Rate-Based watermark traceback: a new approach

Authors:
Zongbin Liu;Jiwu Jing;Peng Liu
Affiliations:
The State Key Laboratory of Information Security, Graduate University of, Chinese Academy of Sciences, China;The State Key Laboratory of Information Security, Graduate University of, Chinese Academy of Sciences, China;The Pennsylvania State University, University Park
Venue:
ISPEC'10 Proceedings of the 6th international conference on Information Security Practice and Experience
Year:
2010

Citing 10
Cited 0

Inter-Packet Delay Based Correlation for Tracing Encrypted Connections through Stepping Stones

ESORICS '02 Proceedings of the 7th European Symposium on Research in Computer Security
Holding intruders accountable on the Internet

SP '95 Proceedings of the 1995 IEEE Symposium on Security and Privacy
Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays

Proceedings of the 10th ACM conference on Computer and communications security
Architecture for Multi-Stage Network Attack Traceback

LCN '05 Proceedings of the The IEEE Conference on Local Computer Networks 30th Anniversary
Tracing intruders behind stepping stones

Tracing intruders behind stepping stones
Detecting stepping stones

SSYM'00 Proceedings of the 9th conference on USENIX Security Symposium - Volume 9
Tor: the second-generation onion router

SSYM'04 Proceedings of the 13th conference on USENIX Security Symposium - Volume 13
DSSS-Based Flow Marking Technique for Invisible Traceback

SP '07 Proceedings of the 2007 IEEE Symposium on Security and Privacy
Multiscale stepping-stone detection: detecting pairs of jittered interactive streams by exploiting maximum tolerable delay

RAID'02 Proceedings of the 5th international conference on Recent advances in intrusion detection
Detecting Encrypted Stepping-Stone Connections

IEEE Transactions on Signal Processing

Quantified Score

Hi-index	0.00

Visualization

Abstract

Network based intrusions have become a serious threat to Internet users. Despite many sophisticated defense techniques, attacks continue to increase. At present, in order to hide the source of the attack, many attackers prefer a stepping stone to launch their attack due to the anonymous nature of the Internet. The size, header and content of an IP packet will be changed because of the stepping stone and all these changes make it more difficult to trace the source of attacks. Currently, researchers study the time interval between IP packets and embed the watermark into the packet stream by adjusting the time interval between IP packets to trace the source of attacks. In this paper we study the previous watermarking schemes based on inter packet delay and propose a novel watermark scheme based on the rate of packets. For the first time we used weak signal detection model and cluster technology to resume the watermark, so as to avoid the present schemes which are based on precision time synchronization or packet number. Simulation tests show that the novel watermark is robust and can countermine the time perturbation, packet losing perturbation and packet padding perturbation caused by an attacker on purpose.