New attacks on timing-based network flow watermarks

Research output: Contribution to conferencePaperpeer-review

19 Scopus citations


A network flow watermarking scheme attempts to manipulate the statistical properties of a flow of packets to insert a “mark” making it easier to detect the flow after passing through one or more relay hosts. Because an attacker that is willing to tolerate delay can (nearly) always eliminate such marks, recent schemes have concentrated on making the marks “invisible” so that a passive attacker cannot detect the presence of the mark. In this work, we argue that from a system’s perspective, security against passive detection is insufficient for successful traffic analysis. We introduce a stronger, but feasible attack model (a known/chosen flow attacker) and a second security goal (security against copy attacks) and argue that security against both of these attacks is required for successful traffic analysis. We also demonstrate successful attacks against two recent watermarking schemes, RAINBOW and SWIRL, and show how considering these stronger attacks can aid in the design of passive detection attacks against each as well.

Original languageEnglish (US)
Number of pages16
StatePublished - 2012
Event21st USENIX Security Symposium - Bellevue, United States
Duration: Aug 8 2012Aug 10 2012


Conference21st USENIX Security Symposium
Country/TerritoryUnited States

Bibliographical note

Publisher Copyright:
Copyright © 2019 21st USENIX Security Symposium. All rights reserved.


Dive into the research topics of 'New attacks on timing-based network flow watermarks'. Together they form a unique fingerprint.

Cite this