Fundamental Limits of Invisible Flow Fingerprinting

Covert communication is necessary when revealing the mere existence of a message leaks sensitive information to an attacker. Consider a network link where an authorized transmitter Jack sends packets to an authorized receiver Steve, and the packets visit Alice, Willie, and Bob, respectively, before they reach Steve.Covert transmitter Alice wishes to alter the packet stream in some way to send information to covert receiver Bob without watchful and capable adversary Willie being able to detect the presence of the message. In our previous works, we addressed two techniques for such covert transmission from Alice to Bob: packet insertion and packet timing. In this paper, we consider covert communication via bit insertion in packets with available space (e.g., with size less than the maximum transmission unit). We consider three scenarios: 1) packet sizes are independent and identically distributed (i.i.d.) with a probability mass function (pmf) whose support is a set of one bit spaced values; 2) packet sizes are i.i.d. with a pmf whose support is arbitrary; 3) packet sizes may be dependent. For the first and second assumptions, we show that Alice can covertly insert O( √ n) bits of information in a flow of n packets; conversely, if she inserts ω( √ n) bits of information, Willie can detect her with arbitrarily small error probability. For the third assumption, we prove Alice can covertly insert on average O(c(n)/ √ n) bits in a sequence of n packets, where c(n) is the average number of conditional pmf of packet sizes given the history, with a support of at least size two.

show abstract

“…Our results are readily extended to the case where P(H 0 ) = P(H 1 ) since minimizing P F A + P M D is applicable when P(H 0 ) = P(H 1 ) [27].…”

Section: B Hypothesis Testingmentioning

confidence: 87%

Fundamental Limits of Covert Bit Insertion in Packets

Soltani

Goeckel

Towsley

et al. 2018

2018 56th Annual Allerton Conference on Communication, Control, and Computing (Allerton)

Self Cite

View full text Add to dashboard Cite

show abstract

“…Similar to the definition of covertness in [1], [2], [16]- [18], [67], [68], and invisibility in [69], [70], we define covertness: We present results under the assumption that P(H 0 ) = P(H 1 ) = 1/2. However, this results in covertness for the general case [71, Appendix A].…”

Section: B Definitionsmentioning

confidence: 99%

Fundamental Limits of Covert Packet Insertion

Soltani

Goeckel

Towsley

et al. 2020

IEEE Trans. Commun.

Self Cite

View full text Add to dashboard Cite

Covert communication conceals the existence of the transmission from a watchful adversary. We consider the fundamental limits for covert communications via packet insertion over packet channels whose packet timings are governed by a renewal process of rate λ. Authorized transmitter Jack sends packets to authorized receiver Steve, and covert transmitter Alice wishes to transmit packets to covert receiver Bob without being detected by watchful adversary Willie. Willie cannot authenticate the source of the packets. Hence, he looks for statistical anomalies in the packet stream from Jack to Steve to attempt detection of unauthorized packet insertion. First, we consider a special case where the packet timings are governed by a Poisson process and we show that Alice can covertly insert O( √ λT ) packets for Bob in a time interval of length T ; conversely, if Alice inserts ω( √ λT ), she will be detected by Willie with high probability. Then, we extend our results to general renewal channels and show that in a stream of N packets transmitted by Jack, Alice can covertly insert O( √ N ) packets; if she inserts ω( √ N ) packets, she will be detected by Willie with high probability. [56]-[62] by leveraging information-theoretic analysis and the use of various coding techniques [40], [63], [64]. In particular, Anantharam and Verdu [65] derived the Shannon capacity of the timing channel with a single-server queue, and Dunn [66] analyzed the secrecy capacity of such a system. Per above, here we take a fundamental approach analogous to [12]-[23], but turn our attention to covert communication over wired channels in which communication takes place through packet transmissions.Specifically, we consider the scenario shown in Fig. 1. Authorized transmitter Jack sends packets to authorized receiver Steve. Assume that Alice wishes to transmit data covertly to Bob on this channel in the presence of an adversary, Willie, who is monitoring the channel. Willie can be in one of the two locations, either between Alice and Bob (Setting 1), or between Bob and Steve (Setting 2). Alice and Bob know that Willie is located at one or the other of these two places; however, they do not know which place he is located at. We assume Willie cannot authenticate the source of the packets (e.g., whether they are sent by Jack or not). However, he knows the statistical model of the timings of the packets transmitted by Jack. Alice can buffer and release Jack's packets and insert her own packets.Also, Bob can authenticate packets, remove the ones originally inserted by Alice, and buffer and release Jack's packets. We assume Alice can only send information to Bob by inserting her own packets into the channel, since she is not allowed to share a secret codebook with Bob and thus she is not able to send covert messages to Bob via packet timings; i.e., altering the timing of the packets according to a shared codebook, to embed information in inter-packet delays (IPDs) [65]. In addition, transmission of information through packet timings is sensitive to natural ...

show abstract

“…When the embedded watermark is 1, the intervals corresponding to the watermarks of the A and B groups are compressed use (5). Here, A i is increased and B i is decreased.…”

Section: Analysis Of the Invisibility Of Common Interval Centroid Based Watermarking Schemementioning

confidence: 99%

“…The attack can be used to detect the watermark carried in the network flow, even recover the watermark parameter to remove the watermark in the network flow. This scheme can also be used to detect network flows carrying different watermarks [5].…”

Section: Introductionmentioning

confidence: 99%

An Intrusion Tracking Watermarking Scheme

Hou

Tan

et al. 2019

IEEE Access

View full text Add to dashboard Cite

With the rapid development of edge computing technology, the scale of the network continues to expand. Various types of applications are becoming more widespread. In the edge computing, existing network agents, NAT, IP tunneling technologies, and rapidly evolving anonymous communication systems provide convenience for attackers to hide real IP. In addition, the attacker forms a ''stepping'' chain by breaking through several intermediate systems of the edge computing network. Thereby implementing an invisible intrusion attack across multiple autonomous domains can increase the difficulty of intrusion tracking. Aiming at the problem of insufficient applicability of existing interval centroid based watermarking technique, this paper proposes a histogram specified interval centroid-based watermarking technique. It improves crossdomain collaborative intrusion tracking. This technique improves the resistance of the prior art to multiflow attacks in edge computing. It decreases the time and space overhead of the detector. Compared with other interval centroid based watermarking techniques, this method has stronger concealment. The proposed method can effectively defend against multi-flow attacks of edge computing. The time and space overhead of the detector can be reduced when multiple attack flows are tracked in parallel. Thus, it is suitable for edge computing. The robustness and adaptability are improved by this method.INDEX TERMS Edge computing, intrusion tracking watermarking, network flow.

show abstract

Fundamental Limits of Invisible Flow Fingerprinting

Cited by 9 publications

References 30 publications

Fundamental Limits of Covert Bit Insertion in Packets

Fundamental Limits of Covert Bit Insertion in Packets

Fundamental Limits of Covert Packet Insertion

An Intrusion Tracking Watermarking Scheme

Contact Info

Product

Resources

About