Monitor placement for stepping stone analysis

The precondition for stepping-stone analysis is to record network events through network monitors. Little work has been done on how to place monitors. In this paper, we propose the technique for the optimal placement of passive monitors in a network where there are constraints on the number of available monitors for deployment. The placement problem is defined in terms of information theory metrics. For a given number of monitors and network topology, average entropy and "worst-case" entropy that describe the remaining uncertainty in the origin of an attack when monitors work perfectly are considered as the optimal object. A brief proof that the worst-case deployment problem is NP-complete is presented. Greedy algorithms based on graph centrality heuristics for finding high quality deployments are introduced to solve this problem. An automatic monitor placement tool, which implements our approach, is developed and we use real network topology in the experiments to evaluate our results.