Int J Performability Eng ›› 2020, Vol. 16 ›› Issue (2): 265-283.

• Orginal Article •

### Repeatedly Coding Inter-Packet Delay for Tracking Down Network Attacks

Lian Yua*(), Lei Zhanga, Cong Tana, Bei Zhaob, Chen Zhangb, and Lijun Liub

1. a School of Software and Microelectronics, Peking University, Beijing, 102600, China
b Design Institute, China Mobile Group, Beijing, 100080, China
• Submitted on  ;  Revised on  ; Accepted on
• Contact: Lian Yu E-mail:lianyu@ss.pku.edu.cn
• Supported by:
This work is supported by the Ministry of Education-China Mobile (No. MCM20170406) and the National Natural Science Foundation of China (No. 61872011). The authors would also like to thank the anonymous reviewers for their invaluable comments.

Abstract:

Attacks against Internet service provider (ISP) networks will inevitably lead to huge social and economic losses. As an active traffic analysis method, network flow watermarking can effectively track attackers with high accuracy and a low false rate. Among them, inter-packet delay (IPD) embeds and extracts watermarks relatively easily and effectively, and it has attracted much attention. However, the performance of IPD is badly affected when networks have perturbations with high packet loss rate or packet splitting. This paper provides an approach to improve the robustness of IPD by repeatedly coding the inter-packet delay (RCIPD), which can smoothly handle situations with packet splitting and merging. This paper proposes applying the Viterbi algorithm to obtain the convolutional code of a watermark such that the impact of network perturbation on the watermark can be worked off; applying the harmony schema, which controls the rhythm and embeds RCIPD bits into network flow, to improve the invisibility of watermarking; and applying K-means to identify dynamically bits of the watermark that may change the intervals due to the latency of networks. A cyclic-similarity algorithm (CSA) is designed to separate the repeated coding and eventually obtain the watermark. Experiments are carried out to compare RCIPD with other three schemas. The results show that the proposed approach is more robust, especially in the case of packet splitting.