Network Flow Watermarking Research Articles

HSTW: A robust network flow watermarking method based on hybrid packet sequence-timing

Network flow watermarking (NFW) has been widely used in flow trace back. However, most of the existing NFW methods cannot work efficiently due to the weakness of resisting channel interferences, establishing reliable synchronization, and resisting statistical analysis-based NFW attacks. To this end, a hybrid packet sequence-timing-based flow watermarking (HSTW) method is proposed, for which packet sequence and packet timing constitute a hybrid carrier to carry watermark information. HSTW modulates the packet sequence of the flow and represents the watermark information by the relative time relationship between the packet reordering, which improves the robustness of the watermark against delay jitter and packet loss. By designing a synchronization header based on the specific packet sequence, the information synchronization is achieved at any position of the flow. To resist statistical analysis-based NFW attacks, the packet sequence modulation is carried out in the form of slight packet reordering. The random distribution of the watermark is achieved based on the synchronization header, eliminating the time correlation between multiple watermarked flows. By a large number of experiments based on real-time traffic and public datasets, the results show that in comparison with the existing methods, HSTW has stronger robustness and more reliable synchronization. Compared with timing-based and rate-based methods, the accuracy of HSTW under delay jitter is increased by 32.17% to 34.50%. The accuracy of HSTW under packet loss interference is improved by 20.11% to 26.89% in comparison with sequence-based methods. HSTW can achieve information synchronization even if only partial watermarked flow can be obtained. Furthermore, HSTW can avoid the detection of Kolmogorov-Smirnov test and multi-flow attacks.

HeteroTiC: A robust network flow watermarking based on heterogeneous time channels

Tracking back stealthy attackers is still a great challenge in face of complicated Internet environments and increased attacker capabilities. As a possible solution, network flow watermarking has been developed to embed attack labels actively in data flows, trying to identify the attack source accurately in time. However, due to the influences of uncertain network noises, the robustness of watermarking cannot be ensured efficiently in case of non-cooperative network scenarios currently. Meanwhile, it is difficult to enhance robustness and covertness simultaneously when suffering from severe network noises. Thus, a robust network flow watermarking based on Heterogeneous Time Channels (HeteroTiC) is proposed, for which packet order, packet timing and packet size constitute heterogeneous time channels to carry watermarks. The beginning positions are located by packet order to support accurate synchronization, the long watermark sequences are carried by inter-packet delays to improve capabilities against packet dropping and time jitter, the mapping relationships for the watermark sequences on heterogeneous time channels are mixed by packet size of the flow itself to enhance covertness. With multiple layers design of watermarking, HeteroTiC is designed to accomplish fast detection and accurate extraction on watermarks. By experiments, the average detection accuracy reaches 100% and the average extraction accuracy is validated with 94.2%. Furthermore, the same mapping pattern on multiple flows only accounts for 8.11%, which validates the covertness against multiple flow similarities. The extraction accuracy exceeds 9.76%∼18.1% in comparison with classical watermarking methods, which validates the robustness under network noises in Internet.

Using Insider Swapping of Time Intervals to Perform Highly Invisible Network Flow Watermarking

Network flow watermarking (NFW) is an emerging flow correlation technique to deanonymize an anonymous communication system or detect stepping stones, in which a watermark is encoded into a network flow by manipulating some flow characteristics, predominantly by altering timing information. Although interval-based NFWs that employ time intervals as carrier have proven to be capable of resisting moderate network interference, they are vulnerable to some statistic-based attacks, which may expose the very existence of watermark and enable attackers to damage or remove watermark from the observed flow. In this study, using insider swapping of time intervals and an adaptive centroid quantization framework, we design a highly invisible NFW scheme, which is undetectable by multi-flow attacks (MFA), Kullback-Leibler divergence (KLD) test, Kolmogorov-Smirnov (K-S) test, and spread spectrum flow watermark (SSFW) detection. Experimental results using real traffic and public dataset show that the proposed NFW scheme can outperform three typical NFW schemes on invisibility while maintaining a strong interference-resistance capability of network jitter, packet loss, and dummy packet insertion.

Survey on network flow watermarking: model, interferences, applications, technologies and security

Compared with passive flow correlation technologies based on flow characteristics, network flow watermarking, a kind of active flow correlation technology, is characterised by high accuracy, low false positive rate and short observation time. The basic framework and main elements of flow watermarking are formally described. The robustness and invisibility focused by flow watermarking as well as typical application scenarios (such as stepping-stone traceback, anonymous abuser correlation) of flow watermarking are expounded. The intra-flow and inter-flow interferences (such as repacketisation, packet reorder, delay normalisation, flow mixing, flow splitting and flow merging) faced by flow watermarking are briefly introduced. Analysis and comparison on different watermark carriers (packet payload, traffic rate, packet timing, packet number, packet length, packet order and hybrid carrier) based typical flow watermarking technologies, including flow fingerprinting technologies, are conducted, then, a review on security threats faced by flow watermarking, including multi-flow attack, mean-square autocorrelation attack, Kolmogorov–Smirnov test, BACKLIT detection and replication attack, and main countermeasures for increasing invisibility of flow watermarking is carried out. Current research hotspots and future development trends of flow watermarking are summarised and prospected from the aspects of architecture design, invisibility enhancement, adaptive capability improvement, performance evaluation, deployment and application.

DropWat: An Invisible Network Flow Watermark for Data Exfiltration Traceback

Watermarking techniques have been proposed during the last 10 years as an approach to trace network flows for intrusion detection purposes. These techniques aim to impress a hidden signature on a traffic flow. A central property of network flow watermarking is invisibility, i.e., the ability to go unidentified by an unauthorized third party. Although widely sought after, the development of an invisible watermark is a challenging task that has not yet been accomplished. In this paper we take a step forward in addressing the invisibility problem with DROPWAT, an active network flow watermarking technique developed for tracing Internet flows directed to the staging server that is the final destination in a data exfiltration attack, even in the presence of several intermediate stepping stones or an anonymous network. DROPWAT is a timing-based technique that indirectly modifies interpacket delays by exploiting network reaction to packet loss. We empirically demonstrate that the watermark embedded by means of DROPWAT is invisible to a third party observing the watermarked traffic. We also validate DROPWAT and analyze its performance in a controlled experimental framework involving the execution of a series of experiments on the Internet, using Web proxy servers as stepping stones executed on several instances in Amazon Web Services, as well as the TOR anonymous network in the place of the stepping stones. Our results show that the detection algorithm is able to identify an embedded watermark achieving over 95% accuracy while being invisible.

Flow Watermarking for Antinoise and Multistream Tracing in Anonymous Networks

To solve the problems of noise interference and multistream tracing in anonymous network tracing, this article proposes an interval packet-size-based spread spectrum (IPS3) network flow watermarking technology, which adopts a new watermarking carrier based on the original direct sequence spread spectrum (DSSS) technology. On one hand, IPS3 solves the problem of multistream tracing through the operation of DSSS for original watermarking. On the other hand, taking the average packet size in a time interval as the watermarking carrier, it solves the problem of network flow watermarking technology being subjected to the network stability by adjusting the carrier size in the process of watermarking modulation. Experimental results show that the proposed IPS3 scheme outperforms the traditional network flow watermarking technology in the above-mentioned two issues: noise filtering and multistream tracing, which can achieve higher accuracy when it is used in anonymous network tracing. This article is part of a special issue on cybersecurity.

A Survey of Timing Channels and Countermeasures

A timing channel is a communication channel that can transfer information to a receiver/decoder by modulating the timing behavior of an entity. Examples of this entity include the interpacket delays of a packet stream, the reordering packets in a packet stream, or the resource access time of a cryptographic module. Advances in the information and coding theory and the availability of high-performance computing systems interconnected by high-speed networks have spurred interest in and development of various types of timing channels. With the emergence of complex timing channels, novel detection and prevention techniques are also being developed to counter them. In this article, we provide a detailed survey of timing channels broadly categorized into network timing channel, in which communicating entities are connected by a network, and in-system timing channel, in which the communicating entities are within a computing system. This survey builds on the last comprehensive survey by Zander et al. [2007] and considers all three canonical applications of timing channels, namely, covert communication, timing side channel, and network flow watermarking. We survey the theoretical foundations, the implementation, and the various detection and prevention techniques that have been reported in literature. Based on the analysis of the current literature, we discuss potential future research directions both in the design and application of timing channels and their detection and prevention techniques.

Network Flow Watermarking: A Survey

Traffic analysis (TA) is a useful tool aimed at understanding network traffic behavior. Basic network administration often takes advantage of TA for purposes such as security, intrusion detection, traffic shaping and policing, diagnostic monitoring, provisioning, and resource management. Network flow watermarking is a type of TA in which packet features of selected flows are manipulated in order to add a specific pattern easily identifiable when the watermarked flows cross an observation point. While passive TA has been extensively studied with hundreds of papers found in the literature, active TA, and more specifically network flow watermarking, has only recently attracted attention. Enforced robustness against traffic perturbations due to either natural network noise or attacks against passive TA have enhanced the appeal of this technique. The contribution of this paper is a thorough review of the main watermarking algorithms implemented for traffic analysis purposes. We present an overview of the motivations and the objectives that have led to the use of network flow watermarking. We also describe the general architecture of a watermarking system. In addition, we impose clarity and order in this branch of TA by providing a taxonomy of the algorithms proposed in the literature over the years, and categorize and present them based on carrier, visibility, and robustness.

A Systematic Review of Network Flow Watermarking In Anonymity Systems

A Systematic Review of Network Flow Watermarking In Anonymity Systems

On detecting co-resident cloud instances using network flow watermarking techniques

Virtualization is the cornerstone of the developing third-party compute industry, allowing cloud providers to instantiate multiple virtual machines (VMs) on a single set of physical resources. Customers utilize cloud resources alongside unknown and untrusted parties, creating the co-resident threat--unless perfect isolation is provided by the virtual hypervisor, there exists the possibility for unauthorized access to sensitive customer information through the exploitation of covert side channels. This paper presents co-resident watermarking, a traffic analysis attack that allows a malicious co-resident VM to inject a watermark signature into the network flow of a target instance. This watermark can be used to exfiltrate and broadcast co-residency data from the physical machine, compromising isolation without reliance on internal side channels. As a result, our approach is difficult to defend against without costly underutilization of the physical machine. We evaluate co-resident watermarkingunder a large variety of conditions, system loads and hardware configurations, from a local laboratory environment to production cloud environments (Futuregrid and the University of Oregon's ACISS). We demonstrate the ability to initiate a covert channel of 4 bits per second, and we can confirm co-residency with a target VM instance in $$<$$ < 10 s. We also show that passive load measurement of the target and subsequent behavior profiling is possible with this attack. We go on to consider the detectability of co-resident watermarking, extending our scheme to create a subtler watermarking attack by imitating legitimate cloud customer behavior. Our investigation demonstrates the need for the careful design of hardware to be used in the cloud.

An interval centroid based spread spectrum watermarking scheme for multi-flow traceback

Network flow watermarking schemes have been proposed to trace network attacks in the presence of stepping stones or anonymized channels. Most existing interval-based watermarking schemes are not only ineffective in tracing multiple network flows in parallel due to severe inter-flow interference in practice but also vulnerable to the newly introduced watermarking attacks. By combining the Interval Centroid Based Watermarking (ICBW) modulation approach with the Spread Spectrum (SS) watermarking coding technique, we herein propose an Interval Centroid Based Spread Spectrum Watermarking scheme (ICBSSW) for efficiently tracing multiple network flows in parallel. Based on our proposed theoretical model, a statistical analysis of ICBSSW, with no assumptions or limitations concerning the distribution of packet times, proves its effectiveness and robustness against inter-flow interference. ICBSSW can thwart multi-flow attacks by utilizing multiple Pseudo-Noise (PN) codes as random seeds for randomizing the location of the embedded watermark across multiple flows. The experiments using a large number of synthetically generated secure shell (SSH) traffic flows demonstrate that ICBSSW can efficiently trace multiple flows simultaneously and achieve robustness against inter-flow interference. Furthermore, our approach can be applied to other interval-based flow watermarking schemes besides ICBW for effective and efficient multi-flow traceback.