Prefix visibility ratio improves carpet bombing attack detection accuracy
Prefix Visibility Ratio: Quantifying Partial Observability in Carpet Bombing Detection
Networking and Internet Architecture
Summary
Carpet bombing attacks spread bad internet traffic across many addresses, but monitoring tools often see only some of those addresses. This makes it hard to spot attacks accurately. The authors introduce a measure called Prefix Visibility Ratio (PVR) that shows how much of the attacked area is actually visible to security tools. They build a system named VANTA that uses PVR to combine detailed and broad data, improving attack detection. Tests show VANTA detects attacks more accurately, especially when visibility is low, and suggest visibility should be measured and reported for better security tools.
What this means in practice
- •For network security teams: Detect distributed malicious network traffic more accurately by accounting for partial visibility in monitored address spaces.
- •For internet service providers: Improve attack detection by integrating visibility-aware evidence fusion in network monitoring tools covering large IP address prefixes.
Authors
Farid Naït-Abdesselam, Laaziz Lahlou, Doha Bentaoussy, Hugo Lege, Eve Lin, Nadjia Kara
Abstract
Carpet bombing attacks distribute malicious traffic across many destinations within a network prefix, while operational monitoring commonly provides destination-specific telemetry for only a subset of those targets. This creates an attack-conditional observability problem that is not captured by address utilization or nominal monitoring coverage. We introduce the Prefix Visibility Ratio (PVR), defined as the fraction of attacked destinations for which the telemetry required by the host-level evidence plane is available, and argue that PVR should be treated as an explicit evaluation dimension for carpet bombing detection. We then present VANTA (Visibility-Aware Network Threat Analysis) as one concrete way to operationalize this principle. VANTA combines host-level and prefix-level anomaly scores, estimates PVR online from router-side destination evidence and the monitored-destination inventory, and adjusts evidence fusion according to both estimated visibility and estimator confidence. Across a validated campaign of 2,160 Mininet runs, VANTA achieves 99.18% precision, 93.46% recall, a global F1-score of 96.24%, and a 1.54% false-positive rate. In a separate matched-observability study using task-adapted feature-level reference implementations, VANTA reaches 95.89% pooled F1 and 92.39% recall for configured PVR<=10%, with its largest advantage appearing at configured PVR=1%. These reference comparisons are intended to isolate observability effects under a common binary detection task rather than to reproduce the original end-to-end objectives of the referenced systems. The results establish attacked-destination visibility as a measurable factor that can materially change detector behavior and should be reported explicitly in future carpet bombing evaluations.