6th European Conference - Academic Conferences

Stephen Groat et al.
probability follows a hypergeometric distribution. In the case of locating specific hosts on a subnet, the
probability can be written as:
where N represents the total possible addresses in the subnet, h represents the target host(s), and r
represents the number of guesses an attacker takes in an attempt to find the target address(es).
The best case for the target host is if its address changes at the same rate that an attacker scans a
single address. To provide the fairest assessment, we assume a scenario where the attacker is aware
of the target host changing his/her address. As a result, the attacker randomizes his/her address
guesses, allowing for repetition of addresses. This is in contrarst to the normal approach where an
attacker exhaustively scans a subnet without repetition. The probability of detecting the target host
using an exhaustive search is slightly lower due to the possibility of a host address changing to a
previously guessed address. In the attacker-aware scenario, the probability of detecting the target
host remains the same with each subsequent guess and follows a cumulative binomial distribution as
shown in Equation 2
where N again represents the total possible addresses in the subnet and r represents the attempt
during which detections occurs. Figure 1 depicts the difference between the probabilities of a static
address versus a changing address that follows a binomial distribution. A subnet of size 256 hosts is
used as an example for this figure.
Figure 1: The probability an attacker has of detecting a target address within r attempts, the solid line
represents the probability given a static address while the dotted line represents the
probability if the address is changed at the same rate it is scanned
87
(1)
(2)