Modeling DDoS Attacks by Generalized Minimum Cut Problems
Abstract
Distributed Denial of Service (DDoS) attack is one of the most preeminent threats in Internet. Despite considerable progress on this problem in recent years, a remaining challenge is to determine its hardness by adopting proper mathematical models. In this paper, we propose to use generalized minimum cut as basic tools to model various types of DDoS attacks. Particularly, we study two important extensions of the classical minimum cut problem, called Connectivity Preserving Minimum Cut (CPMC) and Threshold Minimum Cut (TMC), to model largescale DDoS attacks. In the CPMC problem, a minimum cut is sought to separate a source node from a destination node and meanwhile preserve the connectivity between the source and its partner node(s). The CPMC problem also has important applications in many other areas such as emergency responding, image processing, pattern recognition, and medical sciences. In the TMC problem, a minimum cut is sought to isolate a target node from a threshold number of partner nodes. TMC problem is an interesting special case of the network inhibition problem and finds applications in network security. We show that the general CPMC problem cannot be approximated within unless . We also show that a special case of the CPMC problem in planar graphs can be solved in polynomial time. The corollary of this result is that the network diversion problem in planar graphs is in ; this settles a previously open problem. For the TMC problem, we show that the threshold minimum node cut (TMNC) problem can be approximated within a ratio of and the threshold minimum edge cut (TMEC) problem can be approximated within a ratio of . As a consequence, we show that the related network inhibition problem and network interdiction problem cannot be approximated within any constant ratio unless . This settles another long standing open problem.
I Introduction
Distributed Denial of Service (DDoS) attacks have become one of most preeminent threats to Internet. The DDoS attacks against critical infrastructure (e.g., Internet backbone, power grid, financial services) are especially harmful. For example, the Crossfire attack [20] can disable up to 53% of the Internet connections in some US states, and up to about 33% of the connections in the West Coast of the US. Link/node flooding is an important form of DDoS attacks. From the algorithmic point of view, link/node flooding is closely related to the minimum cut problem. To better deal with such attacks, in this paper, we propose to use two generalized minimum cut problems to model them.
The basic minimum cut problem is one of the most fundamental problems in computer science and has numerous applications in many different areas [26, 32, 25, 24]. In this paper, we investigate two important generalizations of the minimum cut problem and their applications in link/node cut based DDoS attacks. The first generalization is denoted as the Connectivity Preserving Minimum Cut (CPMC) problem, which is to find the minimum cut that separates a pair (or pairs) of source and destination nodes and meanwhile preserve the connectivity between the source and its partner node(s). The second generalization is denoted as the Threshold Minimum Cut (TMC) problem in which a minimum cut is sought to isolate a target node from a threshold number of partner nodes. The basic minimum cut problem tries to find a minimum node/edge cut between a pair of nodes. If we want to find a minimum cut to separate two nodes (called partner nodes) from a third node, the minimum cut may also separate the two partner nodes. For example, in Fig 1 we want to find a node cut to separate two partner nodes and from another node . If we choose node to be the cutting node, then and will still be connected, which means it is a connectivity preserving cut. If we choose node to be the cutting node, then and will be disconnected, which means it is not a connectivity preserving cut. In many applications it is desirable to find a connectivity preserving minimum cut since it is a natural requirement to maintain some connectivity when one wants to cut some links or nodes.
The CPMC problem has recently been studied in [17] (a special case studied in [16]). It has applications in many other areas, such as emergency responding, data mining, pattern recognition, and machine learning. It is very natural to have connectivity related constraints in many minimum cut based applications since “cut” is destructive and one may want to limit the destructive nature of the minimum cut. In Botnet based DDoS attacks, it is important to find the cut to isolate the target server or area, while at the same time maintaining the connectivity between Bots and Botmasters. In link cut attacks like Crossfire attack, it is important to avoid early congestion, which is one kind of connectivity constraints. In applications related to emergency response, when a gun attack such as the Sandy Hook elementary school shooting [1] happens in a building, the best response is to shut down certain passages, and at the same time to make sure that every one can have access to some exits so that rescue personnels can reach them. This problem is closely related to CPMC. In medical science, the protein state transitions can be modeled as directed graphs called biological regulatory networks (BRN) [4]. If one can identify the pathways that lead to the states which cause cancer or other possible diseases, then one should try to find the best way to prevent the system from reaching those dangerous states. For example, one may find an optimal cut to disconnect the possible paths leading to those states, and at the same time maintain the paths that are needed for normal metabolism. This is exactly the CPMC problem. The network diversion problem [12, 11, 9] is a problem to consider the minimum cut to divert traffic to a certain link or set of links/nodes. It has some similarity with the CPMC problem. However, the network diversion problem defines the problem only in the context of network diversion (none of the works recognizes the more important CPMC problem), while the CPMC problem defines the problem in a more natural way and has a lot more applications. In directed graphs, the network diversion problem is not even an NP optimization problem since the desired cut may not exist and it is NPcomplete to judge if node disjoint paths between two pairs of nodes exist [31]. The CPMC problem is an NP optimization problem in both undirected and directed graphs. Also, in planar graphs, the network diversion problem cannot be reduced to the CPMC problem. Even without considering all the applications, the CPMC is a very natural problem in pure graph theory and discrete mathematics.
The TMC problem arising naturally from DDoS attacks, threshold cryptography, and distributed data storage, which concerns with blocking a node from a threshold number of related nodes. Threshold cryptography and threshold related protocols have wide applications in network security such as secure and reliable cloud storage service [8], secure key generation and sharing in mobile ad hoc networks [10, 14, 29], etc. The natural optimization problem arises from threshold based protocols is to block a node from a threshold number of related nodes with minimum cost. This optimization problem is important for both attackers and defenders. From the attacker’s point of view, he/she needs to find an optimal way to thwart the execution of the threshold based protocol, or crack some information by compromising a threshold number of nodes or links. On the other hand, from the defender’s point of view, the defender may need to block the communication between a Bot master and a threshold number of Bots to thwart the Botnet attacks. In link cut DDoS attacks like Crossfire and Coremelt [30] attacks, the attacker may try to achieve the desired degradation ratio by flooding a set of critical links with minimum amount attacking flows. The problem can be easily converted to TMC. In distributed cloud storage, the attacker may try to disconnect the user from a threshold number of cloud servers to disrupt the services that require a certain number of available servers, the problem is exactly TMC. The TMC problem is an important special case of the network inhibition problem or network interdiction problem, and was first studied in [15].
The main results of this paper are the follows: (1) We show that CPMC in directed graphs and multinode CPMEC are hard to approximate, 3node planar CPMNC is in , and the network diversion problem in undirected planar graphs is in , which settles a long standing open problem [11]. (2) We show that the TMNC problem can be approximated within a ratio of and the TMEC problem can be approximated within a ratio of . We reveal the relationship between the TMC problem and some other closely related problems. Particularly, we show that the network inhibition problem [27] and the network interdiction problem [2] cannot be approximated within any constant ratio unless . This settles another long standing open problem.
The rest of the paper is organized as follows. Section II investigates the hardness of the CPMC problem. Section III discusses the hardness of CPMC in planar graphs. Section IV and Section V discusses the hardness and algorithms of the TMC problem, respectively. Future work is presented in Section VI.
Ii Hardness Results of CPMC
We adopt the notation from [17]. The most simple case of CPMC is the 3node CPMC. Informally speaking, in the 3node CPMC problem, we are given a connected graph with positive node (or edge) weights, a source node and its partner node , and a destination node . The objective is to compute a cut with minimum weight to disconnect the source and destination , and meanwhile preserve the connectivity of and its partner node (i.e., and are connected after the cut). The weights can be associated with either the nodes (i.e., vertices) or the edges, and accordingly the cut can be either a set of nodes, called a connectivity preserving node cut, or a set of edges, called a connectivity preserving edge cut. In the former case, a cut is a subset of vertices whose removal (along with the edges incident to them) disconnects and , but does not affect the connectivity of and . Such a cut is called a connectivity preserving node cut (CPMNC). In the latter case, a cut is a subset of edges whose removal disconnects and and preserves the connectivity of and . Such a cut is called a connectivity preserving minimum edge cut (CPMEC). The weight of a cut is the total weight associated with the nodes or edges in . Note that we can easily extend the 3node CPMC problem to the general case CPMC where one may have multiple pairs of source and destination nodes, and each source node may have multiple partner nodes.
First we note that the CPMNC problem is an NP optimization problem. To determine whether a valid cut exists, one just needs to check if is connected to any bridge node between and ; if so, then no valid cut exists. Clearly, this can be done in polynomial time. Thus, we assume thereafter that a cut always exists.
The decision version of the 3node CPMNC problem is as follows: given an undirected graph with each node associated with a positive integer weight , a source node , a partner node , a destination node , and an integer , determine whether there exists a subset of nodes in with total weight less than or equal to such that the removal of this subset disconnects from but preserves the connectivity between and .
The decision version of the 3node CPMEC problem can be defined similarly: given an undirected graph with each edge associated with a positive integer weight , a source node , a partner node , a destination node , and an integer , determine whether there exists a subset of edges in with total weight less than or equal to such that the removal of this subset disconnects from but preserves the connectivity between and .
The CPMEC has several key differences from CPMNC. First, the resulting graph after the node cut in CPMNC may be disintegrated into many connected components, where in CPMEC the resulting graph has exactly two connected components (otherwise there will be some redundant edges, and the cut cannot be the minimum one). Second, suppose the weight of the minimum edge cut between a single node and destination is , the weight of the minimum edge cut (not necessarily connectivity preserving) between two nodes and destination is , if , then the minimum edge cut between two nodes and destination must be connectivity preserving. Node cut does not has this property. These key differences mean that the node cut problem and the edge cut problem may have different hardness. In our NPhardness proof of the CPMNC, we cannot modify it to get a proof for the CPMEC.
Given nodes and in a graph, we can classify other nodes into several categories. If a node has the property , then it is easy to show that the minimum edge cut between two nodes and destination must be connectivity preserving.
Lemma II.1
For two points and in the graph, if , then the minimum edge cut between two nodes and destination must be connectivity preserving.
For a minimum edge cut between two nodes and destination , it must be the the union of two cuts: one is the cut between and , another is between and . The sum of this two cut is at least . If , then the two cuts must have some common edges. But if a common edge exists, then we have two cases:
case 1: The common edge is connected with the component of and , then this edge can be removed from the cut, and the remaining cut is still valid, and and is now connected.
case 2: The common edge is connected with the two components and the component, in this case, and must be connected.
If (here is the CPMEC between , , and ), we call a threshold node of . time. If node satisfies , we call them outer points of .
We also investigate the multiplepartner CPMEC problem. In this case, we have nodes in the graph, and the objective is to find a minimum edge cut that separates from , and at the same time keeps connected.
Note that this problem is still an NP optimization problem. If the removal of node causes some of the nodes to be disconnected from others, then no valid cut exists. Since this can be determined in polynomial time, we always assume that there exists a solution to the problem.
In some applications, we need to find a minimum cut to separate two connected components and from another connected component in a graph, and keep and connected. This is a generalization of the original 3node connectivity preserving minimum cut problem. We can show that the generalized problem has the same approximability as the original problem, in both the cases of node cut and edge cut.
Theorem II.2
The generalized connectivity preserving minimum cut problem can be Lreduced to the original connectivity preserving minimum cut problem. This means the generalized problem has the same approximability as the original connectivity preserving minimum cut problem. In other words, if the connectivity preserving minimum cut problem can be approximated within (where is the input size), then the generalized problem can also be approximated within .
To see this, we can transform the connected components ,, and to three nodes. For every connected component, we can shrink the whole component into one new node. All edges inside the connected component are deleted. For every edge connecting a node in the component and a node outside the component, we add an edge between the new node and the outside node. To make the graph still a simple graph, if there are multiple edges between two nodes, we add an intermediate node in the edge. For node cut, we set the weight of the intermediate node to be infinity. For edge cut, the two intermediate edges all have the same weight as the old edge. An example of component shrinking is shown in Fig. 2.
Now it is easy to see, any connectivity preserving minimum cut in the old graph is the connectivity preserving minimum cut for the new graph, and vice versa. Also note that after the shrinking procedure, the size of the graph decreased. So the generalized problem has the same approximability as the original problem.
To study the 3node CPMEC problem in directed graphs, we first give its definition.
Definition II.3 ( 3node CPMEC in directed graphs)
Let be a directed graph with nodes and edges. Each edge () is associated with a positive integer weight. Given three nodes , , , and a positive integer , the node CPMEC problem for is to seek a subset of edges in with total weight less than or equal to such that after the removal of , there is no path from to and and meanwhile there exists at least one path from and .
Below we show that the 3node CPMEC problem on directed graphs cannot be approximated within a logarithm ratio.
Theorem II.4
In a directed graph , the 3node connectivity preserving minimum edge cut problem cannot be approximated within a factor of for some constant unless .
To prove the theorem, we reduce the set cover problem to this problem. In the set cover problem, we have a ground set of elements, and a set of subsets of with each associated with a weight . The objective is to select a set of subsets in so that the union of all subsets in contains every element in and the total weight of subsets in is minimized.
Given an instance of the set cover problem with elements and sets, we construct a new graph. The new graph has an element gadget for every element, and every element gadget contains nodes, where is the number of sets that contains this element. In every gadget, there are two end points, and internal nodes are connected to the two end nodes in parallel. Every internal nodes of a gadget corresponds to a set that contains this element. All such gadgets are connected sequentially through their end points, with and at the two ends of the whole construction. We also construct an arc for every set. There is an arc from the ending point of every set arc to the corresponding set node in the element gadget, and there is another arc from to the starting point of every set arc.
Figure 3 is the graph constructed for set cover instance with three elements , , and , three sets , , and .
Every set arc is assigned with weight , where is the weight of the set in the original set cover instance. All the arcs in a gadget are assigned with weight . All other arcs ( the arcs connecting the , the gadgets, and , and the arcs connecting with the set arcs) have weight infinity. We also let , where is the bound of weight in the set cover instance. First note that we only need to cut from reaching , since there is no way for to reach in the constructed graph. Also note that one cannot put all arcs from the set node to the right end node of the gadget into the cut in an element gadget, otherwise and will be separated. Now we can see that if the set cover instance has a cover with weight no more , then we can choose the following cut: The cut contains those set arcs contained in the cover and all the gadget arcs starting with the set node which are not in the set cover. The cut has a weight , where . Similarly if we can find a cut with weight no more than , then we can find a set cover with weight no more than . Furthermore, since set cover cannot be approximated within for some constant unless NP=P [28, 18], we can see that the connectivity preserving minimum cut problem in directed graph cannot be approximated within for some constant unless NP=P. Suppose the optimal solution of the set cover instance is , then the optimal solution of the constructed graph has a minimum cut with weight , where . If we can find a cut in which the total weight (in the set cover instance) of the set nodes is , then the cut has a weight , where . Assume
for some , then we have
For the set cover problem with elements and sets, it cannot be approximated within unless NP=P [28, 18]. Since is bounded by some polynomial in , we can see
where is another constant. If we choose , then
Now we have a contradiction, which means that the problem cannot be approximated within unless NP=P.
Next we consider the case of multiple partner nodes for the CPMC problem. In this case, we have nodes in the graph, and the objective is to find a minimum edge cut that separates from , and at the same time keeps connected.
Theorem II.5
For an undirected graph , the CPMC problem with partner nodes (where is an integer, not necessarily constant, given in the input) cannot be approximated within a factor of for some constant unless .
We use similar reductions as in the proofs of Theorems II.4. For the reduction of inapproximability, the only difference is that now the set node is replaced by a set edge, as shown in Figure 4.
As in the proof of Theorem II.4, the set edge has weight . Also in every gadget, the two edges connecting the end nodes in the gadget and the set node have weight 1, which are called gadgetset edges. All other edges have weight infinite. Now it is easy to see that to make disconnected from , for every set node in a gadget, either the two gadgetset edges or the corresponding set edge must be included in the cut. The remaining proof is the same as that in the proof of Theorem II.4.
Similarly we can apply the proof of polylog factor inapproximation of CPMNC in [17], using a similar construction, to show that directed CPMC and multinode CPMEC cannot be approximated within a polylog factor. Due to space limitation, it is omitted here.
Iii CPMC in Planar Graphs
In [17] it is shown that 3node CPMEC in planar graphs has polynomial time solutions and in [5] it is shown that multinode CPMEC in planar graphs has polynomial time solutions.
With some modifications, the algorithm in [17] can also be applied to 3node planar CPMNC, and we can show the algorithm also finds the optimal solution for 3node planar CPMNC.
Theorem III.1
The 3node planar CPMNC can be solved in polynomial time.
The major difference between edge cut and node cut is that in any node cut the graph may be disintegrated into multiple connected components. For any cut between a node and destination node , we define the connected component containing after the cut as the principal cut component of node . We also introduce the perturbation technique of node weight that we used in the proof of 3node planar CPMEC in [17]. In this way, any two cuts (or more generally, two subsets of edges) in will have different weights unless they are completely identical. Based on this property, we have the following observations. (1) Any cut is unique. (2) Given any node , let be the connected component containing and resulting from the minimum edge cut between and . Then all nodes in can be uniquely determined due to the perturbation technique. Now note that any two principal cut components cannot enclose a hole. Suppose the CPMNC principal cut component between nodes and is . If there exists a hole that is completely surrounded by the two CPMNC principal cut components and , then for the nodes adjacent to the boundary of the hole, we can divide the nodes into 3 types: The first type of is in the CPMNC cutting of but not cutting nodes of . We denote the total weight of this type of nodes as . The second type is the cutting nodes of but not cutting nodes of . We denote the total weight of this type of nodes as . The third type of segments is the cutting nodes of both of and . We have , or . If then we remove the cutting nodes of type 1 and add cutting nodes of type 2 for the CPMNC between and . Now we can get a smaller CPMNC, because the new cut will decrease by a value of and increase by a value of , and the overall effect is that the value of the cut will decrease by at least . This is a contradiction. Note that the principal cut component may not enlarge since the added nodes in the hole may not connect to component , but this does not affect the argument. The remaining two cases are similar. So for planar CPMNC, any two principal cut components cannot enclose a hole. The remaining proof of the 3node planar CPMNC is similar to 3node planar CPMEC when we replace the enclosed edge cut region with principal cut component for any node which is not .
Next we show that 2node versus 2node planar CPMEC is in . Note that the problem is an NP optimization problem since the feasibility of disjoint paths for two sourcedestination pairs in planar graphs can be determined in P [23].
Theorem III.2
Let be a planar graph, and and be two pairs of partner nodes in . Then the CPMEC separating partner nodes from partner nodes can be computed in polynomial time.
First it is easy to see if and are in the same face, then it is trivial, so we ignore this case. Now suppose and are not in the same face. In the algorithm for 3node planar CPMEC, for every places when we need to compute a minimum cut between a shrunk node and the destination we can change it to “compute the CPMEC between the shrunk node and the two partner nodes ”. The algorithm grows from and trying to reach . During the dynamic growing algorithm, when procedure “touches” any node (when trying to grow to a new neighbor with the expanded cut) that is in the same face as , then we need to consider the two cuts.
The first cut is between set “the current cut region from to union with all nodes in the same face as grows clockwise from to ” and , while and are connectivity preserving,
The second cut is between set “the current cut region from to union with all nodes in the same face as grows counterclockwise from to ” and , while and are connectivity preserving, We choose the smaller cut of these two as .
So if is the smallest cut in all possible growing choices, then we select as the next growing point and choose the corresponding cut to reach . Otherwise choose the other growing node that does not touch the same face of .
Note that if the dynamic growing algorithm “touches” multiple nodes in the same face of , then all these nodes must be connected (otherwise there will be hole), and we just consider these nodes as a single node and continue with the same procedure described above.
Now we can see if during the growing process, we never touch nodes in the same face of (except the last step, that we touch ), then and will always be connected during the procedure, and we find the correct cut.
If during the growing process, we touch nodes in the same face of , then we apply the above procedure. If this node is selected as the next growing node, then the growing cut will include , and and will be connected, we find the correct cut again. In this way, we can solve the 2versus2 case.
If we directly apply the original procedure without this modification, we may not be able to continue in some intermediate step but the satisfying cut still exists and we will miss it. We have the following observations: (1) In every step of the path growing procedure, the node may either be inside the component that contains and defined by the new found CPMEC or inside the component that contains . (2) If at any step, the path cannot grow and node still not been added, this means it is infeasible to find a satisfiable cut. However, this infeasibility can be verified at the beginning of the algorithm. So if there exists a feasible cut, this situation will not happen. Since we can compute the 3node planar CPMEC in polynomial time, the procedure will be able to find the desired cut in polynomial time.
Note that this result immediately implies that the network diversion problem in planar graphs is in , since the network diversion problem is a special case of 2node versus 2node CPMEC.
Corollary III.3
The network diversion problem in planar graphs can be solved in polynomial time.
The network diversion problem in planar graphs is a special case of the 2node versus 2node CPMEC in planar graphs where node and is connected.
Another result is that the two node location constrained shortest path (LCSP) problem [17] is in . The original definition of LCSP defines the shortest path where one node should be above the path. The two node LCSP problem is to find the shortest path where one given node is located above the path, another given node is located below the path.
Corollary III.4
The two node LCSP problem in planar graphs can be solved in polynomial time.
The two node LCSP problem is a special case of the 2node versus 2node CPMEC in planar graphs. If we add a dummy node that connects to all nodes that are in the boundary of the graph and above the two end points of the path, and a dummy node that connects to all nodes that are in the boundary of the graph and below the two end points of the path, and consider the two position defining nodes as and respectively, then the problem becomes a special case of the 2node versus 2node CPMEC in planar graphs where and are in the same surface.
Iv Threshold Minimum Cut Problem
We first formalize the threshold minimum node cut problem as follows.
Suppose we have a graph and a set of service nodes , ( for ), a client node , and a threshold integer . Every node in has an associated cost , how to find a minimum cost node cut such that at least out of the service nodes will be disconnected from ?
The decision version of the problem is:
Suppose we have a graph and a set of service nodes , ( for ), a client node , a threshold integer , and another integer . Every node in has an associated cost . Can one find a node cut such that at least out of the service nodes will be disconnected from and the total cost of the cut is no more than ?
We name this problem as the threshold minimum node cut problem (TMNC). The threshold minimum edge cut problem (TMEC) can also be similarly defined, the only difference is that every edge in has a cost and the cut is an edge cut.
Iva Hardness of the TMC problem
The TMNC problem was shown to be NPcomplete in [15]. We can also show that the TMEC problem is NPcomplete.
Theorem IV.1
The TMEC problem is NPcomplete.
We can use the reduction from minimum bisection problem (with unit edge cost). Given an instance of minimum bisection problem , we can construct an instance of the threshold minimum edge cut problem. We construct a new graph which contains all nodes in with an additional node . Node is connected with every node in with an edge of cost , where . Without loss of generality, we assume is an even number. We also define the set of the TMEC instance to be , and . We have the following observations:

The threshold minimum cut in will make to be separated from at least nodes in , that is, the threshold minimum cut will have a value that is at least .

The threshold minimum cut in will not make to be separated from more than nodes in since every additional edge in has cost , which is more than the number of total edges in .
Now we can see that the minimum cut in the threshold minimum edge cut instance instance should include a minimum bisection of and exactly edges between and nodes in . If we can find a threshold cut in that is , we can find the corresponding bisection of with value . Conversely, if there exists a bisection of with value , we can find threshold cut in with value . This finishes the reduction.
Based on the NPcompleteness of the threshold minimum node cut problem, it is easy to see the following problem is NPcomplete [15].
Definition IV.2
Given an undirected graph and a number , can one find a subgraph with at least edges, and the number of nodes in the subgraph is minimized?
Note that this is the inverse problem of the maximum ksubgraph problem (unit weight case). And this inverse ksubgraph problem can be further generalized to the following set minimum cover problem [15]:
Definition IV.3
Given a set of elements, a collection of subsets of , and positive integer , can one find subsets from such that the total number of distinct elements in the union of the subsets is minimized?
We can see the set minimum cover problem is the generalization of the inverse ksubgraph problem, so the set minimum cover problem is also NPcomplete.
Similarly we can define the inverse problem of the set minimum cover problem as follows [15].
Definition IV.4
Given a set of elements, a collection of subsets of , and a positive integer , can one find a subset from such that the size of is and the number of subsets (from ) fully covered by is maximized?
Here “fully covered” means that every element of the subset is included in . We denote this problem as the set maximum cover problem. We can see this problem is the generalization of the maximum ksubgraph problem.
If every set in the set minimum cover problem has at most elements, we denote this special case as the minimum cover problem. Similarly we can define the maximum cover problem.
For the max ksubgraph problem, the best known approximation algorithm is the ratio approximation algorithm in [6]. It is conjectured that the problem cannot be approximated within for some , but currently the best known hardness result is that it has no polynomial time approximation scheme unless [19, 22].
The relationship of the approximability between the set minimum cover problem and the set maximum cover problem is shown in the next theorem, proved in [15] (the proof in the paper applies to 2minimum cover problem, which can be easily extended to the minimum cover problem).
Theorem IV.5
If the minimum cover problem can be approximated within ratio ( ,that is, there is an algorithm that can return a subset of with no more than times number of elements compared with the optimal solution), then the maximum cover problem can be approximated within ratio (that is, suppose the optimal solution of the maximum cover problem is , there exists an algorithm that can return a subset of that fully covers at least number of subsets of .
Note that is very close to 1 if is very close to 0.
Corollary IV.6
The the set minimum cover problem problem does not have polynomial time approximation scheme unless .
This follows from the above theorem and the result that max ksubgraph problem (special case of the maximum cover problem when ) does not have polynomial time approximation scheme unless .
Corollary IV.7
Both the threshold minimum node cut problem and the set minimum cover problem do not have polynomial time approximation scheme unless .
We can further show that the maximum cover problem cannot be approximated within any constant ratio unless .
Theorem IV.8
The maximum cover problem cannot be approximated within any constant ratio unless .
First we show that if maximum cover can be approximated within ratio (, then maximum cover can be approximated within ratio . For a maximum cover instance with set , collection , and integer , we can construct a maximum cover instance as follows: the set and integer is the same as that in the maximum cover instance. We define a new collection which contains the union of all possible pairs of subsets in , with all repetitions of subsets being kept. For example, if , then
We define to be the subset collection of the maximum cover instance. Suppose we have a ratio approximation algorithm for the maximum cover instance, we can apply the the same solution (set of elements, denoted as ) for the maximum cover instance. We have the following observations:

If fully covers subsets of , then it fully covers subsets of .

If fully covers subsets of , then it fully covers subsets of .

If the optimal solution of the maximum cover instance can fully cover subsets of , then the optimal solution of the maximum cover instance fully covers subsets of .
Actually we can further show that any subset of will fully cover a perfect square number of subset in . Suppose fully covers subsets in , then will cover all those subsets that are union of two subsets in , and will not fully cover any other subsets in because at least one of the elements of these subsets will not be in . This means the number of fully covered subsets in by will always be a perfect square.
So if we have a ratio approximation algorithm for the maximum cover problem, then we will have a ratio approximation algorithm for the maximum cover problem.
If there exists a constant ratio (denoted as ) approximation algorithm for the set maximum cover problem, we have the following observation: given any instance of the set maximum cover problem with maximum number of elements in the collection of subsets to be and any number , we can construct a maximum cover instance where , with the same and , but the collection is defined to be . Here is the resulting collection of subsets by applying the operation times iteratively. For example, is the resulting collection which contains the union of all possible pairs of subsets in . Since the maximum cover instance can be approximated within , then we can use its result to obtain the approximation for the original maximum cover instance. This means if there exists a constant ratio approximation algorithm for the set maximum cover problem, then we can find a polynomial time approximation scheme for it. However we know that maximum subgraph problem (which is equivalent to the 2maximum cover problem) does not have polynomial time approximation scheme unless , so there exists no constant ratio approximation for the set maximum cover problem unless .
Corollary IV.9
The network inhibition problem (the goal is to find the most effective way to reduce the capacity of a network flow within fixed budget) and the network interdiction problem (a different version of network inhibition, and the goal is to choose a subset of arcs to delete, without exceeding the budget, that minimizes the maximum flow or other flow metrics that can be routed through the network induced on the remaining arcs) cannot be approximated within any constant ratio unless .
We can reduce the set maximum cover problem to the network inhibition problem and network interdiction problem. For an instance of the set maximum cover problem with set , collection and integer , we can construct a directed graph as follows. We first create a source node and destination node . For every subset in , we create a node. For every element in , we create an arc, which is again connecting to every node whose corresponding subset contains the element. The source is connected to the starting point of every arc that corresponds to every element. Every node that corresponds to a subset is connected to the destination. The blocking cost of the arcs that corresponds to the elements is 1, and the cost of all other arcs is infinity. We also set the capacity of the incoming arcs of destination to be 1, all other arcs have capacity infinity. As an example, suppose , , then the constructed network inhibition/interdiction instance is shown in Fig. 5. In the figure, the first number corresponds to every arc is the capacity of the arc, and the second number corresponds to every arc is the blocking cost of the arc.
Now it is easy to see the maximum flow from to is . If a subset of fully covers any subset in , the deletion of the corresponding arcs will reduce the maximum flow by 1. We can see that the set maximum cover in the original instance corresponds to a partial cut for the flow. In this way we reduce the set maximum cover problem to the network inhibition problem and network interdiction problem. So the network inhibition problem and the network interdiction problem cannot be approximated within any constant ratio unless .
V Approximation Algorithms of TMC
First we present a ratio approximation algorithm for TMNC problem in Algorithm 1. In the algorithm, we assume that , since it is trivial to have an approximation when (one just needs to sort according to their minimum cut values with in ascending order, choose the first nodes and find the minimum cut between these nodes and ).
Theorem V.1
Algorithm 1 achieves a ratio of .
The LP defines a fractional cut between the nodes and , and the summation of the accumulated cut value of nodes is at least . If we sort the nodes according to their cut value () in descending order and there are at least nodes in the list than has cut value at least , then the minimum cut between these nodes and will be at most times the fractional cut value returned by the LP in the algorithm (denoted as ). But , where is the minimum threshold node cut value. So in this case the algorithm achieves the ratio . If there less than nodes in the sorted list that is less than , in the algorithm the minimum cut between and is less than . The minimum cut between and is also less than , because there are at most nodes (in ) that have a cut value less than , otherwise the total cut value will be less than in the LP formulation. So in this case the solution returned by the algorithm will also be at most .
Next we present a ratio algorithm for the TMEC problem in Algorithm 2.
We can prove that this algorithm can achieve an approximation ratio .
We can consider the minimum threshold edge cut. Suppose the the minimum threshold edge cut separate from and . In the minimum threshold edge cut, the maximum number of nodes ( in ) that can be separated with can be as large as ( is separated from all other nodes), and as small as . We denote this number as . First we can see that no new added edges in will be in the minimum bisection since all the new edges have a cost , which is larger than the total number of edges in . When , one of the minimum bisection (in ) with value ( ranges from to ) is equivalent to the minimum threshold edge cut. When is , the minimum bisection in with corresponds to the minimum threshold edge cut in , since in this case all the other nodes in and all the cliques appended to ( total size ) will be separated from , but node and the appended clique of will have total size . When is , the minimum bisection in with corresponds to the minimum threshold edge cut in , since in this case the nodes in and all the cliques appended to then ( total size ) will be separated from , but there are remaining nodes in . So the minimum bisection in corresponds to a minimum threshold edge cut in . For all values between and , the algorithm will also find the corresponding minimum bisection with appropriate . Since minimum bisection can be solved with approximation ratio , the above algorithm also finds the minimum threshold edge cut with ratio .
Vi Future Work
The hardness of the 3node CPMEC (in undirected graphs) is still open, but we have some interesting observations for the problem:

It is intriguing that the algorithm does not work for general graphs. It would be interesting to classify the types of graphs that the algorithm can find the optimal cut.

We already have multiple hardness results for 3node CPMNC but the hardness of 3node undirected CPMEC is still open since the hardness proof of CPMNC cannot be applied to CPMEC. For many other minimum cut based problems, such as the basic minimum cut and the minimum multiterminal cut there is no big difference between the hardness of node cut and edge cut. So we conjecture that 3node undirected CPMEC is also hard to solve, though it is not clear whether an NPhard proof is available. Even if it is not NPcomplete, it may not be in , based on the assumption that .

There are several minimum cut related problems which are NPhard in general case but have polynomial algorithms in planar graphs. The maxcut problem and the minimum multiterminal cut problem have polynomial time algorithm in planar graphs [13]. The hardness of Steiner tree problem in planar graphs is still open but it has polynomial time approximation scheme [7]. The minimum multiway cut in planar graphs is NPhard but has polynomial time approximation scheme [3]. The hardness of minimum bisection in planar graphs is still open [21]. It is important to investigate what kind of minimum cut related problems in planar graphs can be solved in polynomial time and what is the deep logic behind this. Further research on this can provide guidance on new problems related to planar minimum cut.

There is another similarity between minimum multiterminal cut problem and the CPMC in planar graphs. Actually if we adopt the perturbation method, we can have a simple algorithm for minimum 3terminal cut in planar graphs. The CPMC problem can be considered as the “complementary” problem of the minimum multiterminal cut problem. Further investigation of the relationship between the two problems will help the understanding of both problems.

It is rather surprising that the dynamic programming algorithm works for 3node planar CPMEC. It is interesting to further investigate what kind of constrained minimum cut problem can be solved by similar algorithms.
We conjecture that the 3node undirected CPMEC problem may belong to a class of problems that are neither in nor complete. Thus, the problem may be related to the central question of versus . For some special and practical graphs, we believe that there may exist efficient precise or approximation algorithms, which will be another future research direction. For TMC problem, there is much room to improve the the approximation ratio and hardness result.
References
 [1] http://www.cbc.ca/news/world/story/2012/12/14/connecticutschoolshooting%.html, 2012.
 [2] Douglas S. Altner, ÖZlem Ergun, and Nelson A. Uhan. The maximum flow network interdiction problem: Valid inequalities, integrality gaps, and approximability. Oper. Res. Lett., 38(1):33–38, January 2010.
 [3] MohammadHossein Bateni, MohammadTaghi Hajiaghayi, Philip N. Klein, and Claire Mathieu. A polynomialtime approximation scheme for planar multiway cut. In Proceedings of the TwentyThird Annual ACMSIAM Symposium on Discrete Algorithms, SODA ’12, pages 639–655. SIAM, 2012.
 [4] Gilles Bernot, Jean paul Comet, Adrien Richard, and Janine Guespin. Application of formal methods to biological regulatory networks: extending Thomas’ asynchronous logical approach with temporal logic. Journal of Theoretical Biology, 229(3):339–347, Sep. 2004.
 [5] Ivona BezÃ¡kovÃ¡ and Zachary Langley. Minimum planar multisink cuts with connectivity priors. In Mathematical Foundations of Computer Science 2014, volume 8635 of Lecture Notes in Computer Science, pages 94–105. Springer Berlin Heidelberg, 2014.
 [6] Aditya Bhaskara, Moses Charikar, Eden Chlamtac, Uriel Feige, and Aravindan Vijayaraghavan. Detecting high logdensities: an approximation for densest subgraph. In Proceedings of the 42nd ACM symposium on Theory of computing, STOC ’10, pages 201–210, New York, NY, USA, 2010. ACM.
 [7] Glencora Borradaile, Claire Kenyonmathieu, and Philip Klein. A polynomialtime approximation scheme for steiner tree in planar graphs. In In Proceedings of the 18th Annual ACMSIAM Symposium on Discrete Algorithms, pages 1285–1294, 2007.
 [8] N. Cao, S. Yu, Z. Yang, W. Lou, and T. Hou. Lt codesbased secure and reliable cloud storage service. In Proceedings of INFOCOM, 2012.
 [9] A. CintronArias, N. Curet, L. Denogean, R. Ellis, C. Gonzalez, S. Oruganti, and P. Quillen. The network diversion vulnerability problem. Technical report, 2001.
 [10] Giovanni Di Crescenzo, Gonzalo Arce, and Renwei Ge. Threshold cryptography in mobile ad hoc networks. In SCN 2004, 2004.
 [11] Christopher A. Cullenbine, R. Kevin Wood, and Alexandra M. Newman. Theoretical and computational advances for network diversion. Networks, 62(3):225–242, August 2013.
 [12] N.D. Curet. The network diversion problem. Mil Oper Res, pages 35–44, 6 2001.
 [13] E. Dahlhaus, D. S. Johnson, C. H. Papadimitriou, P. D. Seymour, and M. Yannakakis. The complexity of multiterminal cuts. SIAM Journal on Computing, 23:864–894, 1994.
 [14] Giovanni Di Crescenzo, Renwei Ge, and Gonzalo R. Arce. Improved topology assumptions for threshold cryptography in mobile ad hoc networks. In SASN ’05: Proceedings of the 3rd ACM workshop on Security of ad hoc and sensor networks, pages 53–62, New York, NY, USA, 2005. ACM.
 [15] Qi Duan and Mohit Virendra. On the algorithms related to threshold cryptography based network protocols. International Journal of Network Security, 15(3):205–211, 2013.
 [16] Qi Duan, Mohit Virendra, Shambhu Upadhyaya, and Ameya Sanzgiri. Minimum cost blocking problem in multipath wireless routing protocols. IEEE TRANSACTIONS ON COMPUTERS, 63(7):1765 – 1777, 2014.
 [17] Qi Duan and Jinhui Xu. On the connectivity preserving minimum cut problem. Journal of Computer and System Sciences, 80(4):837 – 848, 2014.
 [18] Uriel Feige. A threshold of lnn for approximating set cover. Journal of the ACM, 45:314–318, 1998.
 [19] Uriel Feige, Guy Kortsarz, and David Peleg. The dense ksubgraph problem. Algorithmica, 29:2001, 1999.
 [20] Min Suk Kang, Soo Bum Lee, and Virgil D. Gligor. The crossfire attack. In Proceedings of the 2013 IEEE Symposium on Security and Privacy, SP ’13, pages 127–141, Washington, DC, USA, 2013. IEEE Computer Society.
 [21] Marek Karpinski. Approximability of the minimum bisection problem: An algorithmic challenge. In Proceedings of the 27th International Symposium on Mathematical Foundations of Computer Science, MFCS ’02, pages 59–67, London, UK, UK, 2002. SpringerVerlag.
 [22] Subhash Khot. Ruling out PTAS for graph minbisection, dense ksubgraph, and bipartite clique. SIAM J. Comput., 36(4):1025–1071, 2006.
 [23] Yusuke Kobayashi and Christian Sommer. On shortest disjoint paths in planar graphs. Discrete Optimization, 7(4):234 – 245, 2010.
 [24] Eugene Lawler. Combinatorial Optimization: Networks and Matroids. Dover Publications, 2001.
 [25] C.H. Papadimitriou and K. Steiglitz. Combinatorial Optimization: Algorithms and Complexity. Dover Publications, 1998.
 [26] Christos Papadimitriou. Computational Complexity. Addison Wesley, 1993.
 [27] Cynthia A. Phillips. The network inhibition problem. In Proceedings of the twentyfifth annual ACM symposium on Theory of computing, STOC ’93, pages 776–785, New York, NY, USA, 1993. ACM.
 [28] Ran Raz and Shmuel Safra. A subconstant errorprobability lowdegreetest and a subconstant errorprobability pcp characterization of NP. In Proc. 29th ACM Symp. on Theory of Computing, 475484. El Paso, 1997.
 [29] S. Sarkar, B. Kisku, S. Misra, and M. S. Obaidat. Chinese remainder theorembased RSAthreshold cryptography in manet using verifiable secret sharing scheme. Wireless and Mobile Computing, Networking and Communication, IEEE International Conference on, 0:258–262, 2009.
 [30] Ahren Studer and Adrian Perrig. The coremelt attack. In Proceedings of the 14th European conference on Research in computer security, ESORICS’09, pages 37–52, Berlin, Heidelberg, 2009. SpringerVerlag.
 [31] Torsten Tholey. Solving the 2disjoint paths problem in nearly linear time. In STACS 2004, pages 350–361, 2004.
 [32] Vijay V. Vazirani. approximation algorithms. Springer, 2004.