Scholarlink

<p>Advanced Persistent Threat (APT) attacks pose significant threats to critical infrastructure security due to their sophisticated techniques and prolonged nature. Effective network traceability and attack source identification are crucial for mitigating these threats. Time-based network flow watermarking has emerged as a promising approach for tracing APT attacks. However, existing time-based methods face limitations, including reliance on predefined temporal parameters that reduce adaptability to diverse traffic patterns, detectability due to absolute inter-packet delay (IPD) extensions, and sensitivity to network timing fluctuations that affect reliability. To address these challenges, we propose ADIPD, an adaptive watermarking scheme that leverages relative temporal relationships. Our core innovation lies in windowed IPD modulation, where traffic is divided into chronologically ordered windows, and watermarks are embedded by regulating the relative differences between average IPDs of strategically positioned sub-windows. Additionally, a delay minimization strategy compresses IPDs in sub-windows with lower average delays, enhancing both stealthiness and robustness. Experimental results demonstrate that ADIPD outperforms classical methods (WBIPD, IBW, ICBW) in robustness, invisibility, and practicality, achieving higher watermark extraction accuracy under temporal interference while requiring fewer packets and shorter embedding times. This work advances network flow watermarking technology by balancing robustness, stealth, and adaptability, offering a scalable solution for tracing sophisticated cyberattacks.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

ADIPD: adaptive network flow watermarking via relative windowed inter-packet delay modulation

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年3月3日

查看全文
  • Ruijie Cai,
  • Xiaoya Zhu,
  • Shengli Liu

摘要

Advanced Persistent Threat (APT) attacks pose significant threats to critical infrastructure security due to their sophisticated techniques and prolonged nature. Effective network traceability and attack source identification are crucial for mitigating these threats. Time-based network flow watermarking has emerged as a promising approach for tracing APT attacks. However, existing time-based methods face limitations, including reliance on predefined temporal parameters that reduce adaptability to diverse traffic patterns, detectability due to absolute inter-packet delay (IPD) extensions, and sensitivity to network timing fluctuations that affect reliability. To address these challenges, we propose ADIPD, an adaptive watermarking scheme that leverages relative temporal relationships. Our core innovation lies in windowed IPD modulation, where traffic is divided into chronologically ordered windows, and watermarks are embedded by regulating the relative differences between average IPDs of strategically positioned sub-windows. Additionally, a delay minimization strategy compresses IPDs in sub-windows with lower average delays, enhancing both stealthiness and robustness. Experimental results demonstrate that ADIPD outperforms classical methods (WBIPD, IBW, ICBW) in robustness, invisibility, and practicality, achieving higher watermark extraction accuracy under temporal interference while requiring fewer packets and shorter embedding times. This work advances network flow watermarking technology by balancing robustness, stealth, and adaptability, offering a scalable solution for tracing sophisticated cyberattacks.