Markov Chain Modelling of the Probabilistic Packet Marking Algorithm

In this work, we show that the current termination condition of the Probabilistic Packet Marking (PPM) algorithm is not correct for general networks, and this implies the estimation of expected number of marked packets is not accurate. As a result, this may lead to an incomplete attack graph construction. To remedy this problem, we propose a Markov chain modelling of the PPM algorithm. By applying the fundamental matrix theory, one can result in an accurate estimation of the expected number of marked packets. Our simulation results show that the Markov chain modelling technique is effective in calculating the expected number of marked packets.

• Type: Journal
• Year: 2007
• Where: IJNSEC
• Authors: Tsz-Yeung Wong, John Chi-Shing Lui, Man Hon Wong
• Keywords: Current Termination Condition, Expected Number, IJNSEC 2007, Markov Chain