Using Insider Swapping of Time Intervals to Perform Highly Invisible Network Flow Watermarking

Abstract

Network flow watermarking (NFW) is an emerging flow correlation technique to deanonymize an anonymous communication system or detect stepping stones, in which a watermark is encoded into a network flow by manipulating some flow characteristics, predominantly by altering timing information. Although interval-based NFWs that employ time intervals as carrier have proven to be capable of resisting moderate network interference, they are vulnerable to some statistic-based attacks, which may expose the very existence of watermark and enable attackers to damage or remove watermark from the observed flow. In this study, using insider swapping of time intervals and an adaptive centroid quantization framework, we design a highly invisible NFW scheme, which is undetectable by multi-flow attacks (MFA), Kullback-Leibler divergence (KLD) test, Kolmogorov-Smirnov (K-S) test, and spread spectrum flow watermark (SSFW) detection. Experimental results using real traffic and public dataset show that the proposed NFW scheme can outperform three typical NFW schemes on invisibility while maintaining a strong interference-resistance capability of network jitter, packet loss, and dummy packet insertion.

Watermark Based Tor Cross-Domain Tracking System for Tor Network Traceback

“…It only observes the communication process to infer the relationship between users. Active traffic analysis [11,12,16,18,20,28] is mainly to artificially interfere with the traffic, and to achieve neither the purpose of exposure nor the means of intervention. There are some typical digital watermark model, such as packet transmission rate based watermark, inter packet watermark and packet sending interval watermark.…”