Dynamic Probabilistic Packet Marking Based on PPM

Most of the probability of packet marking (PPM) have existed many problems such as the lost of marking information, the difficulties to reconstruct attack path, low accuracy and so on. In this work, we present a new approach, called dynamic probabilistic packet marking (DPPM), to further improve the effectiveness of PPM. Instead of using a fixed marking probability, we propose to judge whether the packet has been marked or not then choose a proper marking probability. DPPM may solve most of the problems in PPM method. Formal analysis indicates that DPPM outperforms PPM in most aspects.