New algorithm tracks down the origins of internet attacks

Swiss researcher Pedro Pinto and his colleagues at École Polytechnique Fédérale de Lausanne suggest using the Sparse Interference algorithmPDF to make tracking down the origins of internet threats more efficient. Until now, institutions such as the US National Security Agency (NSA) have used brute force methods to search for the sources of epidemic threats (malware, worms, trojans, internet rumours) in complex networks – but scanning all potentially affected network nodes or address spaces requires a lot of time and resources.

Sparse Interference takes into consideration such factors as time when examining information that spreads in an avalanche-like manner. The researchers say that the algorithm only needs a few clues to confidently identify the origin of, for example, a bogus email or a terrorist posting. According to their study, monitoring only a few chat room participants or social network members, or a limited number of telephones, is sufficient to reliably pinpoint the originator. The researchers say that by monitoring a randomly selected 25% of nodes they managed to achieve an accuracy of 90%, and that the same result is achievable with only 5% of nodes when targeting a specific selection.