ADIPD: adaptive network flow watermarking via relative windowed inter-packet delay modulation

Abstract Advanced Persistent Threat (APT) attacks pose significant threats to critical infrastructure security due to their sophisticated techniques and prolonged nature. Effective network traceability and attack source identification are crucial for mitigating these threats. Time-based network flow watermarking has emerged as a promising approach for tracing APT attacks. However, existing time-based methods face limitations, including reliance on predefined temporal parameters that reduce adaptability to diverse traffic patterns, detectability due to absolute inter-packet delay (IPD) extensions, and sensitivity to network timing fluctuations that affect reliability. To address these challenges, we propose ADIPD, an adaptive watermarking scheme that leverages relative temporal relationships. Our core innovation lies in windowed IPD modulation, where traffic is divided into chronologically ordered windows, and watermarks are embedded by regulating the relative differences between average IPDs of strategically positioned sub-windows. Additionally, a delay minimization strategy compresses IPDs in sub-windows with lower average delays, enhancing both stealthiness and robustness. Experimental results demonstrate that ADIPD outperforms classical methods (WBIPD, IBW, ICBW) in robustness, invisibility, and practicality, achieving higher watermark extraction accuracy under temporal interference while requiring fewer packets and shorter embedding times. This work advances network flow watermarking technology by balancing robustness, stealth, and adaptability, offering a scalable solution for tracing sophisticated cyberattacks.