Network Stream Watermarking
Detection of stepping stones is a famous problem in computer security. In order to hide the identity, Internet attackers broadcast their traffic on multiple hosts known as stepping stones. A common approach to detect these hosts is to observe the pattern
- PDF / 454,501 Bytes
- 15 Pages / 439.37 x 666.142 pts Page_size
- 112 Downloads / 157 Views
Network Stream Watermarking
11.1 Introduction Detection of stepping stones is a famous problem in computer security. In order to hide the identity, Internet attackers broadcast their traffic on multiple hosts known as stepping stones. A common approach to detect these hosts is to observe the pattern of hosts’ entering and leaving the network. Traditionally, the pattern inherent of packet timing, sizes, and counts is utilized in traffic flows for the analysis of the incoming and outgoing flow of a host [1]. Intrusion detection suffers from the linking network flows, as well as anonymity problem. From a point of view, the techniques for the analysis of network traffic are classified into passive and active. Although passive techniques are able to link flows, a high time complexity is required for low rate of errors. On the other hand, active techniques are more precise and scalable [2, 3]. Active techniques or flow watermarking disconcerted the characteristics of traffic on an incoming flow once they pass routers to generate a distinct pattern. This is detectable in outgoing flows. Active techniques can break the anonymity when two flows are linked. Application of active and passive techniques in anonymous communications has been widely studied in the literature [2–4]. Passive and active techniques demonstrate some features that may compromise one another in traffic analysis applications. For long-lived network flows, passive techniques exhibit good performance, but a large amount of data on traffic flows are required. Meanwhile, flow watermarking observes short period of traffic flows efficiently. Flow watermarking is considered as blind watermarking because the required information for flow watermarking is carried by the flow. Therefore, additional storing and communication of network flows as needed for passive techniques is not essential. Although blind watermarking is more robust, such robustness imposes extra cost to the watermarking technique. It is a consequence of large delays (hundreds of milliseconds) to the flows and makes the benign users susceptible to attacks [5]. © Springer Science+Business Media Singapore 2017 M.A. Nematollahi et al., Digital Watermarking, Springer Topics in Signal Processing 11, DOI 10.1007/978-981-10-2095-7_11
165
166
11 Network Stream Watermarking
Because of a trade-off between passive and blind flow watermarking, non-blind flow watermarking was proposed. Non-blind flow watermarking records the pattern of incoming traffic flows and associates them to the outgoing flows that is similar to passive techniques. However, they change the communication patterns of the intercepted flows which are similar to the blind flow watermarking techniques. A prototype for recording the timing pattern of incoming flows of non-blind flow watermarking and associating them with timing pattern of outgoing flows is RAINBOW. RAINBOW adds a watermark to each incoming flow by delaying some packets once the received timings are recorded. For shortening the delays, RAINBOW utilizes the benefits of sprea
Data Loading...
