A survey on network flow watermarking: A problem-oriented perspective

As the main active traffic analysis method, network flow watermarking (NFW) has been proven effective for flow correlation in anonymous communication system or stepping stone detection. In various types of network flow watermarking schemes, the interval-based ones can achieve significant better capability of resisting network interference. However, there still exists no work to give a comprehensive analysis of them, specifically on practicability as the implementation of NFW in Internet still remains a great challenge. In this paper, the existing interval-based NFW schemes are comparatively analyzed by benchmarking their performance on robustness, invisibility and practicability. Different from some prior work, we pay special attention to the practicability evaluation, which is related to time and storage overhead, communication and computation overhead, and the statistical model demand. Experimental results on CAIDA dataset give an overview of the existing interval-based NFW schemes.

Transaction systems, such as e-commerce, banking systems, and blockchain-based transaction systems, take the advantages of great developments of network technologies. At the same time, such systems face a variety of threats and attacks. Passive traffic analysis (TA) usually consumes a lot of resources, and responds with tardiness, and no longer meets the current requirements. Network flow watermarking is a typical active TA technique, and IPD, IBW and ICBW are the typical ones, which can track attacks in a covert way. However, these approaches are also disturbed by the complex network conditions, e.g., packet splitting and merging during the transmissions. To improve the robustness of network flow watermarking, this paper proposes an improved scheme, dynamic interval-based watermark (DIBW). The experiments compare DIBW performance with that of IPD, IBW, and ICBW under packet splitting and merging conditions; and change the parameters of DIBW to observe the impacts on the performance of DIBW. The results show that DIBW can improve the robustness of the system. This paper utilizes LDPC code that consumes less time than the traditional ones. In addition, this paper proposes a hybrid watermark scheme of DIBW and IPD to adapt to the file sizes and the situations of network flow, and analyzes the feasibility of the adaptability by experiments.

DeMarking: A defense for network flow watermarking in real-time

Despite the increasing botnet threat, research in the area of botmaster traceback is limited. The four main obstacles are 1) the low-traffic nature of the bot-to-botmaster link; 2) chains of “stepping stones;” 3) the use of encryption along these chains; and 4) mixing with traffic from other bots. Most existing traceback approaches can address one or two of these issues, but no single approach can overcome all of them. We present a novel flow watermarking technique to address all four obstacles simultaneously. Our approach allows us to uniquely identify and trace any IRC-based botnet flow even if 1) it is encrypted (e.g., via SSL/TLS); 2) it passes multiple intermediate stepping stones (e.g., IRC server, SOCKs); and 3) it is mixed with other botnet traffic. Our watermarking scheme relies on adding padding characters to outgoing botnet C&C messages at the application layer. This produces specific differences in lengths between randomly chosen pairs of messages in a network flow. As a result, our watermarking technique can be used to trace any interactive botnet C&C traffic and it only requires a few dozen packets to be effective. To the best of our knowledge, this is the first approach that has the potential to allow real-time botmaster traceback across the Internet.We have empirically validated the effectiveness of our botnet flow watermarking approach with live experiments on PlanetLab nodes and public IRC servers on different continents. We achieved virtually a 100% detection rate of watermarked (encrypted and unencrypted) IRC traffic with a false positive rate on the order of 10− 5. Due to the message queuing and throttling functionality of IRC servers, mixing chaff with the watermarked flow does not significantly impact the effectiveness of our watermarking approach.KeywordsStep StoneWatermark SchemeWatermark TechniqueEmbed WatermarkBucket SizeThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Multi-flow attack based on inter-flow dependency relationship can constitute a serious threat to packet timing based flow watermarking technologies. Embedding position randomization method can resist multi-flow attack, but it leads to a higher false positive rate. This paper proposed initial offset randomization based multi-flow attack resistance (IOR-MFAR) method, which adopts different random seeds to randomly choose initial offsets for different target network flows to eliminate dependency relationship between watermarked flows. Analysis and empirical evaluation results show that the IOR-MFAR method can effectively defend against multi-flow attack, at the same time, compared with the embedding position randomization method, it doesn't increase the false positive rate of original flow watermarking technology.