RAINBOW: A Robust And Invisible Non-Blind Watermark for Network Flows

Linking network flows is an important problem in intrusion detection as well as anonymity. Passive traffic analysis can link flows but requires long periods of observation to reduce errors. Watermarking techniques allow for better precision and blind detection, but they do so by introducing significant delays to the traffic flow, enabling attacks that detect and remove the mark, while at the same time slowing down legitimate traffic. We propose a new, non-blind watermarking scheme called RAINBOW that is able to use delays hundreds of times smaller than existing watermarks by eliminating the interference caused by the flow in the blind case. As a result, our watermark is invisible to detection, as confirmed by experiments using information-theoretic detection tools. We analyze the error rates of our scheme based on a mathematical model of network traffic and jitter. We also validate the analysis using an implementation running on PlanetLab. We find that our scheme generates ...

• Type: Conference
• Year: 2009
• Where: NDSS
• Authors: Amir Houmansadr, Negar Kiyavash, Nikita Borisov
• Keywords: Computer Networks, Information-theoretic Detection Tools, NDSS 2009, Non-blind Watermarking Scheme, Passive Traffic Analysis