MSAC and Multi-flow Attacks Resistant Spread Spectrum Watermarks for network flows

To address the problems of anonymous abuse, a new class of flow watermarking technique for invisible traceback based on Direct Sequence Spread Spectrum (DSSS) was developed, utilizing a Pseudo-Noise (PN) code. However, DSSS-based watermarking approach is vulnerable to MSAC and multi-flow attacks: 1) The self-similarity introduced by the DSSS watermarks causes periodic peaks, which allows adversaries to detect DSSS watermarks via Mean-Square Autocorrelation (MSAC) of a single modulated flow´s traffic rate time series. 2) The watermark insertion technique reduces the flow rates over certain intervals across all flows, which can be used by attackers to “line up” multiple watermarked flows and observe the inserted transformations. This paper presents a MSAC and Multi-flow Attacks Resistant Spread Spectrum Watermarking (MMAR-SSW) scheme to trace multiple network flows, which uses multiple orthogonal PN codes to spread different watermark bits and embeds them in randomly selected interval positions. Empirical results demonstrate that this proposed scheme, robust against MSAC and multi-flow attacks, is more effective and efficient in tracing multiple interactive traffic, compared with DSSS-based watermarking scheme.