A Double Interval Centroid-Based Watermark for network flow traceback

Network flow watermarks exploiting active traffic analysis approaches have been proposed for tracing attacks implemented through stepping stones or anonymized channels. Existing watermarking schemes either require longer observation duration leading to low efficiency of traceback or introduce large delays to the target flows, making themselves vulnerable to attacks. Especially, they are unsuitable for tracing multiple flows simultaneously due to their interference with each other. We herein propose a novel efficient and secret Double Interval Centroid-Based Watermark (DICBW) for network flow traceback by modulating the packet timing within each pair of adjacent intervals collaboratively and efficiently. By combining DICBW with spread spectrum (SS) coding techniques, we further present a general hybrid watermarking framework for efficient multi-flow traceback. Comparing with existing Interval Centroid-Based Watermark (ICBW), both statistical analysis of DICBW and the experiments using a series of synthetically generated SSH traffic flows demonstrate that DICBW can trace network flows more efficiently and the DICBW based hybrid watermarking framework can trace multiple flows simultaneously by exploiting the low cross-correlation of SS coding techniques.