Network flow watermarking method based on centroid matching of interval group

For tracing the anonymous communication, traditional passive manners based on source-destination addresses and flow correlatioin analysis is limited with the high-speed flow processing requirements, unreadable encrypted traffic and complicated flow processing in secure routing mechanism. Network flow watermarking as one of anonymous network tracing techniques has obtained lots of attentions in recent year. In practice, flows usually suffer from passive statistical detection and active desynchronized attacks such as chaff packets and flow splitting etc. So invisibility and robustness are the two important required characters. In this paper, an invisible timing flow watermarking method is proposed based on centroid matching of interval group. It exploits the centroid of inter-packet delays (IPDs) and utilizes the secret key to modify flow's timing information. it is verified to achieve good undetectability for typical detection tools, e.g., Kullback-Leibler Divergence (KLD), Kolmogorov-Smirnov (KS) and multiple flow attack (MFA) tests. And experimental results with real traffic show that the proposed method can resist packet delay, packet deletion and insertion better than those state-of-the-art flow watermarking methods.