Abstract: Network flow watermarking is a technique for active tracing of network attacks. Multi-flow attack makes use of dependences among different watermarked network flows, and thus poses a great challenge to the applicability of flow watermarking. This paper proposes a multi-flow attack resistance method based on reordering of watermark bits that combats the multi-flow attack. The method randomizes the bit order of the watermark message across multiple flows based on different random seeds, therefore effectively removing cross-correlations among watermarked flows. Theoretical analysis and experimental evaluation show that the proposed method is robust against multi-flow attack. Compared with insertion position randomization, the method is more effective in resisting multi-flow attack. It neither increase false positive rate, nor requires high computation cost.

Key words: network flow watermarking, multi-flow attack, watermark bit reordering, insertion position randomization