Delay Normalization Interference Resistance Packet Order Based Flow
Watermarking Technology
Liancheng Zhang, Yi Guo, Juwei Yan, Yazhou Kong, Zhenxing Wang
National Digital Switching System Engineering and Technological Research Center
Zhengzhou City, Henan Province, China
e-mail: liancheng17@gmail.com, nongfu@live.cn, yan_jvwei@163.com, coyote0916@163.com, wzx05@sina.com
Abstract—Packet timing based flow watermarking technologies
can effectively embed watermark information for stepping
stone traceback and anonymous abuser correlation by
modulating the packet delay characteristics of the target flow
to be tracked, which are characterized by strong robustness,
wide range of application and free from influence of traffic
encryption. However, they are difficult to resist delay
normalization interference, which adjusts the inter-packet
delays of all packets in the target flow to a fixed value, destroys
the watermark carrier on which packet timing based flow
watermarking technologies rely, and makes the watermark
information in the watermarked flow no longer exist, thus
destroying the flow tracking ability of packet timing based flow
watermarking technologies. Therefore, delay normalization
interference resistance packet order based flow watermarking
(DNIR-POFW) technology is proposed, meanwhile, the error-
correcting code theory is introduced into the watermark
encoding to improve the robustness and anti-interference
ability of DNIR-POFW technology. Experimental results show
that DNIR-POFW technology not only can effectively resist
delay normalization interference, but also has relatively strong
robustness to packet reordering generated spontaneously or
introduced actively.
Keywords-flow watermarking; delay normalization; packet
timing; packet order; inter-packet delay
I. INTRODUCTION
Comparing with passive flow correlation technologies,
flow watermarking technologies [1-3], which can verify the
communication relationship between the sender and the
receiver by actively injecting specific watermark into the
sender’s flow, having advantages of higher accuracy, lower
false positive rate, shorter observation time and fewer
packets to be observed, etc. They can be widely applied to
anonymous abuser correlation, anonymous VoIP calls
tracking, stepping stone traceback, and botmaster tracking.
Packet timing based flow watermarking technologies [4-
9], hotspot technologies of flow watermarking, modulate the
inter-packet delays (IPD), interval, interval centroid or other
timing related characteristics of target network flow to
embed watermark information for flow correlation.
These technologies have good applicability and nothing
to do with specific application layer protocols and encryption
methods. However, their robustness and effectiveness can be
easily affected by delay normalization interference [10].
II. R
ELATED WORKS
This section will briefly introduce delay normalization
interference and related packet timing based flow
watermarking technology, i.e. interval centroid based
watermarking (ICBW) technology.
A. Interval Centroid Based Watermarking Technology
To resist flow transformations, Wang et al. [9] proposed
ICBW technology, which is a typical representative of
packet timing based flow watermarking technologies.
ICBW technology can embed the watermark into target
flow through the adjustment of time delay of certain packets
of target flow. The specific steps are as follows:
(1) A time interval
f
T
is taken from the target flow, and
is divided into 2n time slots, whose length is
T
(
f
TT<<
).
The offset
,ij
t
of each packet in each time slot from the
beginning of the time slot is calculated, in which, i is the
sequence number of time slot, and j is the packet sequence
number in time slot.
(2) Time slots are randomly divided into Group A and
Group B. To encode the ith watermark bit, the number of r
(redundancy) time slots is randomly picked out, in which,
/rnl=
, l is the watermark length.
(3) Assuming that
i
and
i
represent the average value
of all
,ij
t
in the number of r time slots of Group A and Group
B respectively, so
() ()
/2
ii
EA EB T==
. Assuming that
iii
YAB
=−
, then
()
0
i
EY
=
.
(4) Assuming that
w
and
w
are used to respectively
represent the time slot group for embedding the ith
watermark bit in Group A and Group B. When the ith bit is
1, the number of r time slots are selected randomly from
w
,
and all the packets are delayed for a (
0
aT
<<
) before
sending, to make the average value of
,ij
t
greater,
()
0
i
EY
>
. When the ith bit is 0, the number of r time slots
are selected randomly from
w
, and all the packets are
delayed for a before sending, to make
()
0
i
EY
<
. Therefore,
that whether the encoded bit of the time slot is 0 or 1 can be
judged according to the result of
()
i
Y
during watermark
decoding.