An Intrusion Tracking Watermarking Scheme

Sainan Zhang,Rong Tan,Jun Hou,Qianmu Li,Hanrui Zhang,Shunmei Meng

doi:10.1109/access.2019.2943493

Abstract

With the rapid development of edge computing technology, the scale of the network continues to expand. Various types of applications are becoming more widespread. In the edge computing, existing network agents, NAT, IP tunneling technologies, and rapidly evolving anonymous communication systems provide convenience for attackers to hide real IP. In addition, the attacker forms a “stepping” chain by breaking through several intermediate systems of the edge computing network. Thereby implementing an invisible intrusion attack across multiple autonomous domains can increase the difficulty of intrusion tracking. Aiming at the problem of insufficient applicability of existing interval centroid based watermarking technique, this paper proposes a histogram specified interval centroid-based watermarking technique. It improves cross-domain collaborative intrusion tracking. This technique improves the resistance of the prior art to multi-flow attacks in edge computing. It decreases the time and space overhead of the detector. Compared with other interval centroid based watermarking techniques, this method has stronger concealment. The proposed method can effectively defend against multi-flow attacks of edge computing. The time and space overhead of the detector can be reduced when multiple attack flows are tracked in parallel. Thus, it is suitable for edge computing. The robustness and adaptability are improved by this method.

Highlights

Network flow refers to a sequence of unidirectional data packets or frames transmitted between any different nodes in the network over a period of time [1]
This paper investigates the current network flow watermarking technology and classifies it according to the carrier carrying the watermark signal as follows: (1) Flow watermarking technology based on packet payload
Increasing the complexity of MFA searching multiple network flows embedded with the same watermark is an effective method for edge computing multi-flow attacks resistance

Summary

INTRODUCTION

Network flow refers to a sequence of unidirectional data packets or frames transmitted between any different nodes in the network over a period of time [1]. The existing interval centroid based watermarking scheme generates more obvious time characteristics when modulating the network flow. This often becomes the object of the intruder attack. Kiyavash et al studied several time-based watermarking schemes (such as IBW, ICBW, DSSS) They found that these methods divide the network flow into different intervals to embed the watermark [3], [4]. It does not generate an empty period that no data packets reach It enhances the privacy of the interval centroid based watermarking schemeand defends against multi-flow attacks [8]. Combined with the principle and implementation flow of edge computing multi-flow attacks, a histogram specified interval centroid-based watermarking method is proposed.

RELATED WORKS

DEFENSIVE METHODS OF EDGE COMPUTING

PRINCIPLES AND COMMON METHODS OF HISTOGRAM NORMALIZATION

METHODS

DETECTION ACCURACY OF HSICBW TRACKING

Findings

VIII. CONCLUSION