Fingerprinting Traffic Log

As malwares such as worms, viruses, spy wares, and bots keep being large threats in Internet security, a number of projects suggest monitoring their macroscopic network activities by globally distributed sensors. These sensors are deployed in various pertinent organizations and keep collecting traffic logs. Eventually these logs are shared among entities who analyze them. As such activities rise, more and more traffic logs are shared among the organizations and their traceability becomes an important issue. In this paper, we propose a fingerprinting method to embed an id into traffic logs. Particularly, we consider fingerprinting darknet traffic logs, which are common in network monitoring. By focusing on the nature of darknet traffic, our method enhances traceability while introducing minor degradation to them. Experiments using real darknet traffic show the robustness of the proposed scheme against several typical randomized attacks.