An Efficient Algorithm for Intrusion Source Identification

There has been a growing interest in the design and development of intrusion detection systems for the Internet. One of the goals of these systems is to detect the source(s) of attack. Based on the position of the victim in the network, our scheme selects only a small fraction of routers to monitor the traffic and identify packets that bear signatures of the attack packets. From the information provided by these chosen routers, the network is pruned and another set of routers is chosen to identify the source of attack, until the source router is detected. By using the properties of the centroid tree, we present an efficient algorithm for identifying the source of the intrusion.