1. Dong Xuan: CSE885 on 11/07/07 The Ohio State University 1 Invisible Traceback in the Internet r Reference Wei Yu, Xinwen Fu, Steve Graham, Dong Xuan and Wei Zhao, DSSS-Based Flow Marking Technique for Invisible Traceback, in Proc. of IEEE Symposium on Security and Privacy (Oakland), May 2007, pp18-32

2. Dong Xuan: CSE885 on 11/07/07 The Ohio State University Traceback

3. Dong Xuan: CSE885 on 11/07/07 The Ohio State University 3 Traceback in the Internet r Internet has brought convenience to our everyday lives r However, it has also become a breeding ground for a variety of crimes r Network forensics has become part of legal surveillance r We study flow marking for a fundamental network-based forensic technique, traceback

4. Dong Xuan: CSE885 on 11/07/07 The Ohio State University 4 Problem Definition r Suspect Sender is sending traffic through encrypted and anonymous channel, how can Investigators trace who is the receiver? Receiver Sender Network

5. Dong Xuan: CSE885 on 11/07/07 The Ohio State University 5 Traffic Confirmation by Flow Marking r Investigators want to know if Sender and Receiver are communicating Receiver Sender Sniffer Interferer Anonymous Channel The investigators know that Sender communicates with Receiver Investigator HQ

6. Dong Xuan: CSE885 on 11/07/07 The Ohio State University 6 Issues in Flow Marking r Traceback accuracy m Periodic pattern ok? r Traceback secrecy m Traceback without conscience of suspects DSSS-based technique for accuracy and secrecy in traceback!

7. Dong Xuan: CSE885 on 11/07/07 The Ohio State University 7 Basic Direct Sequence Spread Spectrum (DSSS) r A pseudo-noise code is used for spreading a signal and despreading the spread signal DespreadingSpreading PN Code Original Signal tbtb ctct dtdt PN Code crcr Recovered Signal noisy channel InterfererSniffer rbrb drdr

8. Dong Xuan: CSE885 on 11/07/07 The Ohio State University 8 Example – Spreading and Despreading r Signal d t : 1 -1 r DSSS code c t : 1 1 1 -1 1 -1 -1 r Spread signal t b =d t.c t =1 1 1 -1 1 -1 -1 -1 -1 -1 +1 -1 1 1 m One symbol is “represented” by 7 chips m PN code is random and not visible in time and frequency domains r Despreading is the reverse process of spreading +1 dtdt t ctct +1 T c (chip) t NcTcNcTc t tbtb

9. Dong Xuan: CSE885 on 11/07/07 The Ohio State University 9 Mark Generation by Interferer 1.Choose a random signal 2.Obtain the spread signal 3.Modulate a target traffic flow by appropriate interference  Chip +1: without interference  Chip -1: with interference  Low interference favors traceback secrecy PN Code Original Signal d t Flow Modulator Internet rx = spread signal + noise tbtb ctct tx

10. Dong Xuan: CSE885 on 11/07/07 The Ohio State University 10 Mark Recognition by Sniffer 1.Sample received traffic to derive traffic rate time series 2.Use high-pass filter to remove direct component by Fast Fourier Transform (FFT) 3.Despreading by local DSSS code 4.Use low-pass filter to remove high-frequency noise 5.Make decision  Recovered signal == Original signal? PN Code Decision Rule rx = spread signal + noise High-pass Filter Low-pass Filter rx’ rbrb crcr

11. Dong Xuan: CSE885 on 11/07/07 The Ohio State University 11 Thank you ! Questions?