AIBW: Average Interval-Based Watermarking for Tracking Down Network Attacks

With the widespread adoption of encrypted communication and anonymous networks, traditional passive traffic analysis methods face considerable limitations in tracking malicious activities. Existing active network flow watermarking schemes, exhibit insufficient robustness against packet dropping and splitting attacks. In response, this paper introduces <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Average Interval-based Watermarking (AIBW)</i>, a novel technique designed to enhance watermark resilience by partitioning network flows into discrete time windows and dynamically adjusting inter-packet intervals. Specifically, AIBW categorizes packets into three segments—<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">start</i>, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">information</i>, and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">end</i>—and embeds watermark bits through maximum/minimum delay modulation within the information segment. Experimental evaluations demonstrate that AIBW outperforms state-of-the-art watermarking methods, yielding average accuracy improvements.