DSSS-Based Flow Marking Technique for Invisible Traceback

Law enforcement agencies need the ability to conduct electronic surveillance to combat crime, terrorism, or other malicious activities exploiting the Internet. However, the proliferation of anonymous communication systems on the Internet has posed significant challenges to providing such traceback capability. In this paper, we develop a new class of flow marking technique for invisible traceback based on direct sequence spread spectrum (DSSS), utilizing a pseudo-noise (PN) code. By interfering with a sender's traffic and marginally varying its rate, an investigator can embed a secret spread spectrum signal into the sender's traffic. The embedded signal is carried along with the traffic from the sender to the receiver, so the investigator can recognize the corresponding communication relationship, tracing the messages despite the use of anonymous networks. The secret PN code makes it difficult for others to detect the presence of such embedded signals, so the traceback, while available to investigators is, effectively invisible. We demonstrate a practical flow marking system which requires no training, and can achieve both high detection and low false positive rates. Using a combination of analytical modeling, simulations, and experiments on Tor (a popular Internet anonymous communication system), we demonstrate the effectiveness of the DSSS-basedflow marking technique.

1 Introduction

In order to conduct lawful surveillance, law enforcement agencies need the ability to trace Internet communications among those suspected of criminal or terrorist activities. Traditionally, the source and destination IP addresses in an IP header have allowed investigators to trace communication sessions and determine corresponding participants, timing, frequency, and quantity. However, the proliferation of anonymous communication systems [1]–[4] on the Internet has posed significant challenges to effectively tracing communications. For example, web file downloading can be disguised using anonymous communication systems such as Tor [4], [5], preventing detection of illegal use in cases, such as child pornography [5]. Terrorists or criminals might use anonymous communication systems to exchange information and develop plots, without being detected.