CorreFlow: A Covert Fingerprinting Modulation for Flow Correlation in Open Heterogeneous Networks

The constantly changing landscape of the Internet presents a significant challenge in the detection and tracking of covert attackers and their sophisticated methods. To address this issue, various techniques, such as network flow watermarking (NFW) and traffic correlation, embed attack labels in data streams to identify attack pathways or aid post-analysis. However, existing solutions are often tailored to specific scenarios, resulting in lacking robustness, adaptability, and anonymity under non-cooperative or incomplete information heterogeneous environments. To this end, this paper proposes <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CorreFlow</i>, a Transfer Learning (TL) based invisible network flow correlation framework utilizing time channel graph fingerprinting modulation. It considers the fragmentation and reassembly of data packets during transmission. In simple network environments, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CorreFlow</i> utilizes TL for rapid correlation across flows, enabling efficient linkage of related traffic segments. In complex heterogeneous network, where traditional correlation methods may fail due to encryption and variability, it leverages Inter Packet Delay (IPD) for encrypted flow matching and accurately identifies the optimal watermark point. Multiple experiments conducted on real network traffic and public datasets have demonstrated that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CorreFlow</i> achieves highly efficient traffic correlation with minimal false positive rate, improved adaptability, and steganography. Specifically, it has achieved over 97.31% accuracy in various network environments and promotes network traffic correlation in open heterogeneous network environments from low correlation to 95%.