Markov Chain Modelling of the Probabilistic Packet Marking Algorithm

In this work, we show that the current termination condition of the probabilistic packet marking (PPM in short) algorithm is not correct for general networks, and this implies the estimation of expected number of marked packets is not accurate. As a result, this may lead to an incomplete attack graph construction. To remedy this problem, we propose a Markov chain modeling of the PPM algorithm. By applying the fundamental matrix theory, one can result in an accurate estimation of the expected number of marked packets. Our simulation results show that the Markov chain modeling technique is effective in calculating the expected number of marked packets. Keyword: Denial-of-service attack, IP traceback, PPM algorithm, and Markov chain model.