{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,3]],"date-time":"2026-03-03T02:53:33Z","timestamp":1772506413033,"version":"3.50.1"},"reference-count":32,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,3,3]],"date-time":"2026-03-03T00:00:00Z","timestamp":1772496000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,3,3]],"date-time":"2026-03-03T00:00:00Z","timestamp":1772496000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Advanced Persistent Threat (APT) attacks pose significant threats to critical infrastructure security due to their sophisticated techniques and prolonged nature. Effective network traceability and attack source identification are crucial for mitigating these threats. Time-based network flow watermarking has emerged as a promising approach for tracing APT attacks. However, existing time-based methods face limitations, including reliance on predefined temporal parameters that reduce adaptability to diverse traffic patterns, detectability due to absolute inter-packet delay (IPD) extensions, and sensitivity to network timing fluctuations that affect reliability. To address these challenges, we propose ADIPD, an adaptive watermarking scheme that leverages relative temporal relationships. Our core innovation lies in windowed IPD modulation, where traffic is divided into chronologically ordered windows, and watermarks are embedded by regulating the relative differences between average IPDs of strategically positioned sub-windows. Additionally, a delay minimization strategy compresses IPDs in sub-windows with lower average delays, enhancing both stealthiness and robustness. Experimental results demonstrate that ADIPD outperforms classical methods (WBIPD, IBW, ICBW) in robustness, invisibility, and practicality, achieving higher watermark extraction accuracy under temporal interference while requiring fewer packets and shorter embedding times. This work advances network flow watermarking technology by balancing robustness, stealth, and adaptability, offering a scalable solution for tracing sophisticated cyberattacks.<\/jats:p>","DOI":"10.1186\/s42400-025-00424-y","type":"journal-article","created":{"date-parts":[[2026,3,3]],"date-time":"2026-03-03T02:01:34Z","timestamp":1772503294000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["ADIPD: adaptive network flow watermarking via relative windowed inter-packet delay modulation"],"prefix":"10.1186","volume":"9","author":[{"given":"Ruijie","family":"Cai","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaoya","family":"Zhu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-0603-4200","authenticated-orcid":false,"given":"Shengli","family":"Liu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,3,3]]},"reference":[{"issue":"2","key":"424_CR1","doi-asserted-by":"publisher","first-page":"171","DOI":"10.1007\/s10207-013-0210-0","volume":"13","author":"A Bates","year":"2014","unstructured":"Bates A, Mood B, Pletcher J, Pruse H, Valafar M, Butler K (2014) On detecting co-resident cloud instances using network flow watermarking techniques. Int J Inf Secur 13(2):171\u2013189","journal-title":"Int J Inf Secur"},{"key":"424_CR2","doi-asserted-by":"crossref","unstructured":"Bates A, Mood B, Pletcher J, Pruse H, Valafar M, Butler K (2012) Detecting co-residency with active traffic analysis techniques. In: Proceedings of the 2012 ACM workshop on cloud computing security workshop. CCSW \u201912, pp. 1\u201312. Association for Computing Machinery, New York, NY, USA","DOI":"10.1145\/2381913.2381915"},{"key":"424_CR3","unstructured":"Fu X, Zhu Y, Graham B, Bettati R, Zhao W (2005) On flow marking attacks in wireless anonymous communication networks. In: Proceedings of the 25th IEEE international conference on distributed computing systems. ICDCS \u201905 493\u2013503. IEEE Computer Society, USA"},{"issue":"11","key":"424_CR4","doi-asserted-by":"publisher","first-page":"1850","DOI":"10.1109\/TIFS.2013.2279794","volume":"8","author":"X Gong","year":"2013","unstructured":"Gong X, Rodrigues M, Kiyavash N (2013) Invisible flow watermarks for channels with dependent substitution, deletion, and bursty insertion errors. IEEE Trans Inf Forensics Secur 8(11):1850\u20131859","journal-title":"IEEE Trans Inf Forensics Secur"},{"issue":"3","key":"424_CR5","doi-asserted-by":"publisher","first-page":"163","DOI":"10.1504\/IJSN.2021.117864","volume":"16","author":"P Hadem","year":"2021","unstructured":"Hadem P, Saikia DK, Moulik S (2021) I-smite: an ip traceback mechanism for inter-as sdn networks using bgp. Int J Secure Network 16(3):163\u2013173","journal-title":"Int J Secure Network"},{"key":"424_CR6","unstructured":"He H, Yang S, Zhou X, Wang J (2023) Smwt: A universal and lightweight sdn-based meter table watermarking traceback scheme. In: 2023 24st asia-pacific network operations and management symposium (APNOMS) 71\u201376. IEEE, New York, NY, USA"},{"key":"424_CR7","unstructured":"Hick P (2016) CAIDA Anonymized 2016 Internet Trace, equinix-chicago 2016. http:\/\/www.caida.org\/"},{"key":"424_CR8","doi-asserted-by":"publisher","first-page":"141438","DOI":"10.1109\/ACCESS.2019.2943493","volume":"7","author":"J Hou","year":"2019","unstructured":"Hou J, Li Q, Tan R, Meng S, Zhang H, Zhang S (2019) An intrusion tracking watermarking scheme. IEEE Access 7:141438\u2013141455","journal-title":"IEEE Access"},{"issue":"3","key":"424_CR9","doi-asserted-by":"publisher","first-page":"707","DOI":"10.1016\/j.jss.2012.11.005","volume":"86","author":"A Houmansadr","year":"2013","unstructured":"Houmansadr A, Borisov N (2013) Botmosaic: collaborative network watermark for the detection of irc-based botnets. J Syst Softw 86(3):707\u2013715","journal-title":"J Syst Softw"},{"key":"424_CR10","doi-asserted-by":"crossref","unstructured":"Houmansadr A, Borisov N (2013) The need for flow fingerprints to link correlated network flows. In: De Cristofaro E, Wright M (eds) Privacy Enhancing Technologies. Springer, Berlin, Heidelberg, pp 205\u2013224","DOI":"10.1007\/978-3-642-39077-7_11"},{"key":"424_CR11","unstructured":"Houmansadr A, Kiyavash N, Borisov N (2009) Rainbow: A robust and invisible non-blind watermark for network flows. In: Proceedings of the network and distributed system security symposium, NDSS 2009, San Diego, California, USA, 8th February - 11th February 2009"},{"issue":"1","key":"424_CR12","doi-asserted-by":"publisher","first-page":"512","DOI":"10.1109\/COMST.2016.2604405","volume":"19","author":"A Iacovazzi","year":"2017","unstructured":"Iacovazzi A, Elovici Y (2017) Network flow watermarking: a survey. IEEE Commun Surv Tutorials 19(1):512\u2013530","journal-title":"IEEE Commun Surv Tutorials"},{"issue":"5","key":"424_CR13","doi-asserted-by":"publisher","first-page":"1139","DOI":"10.1109\/TIFS.2017.2779113","volume":"13","author":"A Iacovazzi","year":"2017","unstructured":"Iacovazzi A, Sarda S, Frassinelli D, Elovici Y (2017) Dropwat: an invisible network flow watermark for data exfiltration traceback. IEEE Trans Inf Forensics Secur 13(5):1139\u20131154","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"424_CR14","doi-asserted-by":"crossref","unstructured":"Iacovazzi A, Sarda S, Elovici Y (2018) Inflow: Inverse network flow watermarking for detecting hidden servers. In: IEEE INFOCOM 2018 - IEEE conference on computer communications 747\u2013755. IEEE, New York, NY, USA","DOI":"10.1109\/INFOCOM.2018.8486375"},{"issue":"C","key":"424_CR15","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2022.109424","volume":"219","author":"T Li","year":"2022","unstructured":"Li T, Liu K, Feng W, Yang C, Luo X (2022) Heterotic: a robust network flow watermarking based on heterogeneous time channels. Comput Netw: Int J Comput Telecommun Netw 219(C):109424","journal-title":"Comput Netw: Int J Comput Telecommun Netw"},{"issue":"2","key":"424_CR16","doi-asserted-by":"publisher","first-page":"265","DOI":"10.23940\/ijpe.20.02.p10.265283","volume":"16","author":"Y Lian","year":"2020","unstructured":"Lian Y, Lei Z, Cong T, Bei Z, Chen Z, Lijun L (2020) Repeatedly coding inter-packet delay for tracking down network attacks. Int J Performability Eng 16(2):265","journal-title":"Int J Performability Eng"},{"key":"424_CR17","doi-asserted-by":"crossref","unstructured":"Ling Z, Luo J, Xu D, Yang M, Fu X (2019) Novel and practical sdn-based traceback technique for malicious traffic over anonymous networks. In: IEEE INFOCOM 2019 - IEEE conference on computer communications 1180\u20131188. IEEE Press, New York, NY, USA","DOI":"10.1109\/INFOCOM.2019.8737586"},{"key":"424_CR18","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1155\/2018\/1635081","volume":"2018","author":"W Liu","year":"2018","unstructured":"Liu W, Liu G, Xia Y, Ji X, Zhai J, Dai Y (2018) Using insider swapping of time intervals to perform highly invisible network flow watermarking. Security Commun Netw 2018:1\u201316","journal-title":"Security Commun Netw"},{"key":"424_CR19","doi-asserted-by":"crossref","unstructured":"Pyun YJ, Park YH, Wang X, Reeves DS, Ning P (2007) Tracing traffic through intermediate hosts that repacketize flows. In: Proceedings of the IEEE INFOCOM 2007 - 26th IEEE international conference on computer communications, pp. 634\u2013642. IEEE Computer Society, USA","DOI":"10.1109\/INFCOM.2007.80"},{"key":"424_CR20","doi-asserted-by":"crossref","unstructured":"Ramsbrock D, Wang X, Jiang X (2008) A first step towards live botmaster traceback. In: Proceedings of the 11th international symposium on recent advances in intrusion detection. RAID \u201908 59\u201377. Springer, Berlin, Heidelberg","DOI":"10.1007\/978-3-540-87403-4_4"},{"issue":"2","key":"424_CR21","doi-asserted-by":"publisher","first-page":"219","DOI":"10.1109\/JPROC.2016.2575064","volume":"105","author":"B Satchidanandan","year":"2017","unstructured":"Satchidanandan B, Kumar PR (2017) Dynamic watermarking: active defense of networked cyber\u2013physical systems. Proc IEEE 105(2):219\u2013240","journal-title":"Proc IEEE"},{"key":"424_CR22","doi-asserted-by":"crossref","unstructured":"Shi J, Zhang L, Yin S, Liu W, Zhai J, Liu G, Dai Y (2018) A comprehensive analysis of interval based network flow watermarking. Cloud computing and security: 4th international conference. ICCCS 2018, Haikou, China, June 8\u201310, 2018, Revised Selected Papers, Part IV 4. Springer, Cham, pp 72\u201384","DOI":"10.1007\/978-3-030-00015-8_7"},{"issue":"3","key":"424_CR23","doi-asserted-by":"publisher","first-page":"434","DOI":"10.1109\/TDSC.2010.35","volume":"8","author":"X Wang","year":"2010","unstructured":"Wang X, Reeves D (2010) Robust correlation of encrypted attack traffic through stepping stones by flow watermarking. IEEE Trans Dependable Secure Comput 8(3):434\u2013449","journal-title":"IEEE Trans Dependable Secure Comput"},{"key":"424_CR24","doi-asserted-by":"crossref","unstructured":"Wang X, Chen S, Jajodia S (2007) Network flow watermarking attack on low-latency anonymous communication systems. In: Proceedings of the 2007 IEEE symposium on security and privacy. SP \u201907, pp. 116\u2013130. IEEE Computer Society, USA","DOI":"10.1109\/SP.2007.30"},{"key":"424_CR25","doi-asserted-by":"crossref","unstructured":"Wang X, Luo J, Yang M (2010) A double interval centroid-based watermark for network flow traceback. In: The 2010 14th international conference on computer supported cooperative work in design, pp. 146\u2013151. IEEE, New York, NY, USA","DOI":"10.1109\/CSCWD.2010.5471985"},{"key":"424_CR26","doi-asserted-by":"crossref","unstructured":"Wang X, Reeves DS (2003) Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays. In: Proceedings of the 10th ACM conference on computer and communications security. CCS \u201903 20\u201329. Association for Computing Machinery, New York, NY, USA","DOI":"10.1145\/948109.948115"},{"key":"424_CR27","doi-asserted-by":"crossref","unstructured":"Wang X, Reeves DS, Wu SF, Yuill J (2001) Sleepy watermark tracing: an active network-based intrusion response framework. In: Proceedings of the 16th international conference on information security: trusted information: the new decade challenge, pp. 369\u2013384. Kluwer Academic Publishers, USA","DOI":"10.1007\/0-306-46998-7_26"},{"issue":"C","key":"424_CR28","doi-asserted-by":"publisher","first-page":"66","DOI":"10.1016\/j.comcom.2022.09.028","volume":"196","author":"K Yang","year":"2022","unstructured":"Yang K, Liu Z, Zeng Y, Ma J (2022) Sliding window based on\/off flow watermarking on tor. Comput Commun 196(C):66\u201375","journal-title":"Comput Commun"},{"key":"424_CR29","doi-asserted-by":"crossref","unstructured":"Yao Z, Zhang L, Ge J, Wu Y, Zhang X (2019) An invisible flow watermarking for traffic tracking: a hidden markov model approach. In: ICC 2019-2019 IEEE international conference on communications (ICC) 1\u20136. IEEE, New York, NY, USA","DOI":"10.1109\/ICC.2019.8761135"},{"key":"424_CR30","doi-asserted-by":"crossref","unstructured":"Yu W, Fu X, Graham S, Xuan D, Zhao W (2007) Dsss-based flow marking technique for invisible traceback. In: Proceedings of the 2007 IEEE symposium on security and privacy. SP \u201907 18\u201332. IEEE Computer Society, USA","DOI":"10.1109\/SP.2007.14"},{"key":"424_CR31","doi-asserted-by":"crossref","unstructured":"Yu L, Zhang L, Zhang Y, Wen W, Du, (2021) X., cao, f.: dynamic interval-based watermarking for tracking down network attacks. 2021 IEEE 21st international conference on software quality. reliability and security (QRS). IEEE, New York, NY, USA, pp 52\u201361","DOI":"10.1109\/QRS54544.2021.00016"},{"issue":"14","key":"424_CR32","doi-asserted-by":"publisher","first-page":"1639","DOI":"10.1049\/iet-com.2017.1053","volume":"12","author":"L Zhang","year":"2018","unstructured":"Zhang L, Kong Y, Guo Y, Yan J, Wang Z (2018) Survey on network flow watermarking: model, interferences, applications, technologies and security. IET Commun 12(14):1639\u20131648","journal-title":"IET Commun"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00424-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-025-00424-y","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00424-y.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,3]],"date-time":"2026-03-03T02:01:44Z","timestamp":1772503304000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1186\/s42400-025-00424-y"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,3]]},"references-count":32,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["424"],"URL":"https:\/\/doi.org\/10.1186\/s42400-025-00424-y","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3,3]]},"assertion":[{"value":"25 February 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"11 June 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 March 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no Conflict of interest, financial or otherwise, related to this work.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"38"}}