Attack propagation in networks

  • Authors:

  • Sotiris Nikoletseas;Grigorios Prasinos;Paul Spirakis;Christos Zaroliagis

  • Affiliations:

  • Computer Technology Institute, P.O. Box 1122, 26110 Patras, Greece, Department of Computer Engineering & Informatics, University of Patras, 26500 Patras, Greece;Computer Technology Institute, P.O. Box 1122, 26110 Patras, Greece, Department of Computer Engineering & Informatics, University of Patras, 26500 Patras, Greece;Computer Technology Institute, P.O. Box 1122, 26110 Patras, Greece, Department of Computer Engineering & Informatics, University of Patras, 26500 Patras, Greece;Computer Technology Institute, P.O. Box 1122, 26110 Patras, Greece, Department of Computer Engineering & Informatics, University of Patras, 26500 Patras, Greece

  • Venue:
  • Proceedings of the thirteenth annual ACM symposium on Parallel algorithms and architectures
  • Year:
  • 2001

Quantified Score

Hi-index 0.00

Visualization

Abstract

A new model for intrusion and its propagation through various attack schemes in networks is considered. The model is characterized by the number of network nodes, and two parameters f and g. Parameter f represents the probability of failure of an attack to a node and is a gross measure of the level of security of the attacked system and perhaps of the in truder's skills;g represents a limit on the number of attacks that the intrusion software can ever try, when it issues them from a particular (broken) network node,due to the danger to be discovered. The success of the attack scheme is characterized by two factors: the number of nodes captured (the spread factor) and the number of virtual links that a defense mechanism has to trace from any node where the attack is active to the origin of the intrusion (the traceability factor). The goal of an intruder is to maximize both factors. In our model, we present four different ways (attack schemes) by which an intruder can organize his attacks. Using analytic and experimental methods, we first show that for any O f g for which any of our attack schemes can achieve a &THgr; (n) spread and traceability factor with high probability, given sufficient propagation time. We also show for three of our attack schemes that the spread and the traceability factors are, with high probability, linearly related during the whole duration of the attack propagation. This implies that it will not be easy for a detection mechanism to trace the origin of the intrusion, since it will have to trace a number of links proportional to the nodes captured.