Prefix Visibility Ratio: Quantifying Partial Observability in Carpet Bombing Detection

Abstract

Carpet bombing attacks distribute malicious traffic across many destinations within a network prefix, while operational monitoring commonly provides destination-specific telemetry for only a subset of those targets. This creates an attack-conditional observability problem that is not captured by address utilization or nominal monitoring coverage. We introduce the Prefix Visibility Ratio (PVR), defined as the fraction of attacked destinations for which the telemetry required by the host-level evidence plane is available, and argue that PVR should be treated as an explicit evaluation dimension for carpet bombing detection. We then present VANTA (Visibility-Aware Network Threat Analysis) as one concrete way to operationalize this principle. VANTA combines host-level and prefix-level anomaly scores, estimates PVR online from router-side destination evidence and the monitored-destination inventory, and adjusts evidence fusion according to both estimated visibility and estimator confidence. Across a validated campaign of 2,160 Mininet runs, VANTA achieves 99.18% precision, 93.46% recall, a global F1-score of 96.24%, and a 1.54% false-positive rate. In a separate matched-observability study using task-adapted feature-level reference implementations, VANTA reaches 95.89% pooled F1 and 92.39% recall for configured PVR<=10%, with its largest advantage appearing at configured PVR=1%. These reference comparisons are intended to isolate observability effects under a common binary detection task rather than to reproduce the original end-to-end objectives of the referenced systems. The results establish attacked-destination visibility as a measurable factor that can materially change detector behavior and should be reported explicitly in future carpet bombing evaluations.