Strategic deployment of network monitors for attack attribution

—Attacks launched over the Internet have become a pressing problem. Attackers make use of a variety of techniques to anonymize their traffic, in order to escape detection and prosecution. Despite much research on attack attribution, there has been little work on optimizing the number and placement of monitoring points for identifying the source of attacks with minimum ambiguity. This paper proposes such a method. The approach is based on the concept of graph separators. A separator partitions a network, such that the size of the separator is the number of monitors needed, and the size of a partition is the ambiguity in isolating the specific source of an attack. To achieve a desired degree of ambiguity, a good separator for the Internet is sought. Both vertex and edge separator heuristics are presented, which greedily select vertices of highest/lowest degree as monitors. The methods are evaluated for the Internet autonomous system (AS) topology. Experimental results show that the v...

• Type: Conference
• Year: 2007
• Where: BROADNETS
• Authors: Young June Pyun, Douglas S. Reeves
• Keywords: BROADNETS 2007, Computer Networks, Edge Separator, Edge Separator Heuristics, Separator Heuristic