Fast Two Phrases PPM for IP Traceback

In probabilistic packet marking(PPM) for IP tracebacking, the number of packets that are needed to reconstruct the attacking paths depends on the precision of the attacking paths. In this paper, a Fast Two Phrases(FTP) PPM for IP tracebacking is proposed, which depends on the division of Autonomous System(AS) and two algorithms are used to reconstruct the attacking paths. It can reconstruct the exactly attacking paths between AS when it has received tens of packets, and reconstruct the attacking paths in AS after receiving more packets. This method can reduce the number of packets that are needed to reconstruct the attacking paths to the lowest while reducing the complexity of packet marking and reconstructing.