Network Flow Watermark and Its Detection Method Based on Data Packet Interval

Abstract

The invention relates to a network flow watermark based on data packet intervals and a detection method thereof. The watermark is characterized in that based on a network flow watermarking algorithm based on data packet intervals, redundancy is introduced into a data packet group used for embedding a network flow watermark; specifically, when an m-bit network flow watermark needs to be embedded, 2m groups of data packets are extracted, the two adjacent groups of data packets being used for generating a 1-bit network flow watermark, the previous group of the two adjacent groups generating the 1-bit network flow watermark according to a network flow watermark algorithm based on data packet intervals, and the next group of the two adjacent groups generating verification information of the current network flow watermark position according to a verification rule. The method has the beneficial effects that the method is simple, and a mature technology is adopted in the embedding and detecting method of the network flow watermark. Meanwhile, by introducing redundancy and combining with a check information bit, the effectiveness of the recovered network flow watermark is ensured. The detection capability of the network flow watermark can be improved, and the persuasion of the network flow watermark as an electronic evidence is improved.

Description

technical field [0001] The invention relates to a network flow watermark based on data packet interval and a detection method thereof. Background technique [0002] As the frequency of network attacks becomes more and more common, attackers use many methods to hide their location and avoid being located by network monitoring equipment. One of the commonly used methods is to use multi-hop attacks, that is, the attacker forwards his attack network traffic through a series of springboard hosts, so that the attacked can only see that the attack traffic comes from the last hop network host , but the real attacker cannot be known. What's more, the network attacker forwards the attack network traffic through an anonymous P2P network. Taking advantage of the natural anonymity of the anonymous network, even if the attacker wants to track it, he cannot start. In order to locate such attackers, the industry has generally adopted network flow watermarking technology to achieve positio...

AI Technical Summary

Problems solved by technology

All three methods have limitations

[0004] The defect of network flow watermark technology based on packet time is that it is susceptible to interference by network delay. Some attackers have adopted the technology of actively adding network delay to further interfere with the network flow watermark technology based on packet time.

Images