Synchronization in Inter-Packet Delay Based Flow Correlation Techniques

As one of the most important network flow characteristics, Inter-packet delay (IPD) is used by lots of flow correlation techniques. It selects appropriate packet samples in the output flow to calculate the statistical characteristics based on IPDs, and estimates the similarity to the input flow’s characteristics using correlation algorithms. However, perturbations during flow transmission will destroy the synchronization among flows and mismatch the correlation start point and IPDs, which significantly decreases the detection rate. All types of perturbations are summarized in this paper and a new matching-set based synchronization idea is introduced, which assigns several possible mappings for each correlation point. Two synchronization algorithms based on greedy and progressive methods are proposed to improve the effect of flow correlation techniques. The experimental result shows that the proposal in this paper can effectively solve the synchronization problem in the case of flow perturbation and increase the detection rate of IPD based flow correlation techniques.