Abstract: As active traffic analysis approaches, network flow watermarking technologies can effectively traceback anonymous abusers and network attackers behind a connection chain of stepping stones. As they can achieve high detection rates and low false positive rates within short observation time, flow watermarking technologies have significant applicadons in many fields, such as attack traceback, network supervision and attack forensic. This paper firstly represented basic framework and major characteristics of flow watermarking technologies, then briefly introduced typical packet payload based, traffic rate based and packet timing based flow watermarking schemes at present, after that, main attack technologies, such as timing analysis attack, multi-flow attack and mean-square autocorrclation attack, and countermeasures of flow watermarking schemes were described, finally, near future research directions were discussed.

Key words: Network flow watermarking, Packet timing, Interval, Spread spectrum, Multi-flow attack, Mcan-square autocorrelation attack, Anonymous communication, Stepping stone