Network Flow Watermarking

Abstract

Flow watermarking is primarily used for linking network flows in application scenarios where packet contents are striped of all linking information. This chapter reviews network traffic analysis and its utilization in linking network flows, that is, through flow watermarks. It briefly describes different application scenarios for network flow watermarking. The chapter describes the use of flow watermarking for the two applications of stepping stone detection and compromising anonymity networks. The main body of research on flow watermarking encompasses these two applications. The chapter introduces a variant of flow watermarking, called flow fingerprinting. It compares the use of fingerprinting and watermarking for two common applications of active traffic analysis. A flow watermarking system's effectiveness is evaluated based on the features which include robustness, invisibility, and detection accuracy. The chapter describes various issues that may impact a flow watermark's robustness, invisibility, and detection accuracy.