Exposing invisible timing-based traffic watermarks with BACKLIT

ACM International Conference Proceeding Series

Volumn , Issue , 2011, Pages 197-206

  Luo, Xiapu ^a   Zhou, Peng ^a   Zhang, Junjie ^b   Perdisci, Roberto ^c   Lee, Wenke ^b   Chang, Rocky K C ^a  

^a HONG KONG POLYTECHNIC UNIVERSITY   (Hong Kong)

^b GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

^c UNIVERSITY OF GEORGIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANONYMITY NETWORKS; BULK TRANSFER; DETECTION PERFORMANCE; DETECTION SYSTEM; FALSE POSITIVE; INTERACTIVE TRAFFICS; NETWORK FLOWS; NETWORK SECURITY AND PRIVACY; PASSIVE MODE; PEER TO PEER; PLANETLAB; STEPPING STONE; TCP FLOWS; TIMING INFORMATION; WATERMARKING SCHEMES;

COMPUTER APPLICATIONS; COMPUTER PRIVACY; INTERNET TELEPHONY; NETWORK SECURITY; SECURITY SYSTEMS;

WATERMARKING;

EID: 84862967527     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2076732.2076760     Document Type: Conference Paper

References (36)

1. X. Wang and D. Reeves, "Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays," in Proc. ACM CCS, 2003.
2. Y. Pyun, Y. Park, X. Wang, D. Reeves, and P. Ning, "Tracing traffic through intermediate hosts that repacketize flows," in Proc. IEEE INFOCOM, 2007.
3. X. Wang, S. Chen, and S. Jajodia, "Network flow watermarking attack on low-latency anonymous communication systems," in Proc. IEEE Symp. Security and Privacy, 2007.
4. D. Ramsbrock, X. Wang, and X. Jiang, "A first step towards live botmaster traceback," in Proc. RAID, 2008.
5. X. Wang, S. Chen, and S. Jajodia, "Tracking anonymous peer-to-peer voip calls on the Internet," in Proc. ACM CCS, 2005.
6. A. Houmansadr, N. Kiyavash, and N. Borisov, "RAINBOW: A robust and invisible non-blind watermark for network flows," in Proc. NDSS, 2009.
7. A. Houmansadr and N. Borisov, "SWIRL: A scalable watermark to detect correlated network flows," in Proc. NDSS, 2011.
8. V. Shmatikov and M. Wang, "Timing analysis in low-latency mix networks: attacks and defenses?" in Proc. ESORICS, 2006.
9. H. Daginawala and M. Wright, "Studying timing analysis on the Internet with SubRosa," in Proc. PET, 2008.
10. W. Wang, M. Motani, and V. Srinivasan, "Dependent link padding algorithms for low latency anonymity systems," in Proc. ACM CCS, 2008.
11. P. Peng, P. Ning, and D. Reeves, "On the secrecy of timing-based active watermarking trace-back techniques," in Proc. IEEE Symp. Security and Privacy, 2006.
12. N. Kiyavash, A. Houmansadr, and N. Borisov, "Multi-flow attacks against network flow watermarking schemes," in Proc. USENIX Security, 2008.
13. A. Hernandez and E. Magana, "One-way delay measurement and characterization," in Proc. IEEE ICNS, 2007.
14. N. Macfadyen, "Traffic characterisation and modelling," BT Technology Journal, vol. 20, no. 3, 2002.
15. A. Houmansadr, N. Kiyavash, and N. Borisov., "Multi-flow attack resistant watermarks for network flows," in Proc. IEEE ICASSP, 2009.
16. W. John and S. Tafvelin, "Analysis of Internet backbone traffic and header anomalies observed," in Proc. ACM/USENIX IMC, 2007.
17. R. Dingledine, N. Mathewson, and P. Syverson, "Tor: The second-generation onion router," in Proc. USENIX SECURITY, 2004.
18. Y. Zhang and V. Paxson, "Detecting stepping stones," in Proc. USENIX Security, 2000.
19. S. Shakkottai, N. Brownlee, and k. claffy, "A study of burstiness in TCP flows," in Proc. Passive and Active Measurement Conf., 2005.
20. H. Jiang and C. Dovrolis, "Passive estimation of TCP round-trip times," ACM Computer Commun. Review, 2002.
21. C. Dovrolis, P. Ramanathan, and D. Moore, "Packet dispersion techniques and a capacity-estimation methodology," IEEE/ACM Trans. Networking, vol. 12, no. 6, 2004.
22. C. Therrien and M. Tummala, Probability for Electrical and Computer Engineers. CRC, 2004.
23. D. Tax, "One-class classification; concept-learning in the absence of counter-examples," Ph.D. dissertation, Delft University of Technology, 2001.
24. R. Perdisci, G. Gu, and W. Lee., "Using an ensemble of one-class SVM classifiers to harden payload-based anomaly detection systems," in Proc. IEEE ICDM, 2006.
25. L. Gharai, C. Perkins, and T. Lehman, "Packet reordering, high speed networks and transport protocol performance," in Proc. IEEE ICCCN, 2004.
26. M. Allman, V. Paxson, and W. Stevens, "TCP congestion control," RFC 2581, April 1999.
27. S. Jaiswal, G. Iannaccone, C.Diot, J. Kurose, and D. Towsley, "Measurement and classification of out-of-sequence packets in a tier-1 IP backbone," IEEE/ACM Trans. Networking, vol. 15, no. 1, 2007.
28. A. Medina, M. Allman, and S. Floyd, "Measuring the evolution of transport protocols in the Internet," ACM Computer Communication Review, 2005.
29. D. Tax, "DDtools, the data description toolbox for Matlab (version 1.5.3)," June 2009.
30. "PRTools: TheMatlab toolbox for pattern recognition," http://www.prtools.org/, 2008.
31. "libssh2," http://www.libssh2.org/, 2011.
32. L. Heberlein and S. Staniford-Chen, "Holding intruders accountable on the Internet," in Proc. IEEE Symp. Security and Privacy, 1995.
33. A. Blum, D. Song, and S. Venkataraman, "Detection of interactive stepping stones: Algorithms and confidence bounds," in Proc. RAID, 2004.
34. B. Coskun and N. Memon, "Efficient detection of delay-constrained relay nodes," in Proc. ACSAC, 2007.
35. W. Yu, X. Fu, S. Graham, D. Xuan, and W. Zhao, "DSSS-based flow marking technique for invisible traceback," in Proc. IEEE Symp. Security and Privacy, 2007.
36. X. Luo, J. Zhang, R. Perdisci, and W. Lee, "On the secrecy of spread-spectrum flow watermarks," in Proc. ESORICS, 2010.