PaperlayerView exact revision on arXiv

Source-linked AI summary

Prefix Visibility Ratio: Quantifying Partial Observability in Carpet Bombing Detection

Farid Naït-Abdesselam, Laaziz Lahlou, Doha Bentaoussy, Hugo Lege, Eve Lin, Nadjia Kara

arXiv:2610.29802v1cs.NI

TL;DR

Carpet bombing can leave defenders with limited destination-specific telemetry, a gap not captured by address utilization or nominal monitoring coverage. The paper defines PVR and presents VANTA, which estimates visibility online and adapts evidence fusion. Across 2,160 validated Mininet runs, VANTA reports 99.18% precision, 93.46% recall, and a pooled F1-score of 96.24%; matched-observability comparisons show detection behavior changes as visibility decreases.

  • Problem

    Carpet bombing spreads traffic across many destinations, while monitoring may expose destination-specific evidence for only a subset, a condition not captured by utilization or nominal coverage.

    Source: §1 · p. 1, §3.1 · p. 5

  • Method

    VANTA estimates PVR online and adapts fusion of host- and prefix-level anomaly evidence according to estimated visibility and estimator confidence.

    Source: §1 · p. 2

  • Results

    Across 2,160 validated Mininet runs, VANTA achieves 99.18% precision, 93.46% recall, and a pooled F1-score of 96.24%.

    Source: §10 · p. 21

  • Takeaways & Limitations

    Matched-observability results show binary detection behavior can change substantially as destination-specific visibility decreases, with the largest differences in the sparsest configured regimes.

    Source: §10 · p. 21

    The evaluation uses a synthetic Mininet /24 setting and task-adapted reference methods rather than ISP-scale conditions or exact end-to-end executions of the original systems.

    Source: §9.6 · p. 21

Abstract

from arXiv · show

Carpet bombing attacks distribute malicious traffic across many destinations within a network prefix, while operational monitoring commonly provides destination-specific telemetry for only a subset of those targets. This creates an attack-conditional observability problem that is not captured by address utilization or nominal monitoring coverage. We introduce the Prefix Visibility Ratio (PVR), defined as the fraction of attacked destinations for which the telemetry required by the host-level evidence plane is available, and argue that PVR should be treated as an explicit evaluation dimension for carpet bombing detection. We then present VANTA (Visibility-Aware Network Threat Analysis) as one concrete way to operationalize this principle. VANTA combines host-level and prefix-level anomaly scores, estimates PVR online from router-side destination evidence and the monitored-destination inventory, and adjusts evidence fusion according to both estimated visibility and estimator confidence. Across a validated campaign of 2,160 Mininet runs, VANTA achieves 99.18% precision, 93.46% recall, a global F1-score of 96.24%, and a 1.54% false-positive rate. In a separate matched-observability study using task-adapted feature-level reference implementations, VANTA reaches 95.89% pooled F1 and 92.39% recall for configured PVR<=10%, with its largest advantage appearing at configured PVR=1%. These reference comparisons are intended to isolate observability effects under a common binary detection task rather than to reproduce the original end-to-end objectives of the referenced systems. The results establish attacked-destination visibility as a measurable factor that can materially change detector behavior and should be reported explicitly in future carpet bombing evaluations.

1. Introduction

Carpet bombing spreads traffic across many destinations, so aggregate network evidence may coexist with limited destination-specific telemetry. The paper defines PVR to quantify attack-conditional visibility and presents VANTA, which adapts host- and prefix-level evidence using online visibility estimates and estimator confidence.

1. Introduction

  • Carpet bombing can threaten shared links and upstream connectivity while each destination’s traffic remains below conventional host-level thresholds.Destination-specific telemetry may be unavailable for many addresses selected by the attacker.Source: §1 · p. 1
  • PVR measures the fraction of attacked destinations with telemetry required by the host-level evidence plane, unlike address utilization or nominal monitoring coverage.It is defined as |A_t ∩ O_t|/|A_t|, where O_t contains destinations providing that host-level telemetry; gateway measurements alone do not place a destination in O_t.Source: §1 · p. 2
  • VANTA combines host- and prefix-level anomaly evidence, estimates PVR online, and adapts fusion using estimated visibility and estimator confidence.Its estimator uses router-side destination-rate anomalies and the monitored-destination inventory, with temporal smoothing; when visibility is low or uncertain, it shifts weight toward prefix-level evidence.Source: §1 · p. 2
  • The paper evaluates VANTA in 2,160 Mininet runs and separately compares task-adapted reference implementations under matched destination observability.The reference campaign studies binary prefix-level detection, not the original end-to-end objectives; NetRadar’s original task includes victim localization.Source: §1 · p. 2

2. Related Work

Prior work addresses distributed attacks through aggregate network measurements, cross-server analysis, traffic classification, and techniques for incomplete measurements. This paper focuses on attacked-destination observability as a distinct dimension and uses PVR to quantify it.

2.1 Carpet Bombing Detection

  • Most prior carpet-bombing work characterizes traffic at measurement points without explicitly modeling overlap between monitored destinations and the attacker-selected set.Aggregate visibility at a border router does not guarantee destination-specific evidence for the attacked hosts.Source: §2.1 · p. 3
  • NetRadar correlates gateway and server-side evidence across destinations, but its original task includes attacked-server localization rather than VANTA’s binary prefix-level detection.NetRadar-S is a feature-level adaptation for the common binary detection task, not an end-to-end reproduction.Source: §2.1 · p. 3

2.2 Flow and Frequency-Domain Traffic Classification

  • FlowLens and Whisper represent traffic with statistical or frequency-domain features, while missing destination records limit the evidence available to any classifier.Their reference adaptations retain representative feature families and supervised-classification structures, but are not exact reproductions of the original systems.Source: §2.2 · p. 3

2.3 Partial Observability and Missing Telemetry

  • PVR complements coverage and utilization measures by quantifying the overlap between the attacker’s destinations and those observable to the defender.The paper’s contribution is to make attacked-destination observability an explicit threat-model property, estimate it online, and use it as an evaluation axis and adaptive-detection input.Source: §2.3 · p. 4

3. The Prefix Visibility Problem

The prefix visibility problem separates host-specific telemetry from prefix-level measurements that can remain available without host instrumentation. Because attack targets may overlap monitored destinations differently over time, utilization and nominal coverage alone do not characterize attack visibility.

3. The Prefix Visibility Problem

  • Prefix-level measurements remain distinct from host-specific observations, and unmonitored or inactive destinations can still contribute to shared-network impact.Gateway evidence can include aggregate volume, destination dispersion, source diversity, flow fan-out, or entropy; host evidence includes destination-specific counters and measurements.Source: §3 · p. 4

3.1 Address Utilization and Nominal Monitoring Coverage

  • AUR describes how much of the usable prefix is active, while nominal monitoring coverage describes how much of the active set can potentially provide destination-specific evidence.Neither measure indicates whether the attacker’s selected destinations overlap the observable set.Source: §3.1 · p. 5

3.2 Attack-Conditional Visibility

  • Identical utilization and monitoring coverage can yield different host-level evidence when attacks target different subsets of destinations.Target rotation can also change attack-monitor overlap over time without changing the monitoring infrastructure.Source: §3.2 · p. 5
  • Figure 1 depicts a broad attacked surface alongside destination-specific telemetry available for only a subset of attacked destinations.Prefix-level traffic can reveal abnormal traffic even when host-level evidence depends on the attack-monitor intersection.Source: §3.2 · pp. 5–6, Figure 1 · p. 6

4. Prefix Visibility Ratio (PVR)

PVR measures how much of the attacker-selected destination set has the telemetry required for host-level evidence, distinguishing attack visibility from address utilization and nominal monitoring coverage. The section also clarifies how finite-prefix settings and visibility regimes should be interpreted.

4.1 Definition

  • PVR is |A_t ∩ O_t|/|A_t|, the fraction of attacked destinations with telemetry required by the host-level evidence plane.Router-side ingress measurements alone do not place a destination in O_t.Source: §4.1 · p. 6
  • PVR is independent of attack intensity and can change across observation windows as targets or telemetry availability change.It is a dynamic property of the interaction between the attack surface and monitoring infrastructure.Source: §4.1 · p. 6
  • Unlike address utilization and monitoring coverage, PVR is conditional on the actual attacked destination set and its overlap with monitored destinations.Two attacks against the same prefix can have identical address utilization and monitoring coverage but different PVR values.Source: §4.1 · pp. 6–7

4.2 Configured and Effective PVR in Finite Prefixes

  • Finite address spaces can make nominal PVR settings map to the same realized overlap, especially when the attacked set is small.The experiments distinguish configured PVR from effective PVR, which is recomputed from the instantiated attack and observable sets.Source: §4.2 · p. 7

4.3 Visibility Regimes and Interpretation

  • Full visibility is PVR=1, partial visibility is 0.1≤PVR<1, and sparse visibility is PVR<0.1; these are descriptive reporting regimes, not universal thresholds.PVR≤10% is used as a controlled stress condition, not claimed as dominant in real deployments or a sharp transition in difficulty.Source: §4.3 · p. 7

5. Threat Model

The threat model considers distributed attacks that spread traffic across destinations and a defender with complementary destination-specific and network-level evidence. VANTA’s objective is binary prefix-level detection that adapts to estimated attacked-destination visibility.

5.1 Attacker Model

  • The attacker spreads traffic across multiple destinations to threaten shared infrastructure while reducing anomaly evidence at any individual host.The attacker may vary sources, target-set size and composition, traffic intensity, and duration, including targeting inactive addresses.Source: §5.1 · pp. 7–8
  • The attacker is not assumed to know the monitored set, but a monitor-aware adversary that targets unmonitored destinations is outside the validated evaluation.Such an adversary is treated as future work.Source: §5.1 · p. 8

5.2 Defender Model

  • The defender combines destination-specific telemetry available only for monitored hosts with network-level measurements that remain available independently of host instrumentation.Network-side observation does not itself make a destination part of the destination-specific evidence set O_t.Source: §5.2 · p. 8

5.3 Design Objective

  • The task is binary prefix-level carpet-bombing detection; victim localization, source attribution, and mitigation are outside the framework’s scope.The true attacked set and PVR are unknown during operation and must be inferred from available evidence.Source: §5.3 · p. 8, §5.2 · p. 8
  • VANTA estimates PVR online and adapts fusion of host- and prefix-level anomaly scores rather than assuming true PVR is available.As visibility decreases, it shifts emphasis toward prefix-level evidence instead of treating missing host telemetry as benign.Source: §5.3 · p. 8

6. VANTA: Visibility-Aware Network Threat Analysis

VANTA processes destination-specific and prefix-level evidence separately, estimates attack visibility online, and uses estimated PVR and confidence to fuse the two anomaly scores. Its implementation documents the estimator, scoring, fusion, and decision parameters used in the validated campaign.

6.1 System Overview

  • Destination-specific telemetry and gateway or router measurements feed separate host- and prefix-level detectors, while estimated PVR and confidence control their adaptive fusion.The fused evidence supports the final carpet-bombing decision.Source: §6.1 · pp. 8–9, Figure 2 · p. 9

6.2 Online PVR Estimation

  • When per-destination router measurements are available, VANTA infers the attacked set and intersects it with monitored destinations; otherwise, it estimates visibility from destination dispersion and host evidence.The raw estimate is temporally smoothed and accompanied by a confidence score; fallback inference has lower confidence than the direct path.Source: Figure 3 · p. 10, §6.2 · p. 10

6.3 Host- and Prefix-Level Anomaly Scores

  • Host scores use destination-level features, while prefix scores use traffic rate, destination dispersion and entropy, flow fan-out, and source correlation.The feature scores are standardized against benign traffic and averaged; flow fan-out and source correlation are excluded when fewer than two destinations report.Source: §6.3 · pp. 10–11

6.4 Confidence-Aware Adaptive Fusion

  • The raw host weight rises with estimated PVR, and estimator confidence scales its effective contribution; low visibility or low confidence shifts reliance toward prefix evidence.Host evidence becomes dominant only when both estimated visibility and confidence are sufficiently high.Source: §6.4 · p. 11, Figure 4 · p. 12

6.5 Key Implementation Parameters

  • The validated implementation fixes its parameters for the campaign rather than tuning them separately for PVR, AUR, or attack configurations.The parameter table summarizes the values used throughout the validated campaign.Source: Table 1 · p. 12, §6.5 · p. 12

7. Experimental Methodology

The evaluation uses a controlled Mininet campaign to vary address utilization, attack visibility, and attack extent, then compares VANTA with task-adapted references under matched observability. Its scope is controlled characterization rather than estimating operational prevalence or reproducing deployment conditions.

7.1 Testbed and Traffic Model

  • The /24 Mininet testbed fixes 50 legitimate clients, 100 attack sources, and a common aggregation router while varying active destinations and monitoring overlap.Router measurements remain available independently of destination-specific host telemetry; monitoring coverage and attack visibility are coupled by design in this campaign.Source: §7.1 · p. 13

7.2 Visibility and Attack Configurations

  • The campaign combines four address-utilization levels, six configured PVR conditions, and three attack extents across 30 runs per configuration.Configured PVR is a target condition rather than a guarantee: integer conversion can give different configured values the same realized overlap.Source: §7.2 · pp. 13–14

7.3 Calibration, Evaluation Windows, and Metrics

  • Runs use benign calibration and evaluation windows followed by attack windows, with classification metrics pooled across decisions and delay conditional on an alert.The reported delay uses the first detected attack-window index plus a 3 s pre-evaluation offset; PVR error is computed per run after averaging ten attack-window estimates.Source: §7.3 · p. 14

7.4 Task-Adapted Reference Implementations

  • Three feature-level references preserve representative decision structures for a common binary prefix-attack task, not the original systems’ full objectives.NetRadar-S replaces PointNet processing with a Random Forest, and its comparison does not evaluate NetRadar’s victim-localization objective.Source: §7.4 · pp. 14–15

7.5 Observability Modes and Data Splits

  • References receive either full-visibility features as optimistic upper bounds or matched monitored-destination data, with thresholds fixed using validation data.For matched observability, destination probabilities are aggregated by averaging the highest 10% into a prefix-level score; comparisons use held-out, seed-aligned scenarios.Source: §7.5 · p. 15

7.6 Scope of the Current Evaluation

  • The controlled synthetic campaign does not estimate operational PVR prevalence or reproduce ISP-scale conditions, and couples monitoring coverage with attack overlap.Real traces, larger prefixes, adaptive target rotation, exact end-to-end reference reproductions, ablations, oracle-PVR comparisons, and parameter sensitivity remain outside scope.Source: §7.6 · p. 15
  • 4.00 / 4.12 s was the median / mean detection delay among successfully detected runs in the 2,160-run campaign.Complete-miss runs remain false negatives in detection metrics and are excluded only from conditional delay statistics.Source: §7.6 · p. 16, Figure 6 · p. 16

8. Experimental Results

Across the validated campaign, VANTA performs strongly overall, while matched-observability comparisons show its largest advantage at low visibility. Results also show how performance, estimator accuracy, and failure cases vary across the tested AUR–PVR conditions.

8.1 Intrinsic VANTA Performance

  • 99.18% precision, 93.46% recall, 96.24% global F1-score, and 1.54% FPR summarize VANTA’s pooled performance across the validated campaign.The campaign includes 2,160 runs; among detected runs, median delay is 4.00 s and mean delay is 4.12 s, with a maximum of 13 s.Source: §8.1 · p. 16

8.2 Matched-Observability Reference Comparison

  • At configured PVR=1%, VANTA reaches 97.57% mean held-out F1-score and 95.56% recall, versus 72.99% F1 for NetRadar-S, 72.72% for FlowLens-S, and 72.19% for Whisper-S.The strongest reference recall is 57.61%; Figure 7 compares methods under matched destination observability.Source: §8.2 · p. 16, Figure 7 · p. 17
  • Across the held-out grid, pooled F1 is 96.66% for VANTA, 95.57% for NetRadar-S, 95.53% for FlowLens-S, and 95.20% for Whisper-S, with VANTA’s advantage concentrated at low visibility.At PVR=5%, NetRadar-S and FlowLens-S each reach 95.62% F1 versus 92.33% for VANTA; references approach near-perfect classification from PVR=10% upward.Source: §8.2 · p. 17
  • For configured PVR≤10%, VANTA achieves 95.89% pooled F1 and 92.39% recall, versus NetRadar-S at 90.73% F1 and 83.09% recall.VANTA’s FPR is 0.63%, versus 0.15% for NetRadar-S and FlowLens-S, so the recall gain comes with a modest increase in false positives.Source: §8.2 · p. 17, Table 3 · p. 18

8.3 Interaction between AUR and PVR

  • VANTA exceeds 0.90 F1 in 21 of 24 AUR–PVR cells and remains above 0.97 across most of the grid.Figure 8 reports F1 by configured PVR and exposes the joint AUR–PVR structure.Source: §8.3 · p. 17, Figure 8 · p. 18
  • At AUR=0.2 and configured PVR=0.05, only a small monitored subset may remain, sometimes with a single attacked destination in the realized overlap, leaving host evidence weak.The decision consequently relies more heavily on prefix-level information; finite-cardinality effects and detector transitions are possible explanations for nonmonotonic performance, not isolated causal results.Source: §8.3 · p. 18

8.4 PVR Estimation Accuracy

  • The online estimator has 0.0246 mean absolute error and 0.00077 median absolute error; 90.93% of runs have error below 0.05 and 96.11% below 0.10.The largest deviations occur when attacked-set inference is incomplete or temporarily empty, especially when few destinations are attacked or observable; Figure 9 plots error across the AUR–PVR grid.Source: §8.4 · p. 18, Figure 9 · p. 19

8.5 Failure Audit

  • Of 21 complete misses, nine runs across three topology instances show zero detector signals; excluding those nine changes global F1 from 96.24% to 96.44% and recall from 93.46% to 93.85%.The other complete misses cluster mainly around AUR=0.2 and configured PVR=0.05, where realized overlap can be extremely small.Source: §8.5 · p. 19

9. Discussion

The discussion frames attacked-destination visibility as an evaluation dimension distinct from nominal monitoring coverage and interprets VANTA’s results within their tested scope. It also identifies ablations, operational measurements, and more realistic comparisons as needed next steps.

9.1 What PVR Adds to Carpet Bombing Evaluation

  • PVR makes attacked-destination observability an explicit evaluation variable that should be measured, controlled, and reported, beyond traffic intensity or monitoring deployment alone.It can evaluate detector sensitivity across visibility conditions without requiring online estimation or adaptation by the detector.Source: §9.1 · p. 19

9.2 Interpreting the Multi-Level Design

  • The campaign evaluates the complete VANTA pipeline but does not isolate the contributions of host-level evidence, prefix-level evidence, fixed fusion, or adaptive fusion.A dedicated comparison of host-only, prefix-only, fixed-fusion, and visibility-aware fusion variants is needed to quantify each component independently.Source: §9.2 · p. 20

9.3 Interpreting the Reference Comparisons

  • The reference experiments test binary prefix-level detection using task-adapted implementations, not the original systems’ full objectives such as NetRadar’s victim localization.A stronger comparison would preserve each system’s original task, report both binary detection and localization as PVR decreases, and provide comparable gateway evidence.Source: §9.3 · p. 20

9.4 Practical Meaning of Sparse PVR

  • Sparse PVR is a controlled stress condition, not evidence that visibility at or below 10% is typical in production; its operational distribution is unknown.PVR depends jointly on attacker target selection and monitoring deployment, so measuring it in production is an open research problem.Source: §9.4 · p. 20

9.5 Estimator Error and Decision Sensitivity

  • Although the estimator’s validated-campaign mean absolute error is 0.0246, the evaluation does not isolate its effect on classification or establish parameter optimality and robustness.Oracle-PVR tests, controlled estimation perturbations, and systematic parameter sensitivity analysis are identified as needed studies.Source: §9.5 · p. 20

9.6 Limitations and Next Experimental Stage

  • The evaluation uses a controlled Mininet /24 environment with synthetic traffic, active targets, and coverage coupled to configured PVR, rather than operational network conditions.The next stage calls for component and oracle-PVR ablations, paired executions, original-task localization, larger prefixes, adaptive attackers, and real-trace-based traffic; stronger deployment or superiority claims await these extensions.Source: §9.6 · p. 21

10. Conclusion

PVR makes attacked-destination observability explicit, and VANTA demonstrates visibility-aware detection in validated runs. The results support reporting visibility in carpet bombing evaluations while motivating broader validation.

10. Conclusion

  • PVR measures the fraction of attacked destinations with destination-specific evidence available to the defender, conditioned on the destinations selected by the attacker.Source: §10 · p. 21
  • 99.18% precision, 93.46% recall, and a pooled F1-score of 96.24% across 2,160 validated Mininet runs.Mean detection delay was 4.12 s among successfully detected runs.Source: §10 · p. 21
  • In matched-observability comparisons, performance differences were largest in the sparsest configured regimes, while reference methods approached near-perfect classification under full visibility.These task-adapted comparisons isolate binary detection under shared observability rather than reproducing the referenced systems’ original end-to-end objectives.Source: §10 · p. 21
  • Carpet bombing evaluations should report attacked/observable overlap alongside traffic intensity, attack extent, and address utilization.Making overlap explicit exposes visibility assumptions and supports more rigorous evaluation of detection and localization under partial telemetry.Source: §10 · p. 21
  • Future work should test larger prefixes, operational traffic, adaptive monitor-aware attackers, component ablations, oracle-PVR comparisons, and original-task victim localization.These studies are needed to assess how controlled-experiment PVR distributions translate to production and to quantify component benefits.Source: §10 · p. 21

Artifact Availability

The study’s implementation, configurations, scripts, and data are publicly available, with the reported experimental version archived separately.

Artifact Availability

  • The implementation, experimental configurations, analysis scripts, and validated data are publicly available in the VANTA-PVR artifact repository.Source: Artifact Availability · p. 21
  • Release v1.0-arxiv, the exact artifact version corresponding to the reported results, is permanently archived on Zenodo.Source: Artifact Availability · p. 22
  • The artifact includes validated VANTA and task-adapted reference implementations, configurations, scripts, and reproduction data; ongoing extensions are maintained separately.Those extensions are not part of the results reported in the paper.Source: Artifact Availability · p. 22
Loading 2610.29802v1…