Patent ID: 8176173

Claim:
A non-transitory computer readable storage medium containing a series of instructions that when executed by one or more processors causes the one or more processors to perform a process to locate a botmaster connected to a network, the process comprising: a) generating a watermarked packet flow, by a honeynet host that has joined a botnet, by injecting a watermark into an outgoing packet flow in response to commands from the botmaster, the watermark comprising a multitude of watermark bits, the watermark applied to the outgoing packet flow by: i) choosing at least two distinct packets from the outgoing packet flow; ii) forming at least one packet pair from the at least two distinct packets, each of the at least one packet pair including a reference packet and an encoding packet; and iii) encoding each of at least one of the multitude of watermark bits to a different one of the at least one packet pair by increasing the length of the encoding packet when each of the multitude of watermark bits has a predetermined value; b) inspecting, by at least one cooperating node, passing packet flow for the watermarked packet flow; c) creating, by the at least one cooperating node, tracking information related to detection of the watermarked packet flow in the passing packet flow; and d) analyzing, by a path determination processor, the tracking information to locate a path taken by the watermarked packet flow; and wherein: a) the reference packet is placed in the watermarked packet flow at a time t r ; and b) the encoding packet is placed in the watermarked packet flow at a time t e ; and wherein the inspecting, by at least one cooperating node, passing packet flows for the watermarked packet flow further includes: a) calculating the length of the reference packet as the sum of all packet lengths in the watermarked packet flow during the duration (t r −½δ to t r +½δ), δ representing timing jitter in the watermarked packet flow; and b) calculating the length of the encoding packet as the sum of all packet lengths in the watermarked packet flow during the duration (t e −½δ to t e +½δ).