## 2 Related Work
### Network Flow Watermarking  
The time-based network flow watermarking techniques includes the packet timing-based flow watermarking techniques and the packet interval-based flow watermarking techniques. The packet timing-based flow watermarking techniques [20] embed watermark by modifying time-dependent characteristics, which is vulnerable to multi-flow attacks, and network events such as packet loss, packet reassembly, and time crosstalk. [PERSON] et al. [21] proposed a watermarking scheme based on IPD, which works better than the passive time-based flow association technique with sufficient redundancy. [PERSON] et al. [22] proposed RAINBOW to improve the invisibility of the watermark by introducing lower packet delay than other work.  
The packet interval-based flow watermarking techniques [23; 24] embed information by modifying the number of packets in a specific interval. The ICBW proposed by [PERSON] et al. [25] uses the uniform distribution principle to embed watermark information by changing the IPD. [PERSON] et al. proposed the IBW (Interval-Based Watermarking) [26] by modifying the IPD to control the number of packets in four intervals, which has a strong anti-interference ability. The IBF proposed by [PERSON] et al. can embed more fingerprint data with fewer intervals and packets. [PERSON] et al. [27] designed a scalable watermark SWIRL, which selects different watermarks for marking according to flow characteristics, and improves the robustness of the watermark.  
Besides, there are some other flow watermarking techniques. The packet payload-based flow watermarking techniques embed information by modifying the content of packets, for example, SWT (Sleepy Watermark Tracing) [28]. The packet length-based flow watermarking techniques embed information by modifying the length of packets, for example, LBW (Length-Based Watermarking) [29]. The packet order-based flow watermarking techniques change the sequence number of packets to embed information, for example, PROFW [30]. The traffic rate-based flow watermarking techniques modify the traffic rate of flow to embed information, for example, PN-based SS (PN Code Diversification Based Spread Spectrum) [31].  
We select three aspects to evaluate the performance of several flow watermarking techniques [32]: robustness, invisibility and coding efficiency. Robustness refers to the ability to keep the original data when facing network delays, packet loss and other disturbances. Invisibility refers to the ability that the watermark is invisible to the outside world and can be undiscovered by attackers. Coding efficiency reflects the amount of watermark information embedded in a fixed time unit. Table 2 shows the evaluation of several flow watermarking techniques.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Classification** & **Example** & **Robustness** & **Invisibility** & **Coding Efficiency** \\ \hline Packet payload-based & SWT & \(\star\star\star\) & \(\star\) & \(\star\star\) \\ Traffic rate-based & PN-based SS & \(\star\star\) & \(\star\) & \(\star\) \\  & IPD & \(\star\) & \(\star\) & \(\star\)\(\star\)\(\star\)\(\star\) \\ Packet timing-based & RAINBOW & \(\star\) & \(\star\)\(\star\) & \(\star\)\(\star\)\(\star\)\(\star\) \\  & ICBW & \(\star\star\) & \(\star\) & \(\star\) \\ Packet interval-based & IBF & \(\star\star\) & \(\star\)\(\star\) & \(\star\)\(\star\) \\  & SWIRL & \(\star\star\) & \(\star\)\(\star\)\(\star\) & \(\star\)\(\star\) \\ Packet length-based & LBW & \(\star\star\)\(\star\)\(\star\) & \(\star\) & \(\star\)\(\star\)\(\star\)\(\star\) \\ Packet order-based & PROFW & \(\star\star\)\(\star\)\(\star\) & \(\star\)\(\star\)\(\star\)\(\star\) & \(\star\)\(\star\) \\ \hline \hline \end{tabular}
\end{table}
Table 2: Evaluation of several flow watermarking techniques.