DynMark: A dynamic packet counting watermarking scheme for robust traffic tracing in network flows

Abstract

To locate malicious attack sources and enhance network defense capabilities, traffic tracing has become a critical technology for defending against network attacks. Existing methods, such as IP address tracing and network flow watermarking, often fail to trace attackers using encrypted channels or network obfuscation techniques. Although watermarking can embed traceable features, its performance degrades in complex environments with delay jitter and packet loss. To address these issues, we propose a novel dynamic watermarking method based on packet count and timing, called DynMark. This method adaptively modulates packet count and timing to construct a multidimensional watermark carrier, thereby enhancing traffic tracking and tracing capabilities and enabling effective tracking of attack traffic in complex network environments. In addition, to ensure watermark synchronization accuracy, we design a dynamic synchronization tag to guarantee precise synchronization of the watermark’s time window. Moreover, considering that non-continuous data flows may lead to inaccurate watermark detection, we further propose a robust error correction mechanism based on fountain codes and error-correcting codes, which significantly enhances the robustness of the watermarking method and ensures the accuracy of data transmission. Experimental results show that under interference conditions such as high delay jitter, packet loss, and chaff packet insertion, DynMark maintains an accuracy rate of over 90%. Compared with state-of-the-art watermarking methods, DynMark achieves an approximate 4% improvement in accuracy. In addition, DynMark successfully passes the K-S test, demonstrating its invisibility.