TY - CONF
T1 - Multi-flow attacks against network flow watermarking schemes
AU - Kiyavash, Negar
AU - Houmansadr, Amir
AU - Borisov, Nikita
N1 - Funding Information:
We would like to thank Peng Ning and Douglas Reeves for providing us with the IBW implementation, and Xinyuan Wang and the anonymous referees for providing feedback on earlier versions of this paper. This research was supported in part by NSF grants CNS–0627671 and CCF–0729061.
Funding Information:
We would like to thank Peng Ning and Douglas Reeves for providing us with the IBW implementation, and Xinyuan Wang and the anonymous referees for providing feedback on earlier versions of this paper. This research was supported in part by NSF grants CNS?0627671 and CCF?0729061.
Publisher Copyright:
© 2008 USENIX Association. All rights reserved.
PY - 2008
Y1 - 2008
N2 - We analyze several recent schemes for watermarking network flows based on splitting the flow into intervals. We show that this approach creates time dependent correlations that enable an attack that combines multiple watermarked flows. Such an attack can easily be mounted in nearly all applications of network flow watermarking, both in anonymous communication and stepping stone detection. The attack can be used to detect the presence of a watermark, recover the secret parameters, and remove the watermark from a flow. The attack can be effective even if different the watermarks in different flows carry different messages. We analyze the efficacy of our attack using a probabilistic model and a Markov-modulated Poisson process (MMPP) model of interactive traffic. We also implement our attack and test it using both synthetic and real-world traces, showing that our attack is effective with as few as 10 watermarked flows. Finally, we propose a countermeasure that defeats the attack by using multiple watermark positions.
AB - We analyze several recent schemes for watermarking network flows based on splitting the flow into intervals. We show that this approach creates time dependent correlations that enable an attack that combines multiple watermarked flows. Such an attack can easily be mounted in nearly all applications of network flow watermarking, both in anonymous communication and stepping stone detection. The attack can be used to detect the presence of a watermark, recover the secret parameters, and remove the watermark from a flow. The attack can be effective even if different the watermarks in different flows carry different messages. We analyze the efficacy of our attack using a probabilistic model and a Markov-modulated Poisson process (MMPP) model of interactive traffic. We also implement our attack and test it using both synthetic and real-world traces, showing that our attack is effective with as few as 10 watermarked flows. Finally, we propose a countermeasure that defeats the attack by using multiple watermark positions.
UR - http://www.scopus.com/inward/record.url?scp=80052167664&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=80052167664&partnerID=8YFLogxK
M3 - Paper
AN - SCOPUS:80052167664
SP - 307
EP - 320
T2 - 17th USENIX Security Symposium
Y2 - 28 July 2008 through 1 August 2008
ER -