A Novel Network Flow Watermark Embedding Model for Efficient Detection of Stepping-stone Intrusion Based on Entropy

摘要

Network flow watermarking schemes have been used to detect stepping stones, which including watermark embedding scheme and detection scheme. Among them, watermark embedding scheme plays a vital part in a watermarking scheme. Most existing watermark embedding schemes are based on using a randomly select the operation time interval and then generated watermark sequence in carrier flow. However, the randomness of watermark operating may cause watermark easily exposed to attacks. We herein propose a novel watermark embedding scheme based on entropy (NWESBE) to solve this problem. We firstly pre-process the carrier traffic by using entropy analysis and then determine optimum time intervals for embedding watermark. Secondly, we randomly embed watermark in these determined time intervals. Our analytical and empirical results demonstrate that our proposed scheme is robust for embedded watermark to timing perturbation, while invisible to attacks. And also it can greatly improve the detection rate and requiring fewer observation packet.