IP traceback through (authenticated) deterministic flow marking: an empirical evaluation

EURASIP Journal on Information Security

Table 6 The relationship between K , M , S , NB, TR, and MR on all evaluation data sets for the DFM approach

				Darpa 1999		Darpa 1999		CISDA		MAWI		Dal2010
				attack		attack-free		Oct 2012		Dec 2012
K	M	S	NB	TR	MR	TR	MR	TR	MR	TR	MR	TR	MR
			*(M+S+1)*
1	60	0	61	100	7.74	100	6.07	100	8.52	100	5.68	100	10.85
2	30	1	32	98.65	14.13	99.94	12.09	92.91	9.96	97.23	8.60	93.33	15.02
3	20	2	23	98.62	20.51	99.94	18.11	91.76	10.82	96.96	11.38	92.53	18.79
4	15	2	18	98.61	26.89	99.88	24.11	91.03	11.43	96.84	14.12	91.46	22.21
5	12	3	16	98.24	33.18	99.45	30.00	90.56	11.93	96.20	16.70	89.77	25.21
6	10	3	14	78.64	35.54	81.73	32.35	90.11	12.34	92.88	18.62	87.11	27.67
10	6	4	11	66.98	39.66	70.97	36.77	88.82	13.40	86.06	23.17	76.98	33.36
12	5	4	10	64.55	40.63	68.65	37.98	88.48	13.78	84.27	24.75	74.63	35.07
15	4	4	9	60.83	41.26	64.99	38.98	88.08	14.28	81.74	26.55	72.13	37.07
20	3	5	9	59.71	41.69	63.38	39.94	87.64	14.98	77.84	28.37	68.35	39.40
30	2	5	8	59.27	42.28	62.21	41.32	87.12	16.15	74.73	30.66	64.82	42.35
60	1	6	8	58.49	43.43	58.90	43.51	85.95	18.91	70.76	34.14	59.50	46.98

DFM correctly determines the origin of 90% to 99% of packets (TR) by marking 12% to 33% of all packets (MR) if the first five packets of every outgoing flow are marked (italic entries).