Patent ID: 8433796

Claim:
A device, comprising one or more processors to join a botnet by generating a watermarked packet flow by causing a watermark to be injected into an outgoing packet flow in response to commands from a botmaster, the watermark comprising a multitude of watermark bits, the watermark applied to the outgoing packet flow by: a) choosing at least two distinct packets from the outgoing packet flow; b) forming at least one packet pair from the at least two distinct packets, each of the at least one packet pair including a reference packet and an encoding packet; c) encoding each of at least one of the multitude of watermark bits to a different one of the at least one packet pair by increasing the length of the encoding packet when each of the multitude of watermark bits has a predetermined value; d) placing: i) the reference packet in the watermarked packet flow at a time t r ; and ii) the encoding packet in the watermarked packet flow at a time t e and e) wherein: i) the outgoing packet flow is to be part of a passing packet flow inspected by at least one cooperating node processor, wherein the inspecting includes: (1) calculating the length of the reference packet as the sum of all packet lengths in the watermarked packet flow during the duration (t r −½δ to t r +½δ), δ representing timing jitter in the watermarked packet flow; and (2) calculating the length of the encoding packet as the sum of all packet lengths in the watermarked packet flow during the duration (t e ½ δ to t e +½δ); ii) the at least one cooperating node processor is to create tracking information related to detection of the watermarked packet flow in the passing packet flow; and iii) the tracking information is to be analyzed by a path determination processor to locate a path taken by the watermarked packet flow.