Mean Square Autocorrelation Research Articles

Survey on network flow watermarking: model, interferences, applications, technologies and security

Compared with passive flow correlation technologies based on flow characteristics, network flow watermarking, a kind of active flow correlation technology, is characterised by high accuracy, low false positive rate and short observation time. The basic framework and main elements of flow watermarking are formally described. The robustness and invisibility focused by flow watermarking as well as typical application scenarios (such as stepping-stone traceback, anonymous abuser correlation) of flow watermarking are expounded. The intra-flow and inter-flow interferences (such as repacketisation, packet reorder, delay normalisation, flow mixing, flow splitting and flow merging) faced by flow watermarking are briefly introduced. Analysis and comparison on different watermark carriers (packet payload, traffic rate, packet timing, packet number, packet length, packet order and hybrid carrier) based typical flow watermarking technologies, including flow fingerprinting technologies, are conducted, then, a review on security threats faced by flow watermarking, including multi-flow attack, mean-square autocorrelation attack, Kolmogorov–Smirnov test, BACKLIT detection and replication attack, and main countermeasures for increasing invisibility of flow watermarking is carried out. Current research hotspots and future development trends of flow watermarking are summarised and prospected from the aspects of architecture design, invisibility enhancement, adaptive capability improvement, performance evaluation, deployment and application.

Blind detection of spread spectrum flow watermarks

ABSTRACTRecently, the direct sequence spread spectrum (DSSS)‐based technique has been proposed to trace anonymous network flows. In this technique, homogeneous pseudo‐noise (PN) codes are used to modulate multiple bit signals that are embedded into the target flow as watermarks. This technique could be maliciously used to degrade an anonymous communication network. In this paper, we propose an effective single flow‐based scheme to detect the existence of these watermarks. Our investigation shows that, even if we have no knowledge of the applied PN code, we are still able to detect malicious DSSS watermarks via mean‐square autocorrelation (MSAC) of a single modulated flow's traffic rate time series. MSAC shows periodic peaks because of self‐similarity in the modulated traffic caused by homogeneous PN codes that are used in modulating multiple bit signals. Our scheme has low complexity and does not require any PN code synchronization. We evaluate this detection scheme's effectiveness via simulations. Our results demonstrate a high detection rate with a low false positive rate. Real‐world experiments on Tor also validate the feasibility of the detection scheme. Our scheme is more flexible and accurate than the existing multiflow‐based approach in DSSS watermark detection. We also present a theory for reconstructing the DSSS code once the DSSS code length is known and simulations validate the feasibility. Copyright © 2012 John Wiley & Sons, Ltd.