KR102536957B1 - System and Method for Detecting Attacker Packet for IP Traceback Analysing - Google Patents

Abstract

A system and method for detecting attack packets through IP traceback analysis apply a client puzzle to an input router, use a path fingerprint scheme for an output router, and introduce a quantum annealing technology on the server side to introduce malicious packets into the network in a hybrid manner. It has the effect of minimizing the DDoS attack by reducing the amount of

Description

System and method for detecting attack packets through IP traceback analysis {System and Method for Detecting Attacker Packet for IP Traceback Analysing}

The present invention relates to a system for detecting attack packets, and more particularly, by applying a client puzzle to an input router, using a route fingerprint system for an output router, and introducing a quantum annealing technology on the server side to detect packets flowing into a network in a hybrid manner. A system and method for detecting attack packets through IP traceback analysis that minimizes DDos attacks by reducing the amount of malicious packets.

Distributed denial of service attacks are one of the most difficult security problems on the Internet today. Attack traffic, which is currently a protection mechanism against DDoS attacks, is filtered on the victim's side.

An attacker can achieve his goal of blocking access to the victim's bandwidth whether or not the attack traffic is filtered by the victim.

When the victim recognizes the attack, the victim starts the router to collect the appropriate number of attack packets sent by the attacker, collects them as inspection data, and devises a method to block the attack.

However, DDoS attacks can be cumbersome or difficult to block malicious requests if they overwhelm the victim with too much traffic, and if the source IP address is inaccurate and constantly random.

Korean Registered Patent No. 10-0858271

In order to solve this problem, the present invention applies the client puzzle to the input router, uses the route fingerprint system to the output router, and introduces quantum annealing technology to the server side to increase the amount of malicious packets entering the network in a hybrid manner. The purpose of the present invention is to provide an attack packet detection system and method through IP traceback analysis that minimizes DDos attacks by reducing DDoS attacks.

An attack packet detection system through IP traceback analysis according to the features of the present invention for achieving the above object,

an input router that sets a client puzzle composed of authentication sections to the client; and

The client's IP address and corresponding route fingerprint are stored in a mapping table, and if the same data as an incoming packet is included in the mapping table, a quantum annealing process is performed on the incoming packet, and the quantum annealed packet is converted into malicious and a server that determines the packet as a packet and deletes it from the mapping table, and the client interworks with the input router to deliver the packet to be transmitted to the server when the client puzzle is solved.

After the client solves the client puzzle, a solution to the client puzzle is generated and transmitted to the server through the input router;

The input router transmits the packet to the server if the client puzzle is solved according to the solution, and deletes the packet if the client puzzle is not solved;

The server records the answer as an associated temp in a temp table using a timestamp, and displays a hash of the relative temp and the client's arrangement.

The present invention further includes an output router that receives a packet from an input router, includes a unique route fingerprint in a header of the packet, and transmits the packet to the server.

The output router generates the route fingerprint consisting of a distance indication field (R.dist) and a route indication field (R.pid) in the incoming IP packet R transmitted by the client, and initializes the value of R.dist to 0. and R.dist + 1 is calculated as the value of R.dist, and H(R,pid, Ni) performing the hash operation is calculated as the value of R.pid to transfer the incoming IP packet R to each hop ( hop), and the Ni may be a random number related to the R, an ingress interface.

A method for detecting attack packets through IP traceback analysis according to the features of the present invention,

setting a client puzzle consisting of authentication sections in an input router;

The input router receives a solution for solving the client puzzle from the client, and if the client puzzle is solved according to the solution, transmits the packet to the server, and deletes the packet if the client puzzle is not solved. doing;

receiving a packet from the input router by an output router connected to the input router, and including a unique path fingerprint in a header of the received packet;

comparing data identical to the route fingerprint of the incoming packet from the server in the mapping table, and determining that the packet is valid if the route fingerprint exists in the mapping table; and

The server performs a quantum annealing process on the incoming packet, determines the quantum annealed packet as a malicious packet, and deletes it from the mapping table.

According to the configuration described above, the present invention has the effect of minimizing the DDoS attack by reducing the amount of malicious packets flowing into the network by applying the hybrid method, increasing network performance, and increasing network bandwidth.

The present invention has an effect of providing optimal efficiency capable of recognizing and mitigating a DDoS attack.

1 is a diagram showing the configuration of an attack packet detection system through IP backtracking analysis according to an embodiment of the present invention.
2 is a diagram showing a mathematical model of IP backtracking according to an embodiment of the present invention.
3 is a diagram showing an example of a route fingerprint according to an embodiment of the present invention.
4 is a diagram for explaining a method of detecting an attack packet through IP backtracking analysis according to an embodiment of the present invention.

Throughout the specification, when a certain component is said to "include", it means that it may further include other components without excluding other components unless otherwise stated.

1 is a diagram showing the configuration of an attack packet detection system through IP backtracking analysis according to an embodiment of the present invention, FIG. 2 is a diagram showing a mathematical model of IP backtracking according to an embodiment of the present invention, and FIG. is a diagram showing an example of a route fingerprint according to an embodiment of the present invention.

An attack packet detection system 100 through IP traceback analysis according to an embodiment of the present invention includes a client 110, an input router 120, an output router 130, and a server 140.

The input router 120 sets a client puzzle composed of authentication sections to the client 110 .

The client 110 can transmit a packet to be transmitted to the server 140 when the client puzzle is solved in association with the input router 120.

The server 140 stores a mapping table including the IP address of the client 110 and the corresponding route fingerprint, and if the same data as the incoming packet is included in the mapping table, performs a quantum annealing process on the incoming packet, The quantum annealed packet is determined as a malicious packet and deleted from the mapping table.

Output router 130 receives a packet from input router 120, includes a unique route fingerprint in the header of the packet, and forwards the packet to server 140.

The present invention provides a traceback approach in which ICMP-based Packet Logging is integrated with Path Finger Print to achieve the best packet logging with low overhead. That is, a small number of attack packets require little effort in the traceback process and a small amount of resources allocated to intermediate routers for packet logging purposes, since the client puzzle is integrated on the input side.

The present invention uses a quantum annealing method based on an optimization technique. The reason is that multivariate improvement problems consist of finding the most extreme and minimum estimates for the total array of autonomous elements that characterize the design and for the capacity of many free elements (referred to as the cost task).

Cost tasks depend on the setup, and you need to find the ideal setup that limits or expands the cost tasks.

Backtracking of the present invention has multiple router elements that define the multi-path configuration of self-quantum annealing to be a better method for optimization.

The present invention provides a tracking model based on route fingerprint.

The present invention features a novel performance measure for evaluating proposed schemes, where the amount of packets needed to develop a complete attack scheme and even storage needs are evaluated.

(1) Traceback Model

Backtracking consists of two basic parts: client confusion and unique finger trails.

Assume that there is a direct path between the intruder and the victim between d individual routers.

The Ri router marks the packet and calculates the probability that another router will not use the labeled packet again.

이다.As shown in Figure 2, if the R1 router marks one packet, the probability that it is not marked by another router is

am.

The hash value is divided into 8 separate pieces, and one of them is sent randomly.

)은 다음의 수학식 1과 같다.Therefore, the probability of generating a marked packet is P/8. Probability that one indication is generated and no other router uses the indication (

) is equal to the following Equation 1.

The probability (Pr(ei)) that two or more marked packets arrive at the edge (ei) as a set of eight individual pieces is:

은 하나의 표시된 패킷의 도착 확률,

은 표시된 패킷이 수집기에 도달하지 않을 확률이다.where N is the number of packets,

is the arrival probability of one marked packet,

is the probability that the marked packet will not reach the collector.

By subtracting both values from 1, we can calculate the probability that two or more marked packets will arrive at the collector.

Because 8 segments are required for traceback, power up 8 times. For example, suppose each attacker sends 25 packets per second. Then, the backtracking time takes 65 seconds for the detection probability to reach 95% for A1, A2, A3, and A4.

(2) Client Puzzle for input filtering

To mitigate problems caused by incorrect or forged IP source addresses being passed through routers as inputs, a Unicast Reverse Path Forwarding (RPF) feature is provided.

The concept of input filtering is that when unicast RPF is activated on a client interface, the input router 120 checks all packets received as input, displays the client 110 and the client interface in the routing table, and checks whether they match the received interface. Check.

Unicast RPF ensures that packets received on a router interface reach the packet's source on one of the best return paths.

When a packet is received on one of the best reverse paths, it forwards the packet to server 140 as usual. If a packet is received on the same interface, the client address can be changed or forged if there is no router on the reverse path.

If unicast RPF cannot find a reverse path, the packet is dropped.

The present invention introduces the client puzzle concept to the input router 120 to improve input filtering options.

Client puzzles can be sent to either the input router 120 or the input switch depending on the strategy.

When the client 110 transmits a packet, a cookie is connected and a timestamp is displayed.

Server 140 provides puzzles and solutions that approximate the puzzle, the server temp, the surviving puzzle time, and the stream identifier.

Server 140 then sends the puzzle and its parameters, flow identifier, server time, puzzle maturity and elapsed time back to client 110, server 140, and client cookie.

Client 110 finds the contract after the puzzle and responds to server 140's diagnosis. The server 140 receiving this message uses the server timestamp to record it in the temporary table of the server 140, determines whether the writing in the temporary table has not been completed, and searches the hash to distinguish it from the one sent by the client 110. to check the response.

Given a correct answer, server 140 accepts the packet. Hash Reversal Puzzles are used to convey granular puzzles that customers confuse with single hash reversals, including indications to give customers an idea of where the answer lies.

In order to change the difficulty of the puzzle, the accuracy of the clue (hint) can be increased or decreased.

The puzzle consists of an authentication section called the Bastion.

Suppose a randomly generated number "x" is used as hash h(x) input.

To make the puzzle O(D), the guarantor passes the hash and h(x) and you(0,D) to the customer.

you(0,D) always cycles a randomly chosen number around 0 and D. At the input router 120, the client puzzle concept is distributed to reduce network traffic.

After the client 110 solves the client puzzle, the solution to the client puzzle is generated and transmitted to the server 140 through the input router 120 .

The value of x is calculated depending on whether the puzzle was solved or not. The input router 120 forwards the packet forwarding request to the server 140 if the client puzzle is solved, otherwise it is deemed malicious and the packet is dropped.

Client 110 must submit the answer to the server cookie associated with the puzzle. To be precise, the server 140 uses the timestamp to record the answer in a temp table with an associated nonce, and displays a hash of the associated nonce and an array of clients 110, making server cookies easier. make sure it's made

A client 110 that understands the puzzle is granted best access to the server 140, and a client 110 that does not understand the puzzle considers it malicious and discards the packet.

(3) Path Fingerprint for Output Filtering

On client systems, it is standard to create inbound access principles to control what activities are allowed on the Internet.

In the client system, there is a method of setting an outbound channel in the client originating switch as a way to send out packets only through the allocated IP address space.

The present invention provides outbound filtering options for the output router (130).

The route fingerprint is located on the output router 130 that must reach the server 140.

Each IP packet abnormally contains a unique path fingerprint into the IP packet, and the fake fingerprint IP packet is considered malicious.

To generate a unique fingerprint in the discovery of IP packets, each participating switch assigns an n-bit self-guaranteed number to each frame interface and keeps these numbers secure.

The unique method of marking an IP packet consists of two fields: a d-bit removal field (the number of cross-transfer switches) and an n-bit proof of distinction field (an identifier obtained from searched system data and an irregular number).

A unique indication of an IP packet is placed in the header of the IP packet and passed to the destination next to the packet. The unique fingerprint of an IP packet is placed in the header of the IP packet and delivered to the destination along with the packet.

When the output router 130 receives an IP packet, it first examines the partition field. If respect is 0, the Tolerant router will stand by and fall back to an Intrigue router that has experience in receiving packets.

Tolerant routers set the Detach field to 1 and clear the ID field to the self-assured number associated with the packet interface move.

If the Separation field starts with a non-zero Consideration, it is extended by 1, and redesigns the recognizable evidence field to H(PID, Ni). Here, PID represents a current estimate of the path indication field of the packet, and Ni represents an arbitrary number of weak impacts approaching in reverse.

The ideal fingerprint size used in the present invention is 3 bits for no of hop and 6 bits for pid.

Each IP header has a 16-bit proof field with space to remove the route fingerprint. These 16 bits are divided into two fields.

One is used to store a separate estimate with 5 bits, and the remaining bits are used to store PID considerations.

Primary router R1 sets the detach field to 1, and sets the primary PID to an arbitrary number on the mobile interface, i.e., N1.

Each router increments the Separation field and updates the PID field. As such, it can be seen from the past PID considerations and the irregular number of currently accessed interfaces. H indicates that a hash operation is performed.

R is the incoming IP packet sent by client 110.

As shown in FIG. 3, R.dist and R.pid indicate a distance indication field and a route indication field in packet R, respectively. Ni is a random number associated with R, the incoming interface.

The method of updating the incoming packet R at the output router 130 is as follows.

The output router 130 initially initializes the value of R.dist to 0, calculates R.dist + 1 as the value of R.dist, and calculates H(R,pid, Ni) as the value of R.pid .

The process of generating the route fingerprint is the same as Algorithm 1 below.

(4) Update route forwarding table

The present invention implements a Source Initiated Path Forwarding (SIPF) method. The IP packet source first updates the SIPF table, which is forwarded to the next router in the path.

The SIPF table is used to identify and process malicious packets. In particular, the SIPF table includes three fields: IP, Pid, and Counter.

Here, IP is the IP address of different clients (sources) 110, Pid is a unique mark of the fingerprint, and the counter represents the number of a particular client 110 that disappears from the server 140.

When the web topology or web method changes due to dynamic control (routing), a SIPF table is created and the corresponding item is upgraded.

The counter value can be expanded (or contracted) based on a database that can be used to store the SIPF.

If the destination receives an IP packet from another IP address, the table can be added to another segment.

Therefore, it can be said that SIPF requires only a moderate proportion of confinement and reduces the ideal open entry.

The ICMP ECHO request message explicitly checks the track fingerprint of the explicit IP source address. The destination must send an ICMP ECHO request to the IP address of the client 110 before entering another IP address into the SIPF table. On the other hand, the exceptional check available in the returned ICMP ECHO response message monitors with a forward-looking impression of that IP address.

There are two main reasons for checking the route fingerprint of a specific IP address. First, the first is to add a new IP address to the IP packet, and the second is instructions to upgrade a segment of the SIPF table.

Considering the essential situation when another client arrives, the SIPF table cannot mandate mapping of all possible IPs. The tendency to replace existing SIPF tables with others is similar to the underlying problem.

Therefore, when the table is full, an alternative calculation is needed to replace the aisle of the table. Substitution calculations are the most frequently used calculations.

When the table is full, the IP address of the client (Source) 110 is removed by a new push towards the IP packet segment.

The number of entries allowed in the SIPF table is determined by the administrator or executive of the web server.

When the SIPF table is full, the current entries in the SIPF table are replaced with new Debuts by MFU Algorithm 2 as follows:

The process of updating the SIPF table is the same as Algorithm 2 below.

R represents an incoming packet and T represents a scheduling queue.

Information stored in the header of the packet includes R.ip and R.pf.

R.ip is the IP address of the client 110, and R.pf represents a route fingerprint.

ICMP.addr represents the value of the ICMP (Internet Control Message Protocol) echo request of the new incoming packet.

ICMP is one of the internet protocol suites and is used for network diagnosis or control purposes in IP operation. It is created as a response to an error when an error occurs on the network and transmits an error packet to the sending IP address.

The server 140 determines whether R.pf = SIPF.pf, and if SIPF.counter > 35, deletes the entry from the SIPF table and moves the packet to the end of the scheduling queue T.

R.pf = SIPF.pf is the case where the same data as the incoming packet is included in the SIPF table.

When the server 140 determines that SIPF.counter > 35 is not, SIPF.counter = SIPF.counter + 1 is performed.

When the server 140 determines that R.pf = SIPF.pf, an ICMP echo request message is generated and transmitted to the client 110.

If R.pf = SIPF.pf, the server 140 generates an ICMP echo request message and transmits it to the client 110, and ICMP.pf! = IP.pf, the SIPF table is updated with new R.ip and R.pf, and SIPF.counter is set to 1.

If R.pf = SIPF.pf, the server 140 generates an ICMP echo request message and transmits it to the client 110, and ICMP.pf! = If not IP.pf, discard fake packets after marking them as fake packets in the SIPF table.

(5) Quantum Annealing Method

In server 140, the quantum annealing method is used as part of the optimization process.

A quantum annealing method is used to find a minimum solution set in a packet flowing into the server 140 after performing path fingerprint filtering. The quantum annealing method may be a known technique for finding the minimum solution set of a packet.

The quantum annealing method is a metaheuristic for finding the global minimum of a given hypothesized function for a given set of candidate solutions by a process using quantum fluctuations.

Quantum annealing initiates quantum mechanical superposition of all candidate states with equal weight. The size of all states continuously changes even after a certain amount of time has elapsed, resulting in quantum tunneling between different states.

The sample space is expressed as Equation 3 below.

Here, "a" is an atom, and the number of atoms in the test space forms a solution.

The number of solutions is shown in Equation 4 below.

Here, n is the number of nodes and r is the number of malignant reactions. Atoms represent packets in a network, and spaces represent network areas.

Accessible strategies are only utilized for a small set of solutions. In other words, advances can be made on quantum annealing technology because a vast solution set cannot be prepared.

The hypothesis function is as shown in Equation 5 below.

Evaluate the probability that a hub behaves maliciously given a hypothesis function. The probability value (p) of a hub becoming malignant is calculated by Equation 6 below.

Here, N _i is the number of packets entering the node, and I _f is the sum of incoming flows. These parameters are used to test whether a packet is malicious, and to test if a malicious node has been removed from the network.

The probability value p for a hub to become malignant is given as an input to quantum annealing, which in turn creates a sample space.

Atoms are made for solutions.

For every iteration, the objective value of the hypothesized function is checked as follows.

If the quantum generated is not likely to give the best solution, the next iteration is preceded by the already generated solution.

If the current atom is likely to be ideal, the individual atom in the solution is accepted as the best solution.

When a better opportunity arises, the next iteration is recreated with the current solution.

A similar procedure is repeated until the most dramatic iteration is reached or a final measure is met where the objective of the hypothesized function becomes zero.

At the end of the iteration, the final solution is selected as the best answer to distinguish malicious packets. Packets written to atoms represent malicious packets, and these packets are removed from the system. A quantum annealing based optimization process is described in Algorithm 3 below.

It is assumed that n is the number of nodes, r is the number of malicious nodes, and i=0 (step 1).

Server 140 may calculate quantum atoms to detect attack packets.

The server 140 may calculate a hypothesis function using Equation 5 (step 2) and calculate a probability value using Equation 6 (step 3).

The server 140 may calculate the number of atoms and an objective value (ov) in the sample space using Equations 1 and 2 (step 4).

The server 140 repeats until i<=N or ov _i becomes ov _i-1 (step 5).

Server 140 generates each quantum atom and selects the best combination of atoms (step 6).

The server 140 calculates target values for the current quanta and the generated quanta (step 7).

Server 140 proceeds to step 5 with i = i+1 and the generated solution if both are generated as the best solution (step 8).

Server 140 proceeds to step 5 with i = i+1 and the individual atoms in the solution if neither is the best solution and the current atom is the best (step 9).

If neither is the best solution and the current solution is the best, the server 140 proceeds to step 5 with i = i+1 and the current solution (step 10).

Server 140 finds the best solution for which solution ov _i detects a DDoS attack.

4 is a diagram for explaining a method of detecting an attack packet through IP backtracking analysis according to an embodiment of the present invention.

Using the aforementioned (2) Client Puzzle for input filtering, (3) Path Fingerprint for output filtering, (4) Path propagation table update, and (5) Quantum Annealing method. and how to detect attack packets.

The client 110 generates a packet request message for transmitting a packet (S100).

The input router 120 performs a client puzzle on the client 110 requesting the packet (S101), determines whether the solution to the client puzzle matches (S102), and if it matches, transmits the packet to the server 140. (S103), and if the answers do not match, the incoming packet is removed (S104).

The output router 130 includes a route fingerprint in the header of an incoming packet and updates the route fingerprint for each hop (S105).

The server 140 compares whether the same data as the incoming packet exists in the SIPF table, and determines whether the packet is legitimate according to whether the path fingerprint exists in the SIPF table (S106, S107). If the path fingerprint is present in the SIPF table, it is a legitimate packet.

The process of determining whether the packet is legitimate in the server 140 represents the above-described process of updating the SIPF table.

If the incoming packet is not a legitimate packet but a malicious packet, the server 140 discards it (S108), and if the incoming packet is a legitimate packet, it transmits the packet to the quantum annealing process (S109).

The server 140 performs a quantum annealing process to determine whether an incoming packet is a DDoS attack packet (S110), if it is a DDoS attack packet, discards the packet (S111), and if it is not a DDoS attack packet, performs a service request. Do (S112).

As described above, the embodiments of the present invention are not implemented only through devices and/or methods, and may be implemented through programs for realizing functions corresponding to the configurations of the embodiments of the present invention, recording media on which the programs are recorded, and the like. And, such an implementation can be easily implemented by an expert in the technical field to which the present invention belongs from the description of the above-described embodiment.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements made by those skilled in the art using the basic concept of the present invention defined in the following claims are also included in the scope of the present invention. that fall within the scope of the right.

100: attack packet detection system
110: client
120: input router
130: output router
140: server

Claims (9)

an input router that sets a client puzzle composed of authentication sections to the client; and
The client's IP address and corresponding route fingerprint are stored in a mapping table, and if the same data as an incoming packet is included in the mapping table, a quantum annealing process is performed on the incoming packet, and the quantum annealed packet is converted into malicious and a server that determines the packet as a packet and deletes it from the mapping table, wherein the client interworks with the input router to deliver a packet to be transmitted to the server when the client puzzle is solved;
After the client solves the client puzzle, a solution to the client puzzle is generated and transmitted to the server through the input router;
The input router transmits the packet to the server if the client puzzle is solved according to the solution, and deletes the packet if the client puzzle is not solved;
The server records the answer as a related temporary value in a temporary table using a timestamp, and displays a hash of the related temporary value and the array of the client. delete The method of claim 1,
The attack packet detection system through IP traceback analysis further comprising an output router receiving a packet from the input router, including a unique path fingerprint in a header of the packet, and transmitting the packet to the server. The method of claim 3,
The output router generates the route fingerprint consisting of a distance indication field (R.dist) and a route indication field (R.pid) in the incoming IP packet R transmitted by the client, and sets the initial R.dist value to 0. Initialize, calculate R.dist + 1 as the value of R.dist, and H(R,pid, Ni) performing the hash operation calculates as the value of R.pid to transfer the incoming IP packet R to each hop Attack packet detection system through IP traceback analysis, which is updated every (hop), and Ni is a random number related to the R, an incoming interface. The method of claim 1,
The mapping table is a SIPF (Source Initiated Path Forwarding) table used to identify and process malicious packets. IP, which is the address of different clients, Pid, which is a unique fingerprint mark, and Counter, which is the number of a specific client that disappears from the server. field is included,
The attack packet detection system through IP traceback analysis including the client's IP address (R.ip) and route fingerprint (R.pf) in the header of the incoming packet. The method of claim 5,
The server extracts the route fingerprint from the header of the incoming packet, determines whether the extracted route fingerprint has the same data in the SIPF table, transmits the incoming packet to an external network, and If it is determined that the data is not the same in the SIPF table, an attack packet detection system through IP traceback analysis generates an Internet Control Message Protocol (ICMP) echo request message and transmits it to the client. The method of claim 1,
The server calculates a probability value that the incoming packet proceeds as a malicious packet by Equation 1 below, and provides the probability value as an input to a hypothesis function (hp) below, so that the target value of the hypothesis function is 0 An attack packet detection system through IP traceback analysis that evaluates the probability that the packet is malicious by repeating until the final measurement value is met.
[Equation 1]

Here, N _i is the number of packets entering the node, and I _f is the sum of incoming flows.
[Equation 2]

setting a client puzzle consisting of authentication sections in an input router;
receiving, by the input router, a solution for solving the client puzzle from the client, and if the client puzzle is solved according to the solution, transmitting a packet to a server, and deleting the packet if the client puzzle is not solved; ;
receiving a packet from the input router by an output router connected to the input router, and including a unique path fingerprint in a header of the received packet;
comparing data identical to the route fingerprint of the incoming packet from the server in the mapping table, and determining that the packet is valid if the route fingerprint exists in the mapping table; and
The server performs a quantum annealing process on the incoming packet, determines the quantum annealed packet as a malicious packet, and deletes it from the mapping table. The method of claim 8,
The server calculates a probability value that the incoming packet proceeds as a malicious packet by Equation 1 below, and provides the probability value as an input to a hypothesis function (hp) below, so that the target value of the hypothesis function is 0 A method of detecting attack packets through IP traceback analysis that evaluates the probability that the packet operates as malicious by repeating until the final measurement value is satisfied.
[Equation 1]

Here, N _i is the number of packets entering the node, and I _f is the sum of incoming flows.
[Equation 2]

Images