and records and easily evade detection. Our work gives a precise completion condition for PPM that guarantees that when attack graph is reconstructed, it is correct with high probability. The main contribution of our work is - it increases the reliability and correctness of PPM algorithm and improves the chances of exact attack origin detection instead of just …