research-article

Exposing invisible timing-based traffic watermarks with BACKLIT

Authors:

Roberto Perdisci,

Rocky K. C. ChangAuthors Info & Claims

ACSAC '11: Proceedings of the 27th Annual Computer Security Applications Conference

Pages 197 - 206

https://doi.org/10.1145/2076732.2076760

Published: 05 December 2011 Publication History

Abstract

Traffic watermarking is an important element in many network security and privacy applications, such as tracing botnet C&C communications and deanonymizing peer-to-peer VoIP calls. The state-of-the-art traffic watermarking schemes are usually based on packet timing information and they are notoriously difficult to detect. In this paper, we show for the first time that even the most sophisticated timing-based watermarking schemes (e.g., RAINBOW and SWIRL) are not invisible by proposing a new detection system called BACKLIT. BACKLIT is designed according to the observation that any practical timing-based traffic watermark will cause noticeable alterations in the intrinsic timing features typical of TCP flows. We propose five metrics that are sufficient for detecting four state-of-the-art traffic watermarks for bulk transfer and interactive traffic. BACKLIT can be easily deployed in stepping stones and anonymity networks (e.g., Tor), because it does not rely on strong assumptions and can be realized in an active or passive mode. We have conducted extensive experiments to evaluate BACKLIT's detection performance using the PlanetLab platform. The results show that BACKLIT can detect watermarked network flows with high accuracy and few false positives.

References

[1]

X. Wang and D. Reeves, "Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays," in Proc. ACM CCS, 2003.

Digital Library

[2]

Y. Pyun, Y. Park, X. Wang, D. Reeves, and P. Ning, "Tracing traffic through intermediate hosts that repacketize flows," in Proc. IEEE INFOCOM, 2007.

[3]

X. Wang, S. Chen, and S. Jajodia, "Network flow watermarking attack on low-latency anonymous communication systems," in Proc. IEEE Symp. Security and Privacy, 2007.

Digital Library

[4]

D. Ramsbrock, X. Wang, and X. Jiang, "A first step towards live botmaster traceback," in Proc. RAID, 2008.

Digital Library

[5]

X. Wang, S. Chen, and S. Jajodia, "Tracking anonymous peer-to-peer voip calls on the Internet," in Proc. ACM CCS, 2005.

Digital Library

[6]

A. Houmansadr, N. Kiyavash, and N. Borisov, "RAINBOW: A robust and invisible non-blind watermark for network flows," in Proc. NDSS, 2009.

[7]

A. Houmansadr and N. Borisov, "SWIRL: A scalable watermark to detect correlated network flows," in Proc. NDSS, 2011.

[8]

V. Shmatikov and M. Wang, "Timing analysis in low-latency mix networks: attacks and defenses?" in Proc. ESORICS, 2006.

Digital Library

[9]

H. Daginawala and M. Wright, "Studying timing analysis on the Internet with SubRosa," in Proc. PET, 2008.

Digital Library

[10]

W. Wang, M. Motani, and V. Srinivasan, "Dependent link padding algorithms for low latency anonymity systems," in Proc. ACM CCS, 2008.

Digital Library

[11]

P. Peng, P. Ning, and D. Reeves, "On the secrecy of timing-based active watermarking trace-back techniques," in Proc. IEEE Symp. Security and Privacy, 2006.

Digital Library

[12]

N. Kiyavash, A. Houmansadr, and N. Borisov, "Multi-flow attacks against network flow watermarking schemes," in Proc. USENIX Security, 2008.

Digital Library

[13]

A. Hernandez and E. Magana, "One-way delay measurement and characterization," in Proc. IEEE ICNS, 2007.

Digital Library

[14]

N. Macfadyen, "Traffic characterisation and modelling," BT Technology Journal, vol. 20, no. 3, 2002.

Digital Library

[15]

A. Houmansadr, N. Kiyavash, and N. Borisov., "Multi-flow attack resistant watermarks for network flows," in Proc. IEEE ICASSP, 2009.

Digital Library

[16]

W. John and S. Tafvelin, "Analysis of Internet backbone traffic and header anomalies observed," in Proc. ACM/USENIX IMC, 2007.

Digital Library

[17]

R. Dingledine, N. Mathewson, and P. Syverson, "Tor: The second-generation onion router," in Proc. USENIX SECURITY, 2004.

Digital Library

[18]

Y. Zhang and V. Paxson, "Detecting stepping stones," in Proc. USENIX Security, 2000.

Digital Library

[19]

S. Shakkottai, N. Brownlee, and k. claffy, "A study of burstiness in TCP flows," in Proc. Passive and Active Measurement Conf., 2005.

Digital Library

[20]

H. Jiang and C. Dovrolis, "Passive estimation of TCP round-trip times," ACM Computer Commun. Review, 2002.

Digital Library

[21]

C. Dovrolis, P. Ramanathan, and D. Moore, "Packet dispersion techniques and a capacity-estimation methodology," IEEE/ACM Trans. Networking, vol. 12, no. 6, 2004.

Digital Library

[22]

C. Therrien and M. Tummala, Probability for Electrical and Computer Engineers. CRC, 2004.

[23]

D. Tax, "One-class classification; concept-learning in the absence of counter-examples," Ph.D. dissertation, Delft University of Technology, 2001.

[24]

R. Perdisci, G. Gu, and W. Lee., "Using an ensemble of one-class SVM classifiers to harden payload-based anomaly detection systems," in Proc. IEEE ICDM, 2006.

Digital Library

[25]

L. Gharai, C. Perkins, and T. Lehman, "Packet reordering, high speed networks and transport protocol performance," in Proc. IEEE ICCCN, 2004.

[26]

M. Allman, V. Paxson, and W. Stevens, "TCP congestion control," RFC 2581, April 1999.

Digital Library

[27]

S. Jaiswal, G. Iannaccone, C. Diot, J. Kurose, and D. Towsley, "Measurement and classification of out-of-sequence packets in a tier-1 IP backbone," IEEE/ACM Trans. Networking, vol. 15, no. 1, 2007.

Digital Library

[28]

A. Medina, M. Allman, and S. Floyd, "Measuring the evolution of transport protocols in the Internet," ACM Computer Communication Review, 2005.

Digital Library

[29]

D. Tax, "DDtools, the data description toolbox for Matlab (version 1.5.3)," June 2009.

[30]

"PRTools: The Matlab toolbox for pattern recognition," http://www.prtools.org/, 2008.

[31]

"libssh2," http://www.libssh2.org/, 2011.

[32]

L. Heberlein and S. Staniford-Chen, "Holding intruders accountable on the Internet," in Proc. IEEE Symp. Security and Privacy, 1995.

Digital Library

[33]

A. Blum, D. Song, and S. Venkataraman, "Detection of interactive stepping stones: Algorithms and confidence bounds," in Proc. RAID, 2004.

[34]

B. Coskun and N. Memon, "Efficient detection of delay-constrained relay nodes," in Proc. ACSAC, 2007.

[35]

W. Yu, X. Fu, S. Graham, D. Xuan, and W. Zhao, "DSSS-based flow marking technique for invisible traceback," in Proc. IEEE Symp. Security and Privacy, 2007.

Digital Library

[36]

X. Luo, J. Zhang, R. Perdisci, and W. Lee, "On the secrecy of spread-spectrum flow watermarks," in Proc. ESORICS, 2010.

Digital Library

Cited By

Soderi SDe Nicola R(2024)CONNECTION: COvert chaNnel NEtwork attaCk Through bIt-rate mOdulatioNEmerging Information Security and Applications10.1007/978-981-99-9614-8_11(164-183)Online publication date: 4-Jan-2024
https://doi.org/10.1007/978-981-99-9614-8_11
M BM AJ DS S(2023)Byte Segmented Convolutional Neural Network for Network Traffic Classification2023 1st International Conference on Optimization Techniques for Learning (ICOTL)10.1109/ICOTL59758.2023.10434992(1-6)Online publication date: 7-Dec-2023
https://doi.org/10.1109/ICOTL59758.2023.10434992
Xiao XXiao WLi RLuo XZheng HXia S(2022)EBSNN: Extended Byte Segment Neural Network for Network Traffic ClassificationIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2021.310131119:5(3521-3538)Online publication date: 1-Sep-2022
https://doi.org/10.1109/TDSC.2021.3101311
Show More Cited By

Index Terms

Exposing invisible timing-based traffic watermarks with BACKLIT

Recommendations

Invisible watermarking based on creation and robust insertion-extraction of image adaptive watermarks

This article presents a novel invisible robust watermarking scheme for embedding and extracting a digital watermark in an image. The novelty lies in determining a perceptually important subimage in the host image. Invisible insertion of the watermark is ...
A JPEG-based statistically invisible steganography
ICIMCS '11: Proceedings of the Third International Conference on Internet Multimedia Computing and Service

The objective of steganography is to implement covert communication by hiding data in digital files such that there is no indication of the existence of hidden data; so an ideal steganographic system should be able to withstand all steganalysis methods--...
Reversible Data Embedding for Tamper-Proof Watermarks
ICICIC '06: Proceedings of the First International Conference on Innovative Computing, Information and Control - Volume 3

In this paper, a novel reversible data embedding for tamper-proof watermarks is proposed. A reversible watermark is embedded into robust watermark in the discrete wavelet transform (DWT) domain using a feature map and a location map. Generally, the ...

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Other conferences

ACSAC '11: Proceedings of the 27th Annual Computer Security Applications Conference

December 2011

432 pages

ISBN:9781450306720

DOI:10.1145/2076732

Conference Chair:
Robert H'obbes' Zakon
Zakon Group LLC
,
Program Chairs:
John McDermott
Naval Research Lab
,
Michael Locasto
University of Calgary

Copyright © 2011 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

ACSA: Applied Computing Security Assoc

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 05 December 2011

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Qualifiers

Research-article

Funding Sources

Conference

ACSAC '11

Sponsor:

ACSA

ACSAC '11: Annual Computer Security Applications Conference

December 5 - 9, 2011

Florida, Orlando, USA

Acceptance Rates

Overall Acceptance Rate 104 of 497 submissions, 21%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

31
Total Citations
View Citations
277
Total Downloads

Downloads (Last 12 months)6
Downloads (Last 6 weeks)0

Reflects downloads up to 01 Dec 2024

Other Metrics

View Author Metrics

Citations

Cited By

Soderi SDe Nicola R(2024)CONNECTION: COvert chaNnel NEtwork attaCk Through bIt-rate mOdulatioNEmerging Information Security and Applications10.1007/978-981-99-9614-8_11(164-183)Online publication date: 4-Jan-2024
https://doi.org/10.1007/978-981-99-9614-8_11
M BM AJ DS S(2023)Byte Segmented Convolutional Neural Network for Network Traffic Classification2023 1st International Conference on Optimization Techniques for Learning (ICOTL)10.1109/ICOTL59758.2023.10434992(1-6)Online publication date: 7-Dec-2023
https://doi.org/10.1109/ICOTL59758.2023.10434992
Xiao XXiao WLi RLuo XZheng HXia S(2022)EBSNN: Extended Byte Segment Neural Network for Network Traffic ClassificationIEEE Transactions on Dependable and Secure Computing10.1109/TDSC.2021.310131119:5(3521-3538)Online publication date: 1-Sep-2022
https://doi.org/10.1109/TDSC.2021.3101311
Yang KLiu ZZeng YMa J(2022)Sliding window based ON/OFF flow watermarking on TorComputer Communications10.1016/j.comcom.2022.09.028196(66-75)Online publication date: Dec-2022
https://doi.org/10.1016/j.comcom.2022.09.028
Zhang BXiao XZhang WKumar Sangaiah AZhou YLiu X(2022)A co‐occurrence matrix based masquerade detection method in in‐vehicle networkTransactions on Emerging Telecommunications Technologies10.1002/ett.385833:5Online publication date: 27-May-2022
https://dl.acm.org/doi/10.1002/ett.3858
Ding JChen Z(2021)Watermark Based Tor Cross-Domain Tracking System for Tor Network TracebackSecurity and Privacy in New Computing Environments10.1007/978-3-030-66922-5_4(54-73)Online publication date: 22-Jan-2021
https://doi.org/10.1007/978-3-030-66922-5_4
Ling ZLuo JXu DYang MFu X(2019)Novel and Practical SDN-based Traceback Technique for Malicious Traffic over Anonymous NetworksIEEE INFOCOM 2019 - IEEE Conference on Computer Communications10.1109/INFOCOM.2019.8737586(1180-1188)Online publication date: Apr-2019
https://doi.org/10.1109/INFOCOM.2019.8737586
Yao ZZhang LGe JWu YZhang X(2019)An Invisible Flow Watermarking for Traffic Tracking: A Hidden Markov Model ApproachICC 2019 - 2019 IEEE International Conference on Communications (ICC)10.1109/ICC.2019.8761135(1-6)Online publication date: May-2019
https://doi.org/10.1109/ICC.2019.8761135
Yao HLiu HZhang PWu SJiang CGuo S(2019)An Intelligent Approach to Energy Efficient Transportation and QoS RoutingICC 2019 - 2019 IEEE International Conference on Communications (ICC)10.1109/ICC.2019.8761088(1-6)Online publication date: May-2019
https://doi.org/10.1109/ICC.2019.8761088
Zhang LHuang TRasheed WHu XZhao C(2019)An Enlarging-the-Capacity Packet Sorting Covert ChannelIEEE Access10.1109/ACCESS.2019.29453207(145634-145640)Online publication date: 2019
https://doi.org/10.1109/ACCESS.2019.2945320
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents