CSSW: A robust Centroid-Sequential Synergetic Flow Watermarking framework for tracking network attacks

Ning Yang

doi:10.1016/j.comnet.2026.112340

Return

CSSW: A robust Centroid-Sequential Synergetic Flow Watermarking framework for tracking network attacks

2026-04-28

PRE

Ning Yang

Shanchen Pang *

Shutao Guo

DOI：10.1016/j.comnet.2026.112340

Original

Original request for help

Save

Abstract

En 中文

In complex and dynamic network environments, network attack attribution remains a significant technical challenge. Traditional passive traffic analysis techniques, such as IP address tracing and log analysis, are often ineffective when attackers conceal their identities through anonymization networks or multi-hop stepping stones, resulting in limited attribution accuracy. To overcome this limitation, Network Flow Watermarking (NFW) has emerged as an active traffic analysis technique that embeds imperceptible watermarks to identify and trace attack flows. However, existing NFW approaches exhibit insufficient robustness against timing jitter, packet loss, and other network disruptions. To address these issues, we propose a Centroid–Sequence Synergistic Watermarking framework (CSSW), which innovatively combines centroid-based statistical features and packet sequence characteristics as a hybrid watermark carrier. To mitigate synchronization failures caused by timing perturbations, we design a reliable sequence-based synchronization mechanism that enables watermark extraction at arbitrary positions within the traffic stream. Moreover, to resist watermark degradation under severe timing noise and packet loss, we develop an anti-damage encoding strategy that significantly enhances watermark survival in adverse network conditions. Extensive experimental results demonstrate that CSSW achieves superior robustness and practical effectiveness compared to existing approaches.

Keywords:

Network Flow Watermarking

Attack Attribution

Centroid-Sequence Synergistic Framework

Robustness

Traffic Analysis