Skip to main content
Exposing Invisible Timing-Based Traffic Watermarks with BACKLIT
Proceedings of the 27th Annual Computer Security Applications Conference
  • Xiapu Luo
  • Peng Zhou
  • Junjie Zhang, Wright State University - Main Campus
  • Roberto Perdisci
  • Wenke Lee
  • Rocky K. C. Chang
Document Type
Conference Proceeding
Publication Date
Find this in a Library
Catalog Record
Traffic watermarking is an important element in many network security and privacy applications, such as tracing botnet C&C communications and deanonymizing peer-to-peer VoIP calls. The state-of-the-art traffic watermarking schemes are usually based on packet timing information and they are notoriously difficult to detect. In this paper, we show for the first time that even the most sophisticated timing-based watermarking schemes (e.g., RAINBOW and SWIRL) are not invisible by proposing a new detection system called BACKLIT. BACKLIT is designed according to the observation that any practical timing-based traffic watermark will cause noticeable alterations in the intrinsic timing features typical of TCP flows. We propose five metrics that are sufficient for detecting four state-of-the-art traffic watermarks for bulk transfer and interactive traffic. BACKLIT can be easily deployed in stepping stones and anonymity networks (e.g., Tor), because it does not rely on strong assumptions and can be realized in an active or passive mode. We have conducted extensive experiments to evaluate BACKLIT's detection performance using the PlanetLab platform. The results show that BACKLIT can detect watermarked network flows with high accuracy and few false positives.

Presented at the 27th Annual Computer Security Applications Conference, Orlando, FL.

Citation Information
Xiapu Luo, Peng Zhou, Junjie Zhang, Roberto Perdisci, et al.. "Exposing Invisible Timing-Based Traffic Watermarks with BACKLIT" Proceedings of the 27th Annual Computer Security Applications Conference (2011) p. 197 - 206 ISSN: 978-1-4503-0672-0
Available at: