Pith. sign in

REVIEW 2 major objections 4 minor 30 references

A Queueing-Stability Criterion for Causal IPD-QIM Network Flow Watermarking

T0 review · 2 major / 4 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper proves that causal IPD-QIM watermarking — where an embedder can only delay packets — is stably embeddable exactly when the mean inter-packet gap exceeds Δ/4 (i.e., Δ < 4μ_d), and that under bursty traffic only the time-average int

desk verdict Solid stability analysis for a niche watermarking problem; the i.i.d. criterion is convincing, but Theorem 3 overclaims stationary-ergodic generality it only proves for finite-state Markov. read the letter →

arxiv 2607.14954 v2 pith:NQYSV3E4 submitted 2026-07-16 cs.CR

Jiuxiang Cao , Guang Cheng , Guangjie Liu This is my paper
classification cs.CR MSC 60K2560J05
keywords networkflowwatermarkingquantizationindexmodulationcausalconstraintqueueingstabilityLindleyrecursionoperatingwindowinter-packetdelaytrafficanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish a testable stability criterion for causal IPD-QIM flow watermarking — a method that marks encrypted traffic by delaying packets to align with a quantization lattice. Because the embedder can only add delay, the alignment cost accumulates in a buffer, and if the buffer grows without bound the watermark breaks the host connection and itself. The paper claims that, for the standard fixed dual-lattice, equiprobable-bit rule, the buffer is stable away from the critical boundary iff the mean inter-packet gap exceeds Δ/4 (i.e., Δ < 4μ_d), and that under stationary-ergodic and finite-state Markov-modulated bursty traffic only the time-average intensity ρ̄ < 1 matters, not instantaneous overloads. This matters because it converts the setting of the quantization step Δ from empirical trial-and-error into an explicit two-sided window: large enough to survive channel jitter (Δ ≥ cσ_ξ) yet small enough to keep the queue stable (Δ < 4μ̄_d). The proof identifies the mechanism at the core: in the deep-buffer busy state the effective interval is zero, so the average injection per packet is exactly Δ/4.

What carries the argument

The central object is the reflect-then-inject dwell recursion (3): δ_i = max(0, δ_{i−1} − d_i) + r_i. The substitution Y_i = δ_i − r_i writes it in standard Lindley form, but under a fixed lattice r_i is state-dependent — set by the current effective interval and the bit — so classical i.i.d. queueing results cannot be invoked. The quantity that carries the argument is the busy-state mean injection E_w[R_w(0)] = Δ/4: once the buffer is deep, the effective interval is zero, the injection no longer depends on arrivals, and the Foster–Lyapunov drift criterion gives stability iff Δ/4 < μ_d (Theorem 2). For burst-robust stability, a bounded solution to the Poisson equation g(j) − Σ_k P_jk g(k) =

What would settle it

Run the budget-free dwell recursion (3) on a stationary-ergodic background that is not finite-state Markov — for instance a semi-Markov process with heavy-tailed sojourn times in an overloaded state — with time-average ρ̄ < 1; if the dwell diverges, the general stationary-ergodic claim of Theorem 3 is false.

Watch

Extended reading notes

Core claim

The central claim is that the causal QIM dwell recursion δ_i = max(0, δ_{i-1} − d_i) + r_i, with the fixed dual-lattice, equiprobable-bit injection rule, is stable away from the critical boundary iff μ_d > Δ/4 for i.i.d. backgrounds (Theorem 2), and iff the time-average intensity ρ̄ = Δ/(4μ̄_d) < 1 under stationary-ergodic and finite-state Markov-modulated traffic (Theorem 3). The load-bearing observation is that in the deep-buffer busy state the effective interval collapses to zero, so the random bit injects on average Δ/4 per packet — the stability threshold is set by this drift Δ/4 − μ_d, not by the global distribution of the injection. Combining the queue-side ceiling with the decoding l

Load-bearing premise

The robust-stability theorem is proved only for backgrounds modulated by an irreducible aperiodic finite-state Markov chain, yet the paper claims the same time-average condition for general stationary-ergodic traffic; if real traffic is stationary-ergodic but not finite-state Markov (e.g., semi-Markov or long-range dependent), the time-average drift condition may cease to guarantee stability.

Editorial extensions

If this is right

  • The quantization step Δ has a hard upper ceiling 4μ_d (or 4μ̄_d for Markov-modulated traffic); setting Δ above it makes the delay buffer diverge for any finite buffer budget.
  • Stability is decided only by the time-average mean inter-packet gap: instantaneous overload episodes (ρ(J) > 1) are drained by slow periods as long as ρ̄ < 1, so bursty autocorrelated traffic does not break the criterion.
  • The practical configuration rule is two-sided: Δ must satisfy Δ ≥ cσ_ξ to keep the single-symbol error rate below ε and Δ < 4μ̄_d to keep the queue stable, yielding the nonempty operating window [cσ_ξ, 4μ̄_d) iff σ_ξ < 4μ̄_d/c.
  • Near the boundary the steady-state dwell grows roughly as 1/(1−ρ), so operating close to Δ = 4μ̄_d incurs rapidly increasing delay; a margin below the pooled ceiling is required when per-flow intensities are dispersed.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial: The same drift analysis suggests a unified stability ceiling across QIM variants: replace Δ/4 by the busy-state mean injection E_w[R_w(0)] of the actual rule (e.g., Δ/2 under dither), so the criterion should generalise from a single rule to a family of embedders.
  • Editorial: The paper stops at the stability pre-screen; the next testable step is a large-deviations result for the overflow tail P(δ_∞ > B), which would turn the criterion into buffer-sizing guidance — the exponential-vs-subexponential dichotomy is a concrete open question.
  • Editorial: Because stability depends only on a single time-average mean, the criterion is amenable to online estimation and adaptive step control on non-stationary traffic; a natural experiment is to compute a running estimate of μ̄_d and compare predicted vs observed divergence on real flows.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper analyzes the stability of causal IPD-QIM watermarks, in which the embedder can only delay packets. It models the embedding rule as a reflected dwell queue with a state-dependent injection r_i = R_{w_i}((d_i - δ_{i-1})^+), and shows that a naive Lindley reduction (Lemma 1) is only algebraic because the increment depends on the queue history. The main theoretical results are Theorem 2, giving an i.i.d. stability criterion μ_d > Δ/4 (equivalently ρ < 1) via a Foster–Lyapunov drift argument, and Theorem 3, extending the criterion to traffic modulated by an irreducible aperiodic finite-state Markov chain, with stability determined by the time-average intensity ρ̄ < 1. The paper also derives a Gaussian-jitter decoding floor Δ ≥ cσ_ξ with c = 4Q^{-1}(ε/2), which, combined with the stability ceiling, yields a proposed operating window Δ ∈ [cσ_ξ, 4μ̄_d). Simulations and real-flow experiments are used to support the criterion.

Significance. If the claims are taken at their proved scope, the paper makes a useful contribution: it turns a largely empirical configuration question into a testable stability condition, identifies the busy-state mean injection Δ/4 as the quantity that sets the stability ceiling, and gives a clean Foster–Lyapunov proof for the i.i.d. case plus a standard Poisson-equation correction for the finite-state Markov-modulated case. The paper also ships released simulation scripts and gives detailed real-flow stress tests with careful attention to avoiding cross-flow splicing. These are genuine strengths. The main reservation is that the most prominently advertised extension—stability for general stationary-ergodic backgrounds—is not proved; the proof covers finite-state Markov modulation only. This is a load-bearing issue because the abstract, contribution list, and real-data section explicitly claim the broader result. The finite-state Markov version and the i.i.d. version appear sound, and the overclaim appears fixable by restricting the claims and adjusting the text.

major comments (2)
  1. [§IV-C, Theorem 3; Abstract; Contribution (2); §III-D] Theorem 3 is stated and proved only for a background modulated by an irreducible aperiodic finite-state Markov chain. The proof relies essentially on a bounded solution to the Poisson equation g(j) - Σ_k P_{jk} g(k) = μ̄_d - m(j), which exists by finite-state invertibility on the zero-π-mean subspace. No analogous construction is given for general stationary-ergodic input. Yet the abstract, contribution (2), and Assumption 1 claim the result for stationary-ergodic backgrounds generally, and Section V-B states that real traces are 'exactly the stationary-ergodic ... backgrounds Theorem 3 characterizes.' This is unsupported. The paper itself notes in §II-C that Loynes' theorem does not apply directly because X_i = r_{i-1} - d_i is state-dependent, so a general stationary-ergodic proof is not a routine corollary. Please either supply such a proof or restrict the claims, including the real-t
  2. [§V-B, §VI] The real-data experiments use traces that are not shown to satisfy the finite-state Markov hypothesis of Theorem 3, and a finite trace is not a stationary-ergodic process in the sense of the theorem. The window diagnostic in Fig. 6 is therefore empirical corroboration, not a verification of Theorem 3. Section VI repeats the unqualified statement that 'for stationary-ergodic bursty backgrounds it generalizes to μ̄_d > Δ/4 ... Theorem 3.' The paper should explicitly separate the theorem's scope from the numerical stress-test evidence, so that readers do not infer a proof for traffic classes that are not covered by the stated hypotheses.
minor comments (4)
  1. [§III-D, Assumption 1] Assumption 1 describes the second tier as 'stationary-ergodic (including finite-state Markov modulation)', but Theorem 3 needs irreducibility, aperiodicity, and finite state. Please restate the assumption to match the theorem actually proved, or split it into a general assumption and a separate finite-state Markov assumption.
  2. [§IV-C, Theorem 2 converse] The converse direction (μ_d < Δ/4 implies no finite stationary distribution) is dismissed in one sentence as a 'standard reverse-drift criterion.' Because the recursion is not classical Lindley, please state the exact criterion used and its hypotheses, or give a short proof that positive large-dwell drift excludes a finite stationary distribution.
  3. [§IV-A, Fig. 5(b)] The lower bound Δ ≥ cσ_ξ is called 'conservative' in the abstract and text, but Fig. 5(b) shows that under Laplace or Student-t jitter the required c is substantially larger than the Gaussian c. The conservatism is relative to the ideal Gaussian model; please qualify this wording explicitly whenever the floor is discussed.
  4. [§V-B, Table III] The caption and table list lag-1 autocorrelation and kurtosis for the filtered in-flow IPDs. It would be clearer to state in the caption that these statistics are computed over the concatenated in-flow samples with cross-boundary pairs dropped, rather than leaving this to the main text.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the stability criterion is derived from the recursion's drift, not from fitted data or self-citation.

full rationale

The derivation chain is self-contained rather than circular. The dwell recursion (3) is defined from the causal QIM rule, Lemma 1 gives only the algebraic Lindley-form identity and explicitly disclaims that it yields stability, and Theorem 2's threshold μ_d > Δ/4 follows from the large-dwell drift limit −μ_d + E_w[R_w(0)] with E_w[R_w(0)] = Δ/4 computed from the fixed dual-lattice rule R_0(0)=0, R_1(0)=Δ/2. Theorem 3 extends this to finite-state Markov modulation via a bounded Poisson-equation correction; it does not assume the conclusion. No parameter is fitted to data and then relabeled a prediction: the synthetic sweeps simulate Eq. (3) and observe divergence at ρ=1, which is an independent numerical check of an analytical threshold, not a fit renamed as validation. The decoding floor Δ ≥ cσ_ξ is an analytic Gaussian-tail bound under Assumption 3; the Monte-Carlo check under the same Gaussian model verifies tightness of the bound, which is internal consistency rather than circularity. The only self-citation ([16], DeMarking) appears in related work and is not load-bearing for any theorem. The one substantive caveat is a scope mismatch, not circularity: contribution (2) and the abstract claim the stationary-ergodic extension generally, while Theorem 3's hypothesis and proof require an irreducible aperiodic finite-state Markov chain and the bounded solution of the Poisson equation on that finite state space. General stationary-ergodic stability is therefore asserted beyond the proven regime; this is a correctness/overclaim concern, not a circular step.

Assumptions & free parameters 0 free parameters · 6 assumptions · 0 invented entities

The central claim rests on standard queueing-theoretic tools (Lindley recursion, Foster-Lyapunov, Loynes) and three explicit traffic/channel assumptions. No hidden fitted parameters; Δ is the design variable under study. The finite-state Markov assumption in Theorem 3 is narrower than the prose claims.

assumptions (6)
  • domain assumption Background IPD {d_i} is i.i.d. (or stationary-ergodic) with finite mean (Assumption 1).
    The queueing analysis and the real-data interpretation assume a well-defined long-run mean inter-arrival; without it, Δ<4μ_d is meaningless.
  • domain assumption Watermark bits are i.i.d. equiprobable and independent of arrivals, with a fixed dual lattice and no per-symbol dither (Assumption 2).
    The busy-state mean injection of Δ/4 is computed under this exact rule; any deviation (non-equiprobable bits, dither, dynamic phase) changes the stability threshold.
  • domain assumption Channel jitter is i.i.d. Gaussian for the decoding floor (Assumption 3).
    The lower bound Δ≥cσ_ξ is derived under Gaussian noise; the paper itself notes heavy-tailed jitter requires a larger c.
  • standard math The dwell chain satisfies irreducibility/small-set conditions for the Foster-Lyapunov criterion.
    Positive recurrence conclusions rely on the standard Markov-chain stability conditions, stated but not verified for particular distributions.
  • domain assumption The lattice is zero-phase (subtract any physical minimum inter-send gap as a common offset).
    The values R_0(0)=0 and R_1(0)=Δ/2 depend on placing the dual lattices at kΔ and (k+1/2)Δ; a phase shift could change the busy-state injection.
  • domain assumption Theorem 3 backgrounds are modulated by an irreducible aperiodic finite-state Markov chain.
    The Poisson-equation correction requires a finite state space; the general stationary-ergodic claim in the abstract is not proven.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Queueing-Stability Criterion for Causal IPD-QIM Network Flow Watermarking." pith.science (2026). https://pith.science/paper/NQYSV3E4

@misc{pith2026260714954,
  author       = {Pith},
  title        = {Pith review of: A Queueing-Stability Criterion for Causal IPD-QIM Network Flow Watermarking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NQYSV3E4}},
  note         = {Machine review of arXiv:2607.14954}
}
abstract

On multi-hop encrypted links such as Tor and cascaded VPNs, tunneling flattens packet lengths and protocol fields, leaving inter-packet delay (IPD) as the main carrier for active flow attribution. Causality lets the embedder delay packets but never advance them, so each quantization-index-modulation (QIM) alignment injects nonnegative dwell into a delay buffer; unbounded dwell breaks lattice alignment and delays the host connection unacceptably. Whether a causal QIM watermark embeds stably on bursty traffic has largely been left to empirical configuration rather than analysis. We model the embedder as a reflected dwell queue under the fixed dual-lattice, equiprobable-bit rule, where injection is state-dependent -- set by the current interval and bit -- rather than exogenous. The substitution $Y_i=\delta_i-r_i$ gives only an algebraic Lindley-form identity; stability is governed by the busy-state drift at large dwell, where the effective interval collapses to zero and the mean injection becomes $\Delta/4$. Away from the critical boundary, the buffer is stable iff $\mu_d>\Delta/4$ (i.e. $\Delta<4\mu_d$) for i.i.d. backgrounds, and, under stationary-ergodic and finite-state Markov-modulated traffic with instantaneous overload, iff the time-average intensity $\bar\rho<1$. With the exogenous decoding floor $\Delta\ge c\sigma_\xi$ ($c=4Q^{-1}(\epsilon/2)$), this yields the operating window $\Delta\in[c\sigma_\xi,4\bar\mu_d)$. Simulations confirm a sharp transition at $\rho=1$ set only by the mean; on four real IPD traces, with each simulated chain confined to a single flow, the criterion gives the correct stability direction under flow-local correlation and burstiness, while pooled cross-flow means overestimate the margin. These results give a testable stable-embeddability criterion and a quantization-step configuration baseline for causal QIM network flow watermarking.

Figures

Figures reproduced from arXiv: 2607.14954 by the authors.

Figure 1
Figure 1. Deployment view of causal IPD-QIM flow watermarking. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Per-packet processing flow of the causal QIM buffer. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. A typical dwell trajectory (∆ = 2 ms, budget B = 6 ms). the step ∆, squeezed from two sides and given in turn. First a functional lower end (Section IV-A): to guarantee decodability via a single-symbol sufficient bound, the step must meet a conservative decoding floor ∆ ≥ cσξ set by the channel jitter. Then the main line: the algebraic identity between the causal￾QIM recursion and the Lindley form (Section IV-B), fo… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Per-theorem fine-grained checks on synthetic backgrounds. [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: The quantization-step operating window and the decoding floor under non-ideal jitter. [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: Stress test approaching the stability boundary. [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

30 extracted references

  1. [1]

    Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays,

    X. Wang and D. S. Reeves, “Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays,” in Proc. 10th ACM Conf. Computer and Communications Security (CCS), 2003, pp. 20–29

    2003

  2. [2]

    A survey on network flow watermarking: A problem-oriented perspective,

    T. Li, K. Liu, and S. Du, “A survey on network flow watermarking: A problem-oriented perspective,”Computers & Security, 2026

    2026

  3. [3]

    Network flow watermarking attack on low-latency anonymous communication systems,

    X. Wang, S. Chen, and S. Jajodia, “Network flow watermarking attack on low-latency anonymous communication systems,” inProc. IEEE Symposium on Security and Privacy (S&P), 2007, pp. 116–130

    2007

  4. [4]

    RAINBOW: A robust and invisible non-blind watermark for network flows,

    A. Houmansadr, N. Kiyavash, and N. Borisov, “RAINBOW: A robust and invisible non-blind watermark for network flows,” inProc. 16th Network and Distributed System Security Symposium (NDSS), 2009

    2009

  5. [5]

    SWIRL: A scalable watermark to detect correlated network flows,

    A. Houmansadr and N. Borisov, “SWIRL: A scalable watermark to detect correlated network flows,” inProc. 18th Network and Distributed System Security Symposium (NDSS), 2011

    2011

  6. [6]

    Quantization index modulation: A class of provably good methods for digital watermarking and information embedding,

    B. Chen and G. W. Wornell, “Quantization index modulation: A class of provably good methods for digital watermarking and information embedding,”IEEE Trans. Inf. Theory, vol. 47, no. 4, pp. 1423–1443, 2001

    2001

  7. [7]

    I. J. Cox, M. L. Miller, J. A. Bloom, J. Fridrich, and T. Kalker,Digital Watermarking and Steganography, 2nd ed. Morgan Kaufmann, 2007

    2007

  8. [8]

    IP covert timing channels: Design and detection,

    S. Cabuk, C. E. Brodley, and C. Shields, “IP covert timing channels: Design and detection,” inProc. 11th ACM Conf. Computer and Com- munications Security (CCS), 2004, pp. 178–187

    2004

Show all 30 references
  1. [9]

    DSSS-based flow marking technique for invisible traceback,

    W. Yu, X. Fu, S. Graham, D. Xuan, and W. Zhao, “DSSS-based flow marking technique for invisible traceback,” inProc. IEEE Symposium on Security and Privacy (S&P), 2007, pp. 18–32

    2007

  2. [10]

    Sliding window based ON/OFF flow watermarking on Tor,

    K. Yang, Z. Liu, Y . Zeng, and J. Ma, “Sliding window based ON/OFF flow watermarking on Tor,”Computer Communications, vol. 196, pp. 66–75, 2022

    2022

  3. [11]

    HeteroTiC: A robust network flow watermarking based on heterogeneous time channels,

    T. Li, K. Liu, W. Feng, C. Yang, and X. Luo, “HeteroTiC: A robust network flow watermarking based on heterogeneous time channels,” Computer Networks, vol. 219, p. 109424, 2022

    2022

  4. [12]

    DynMark: A dynamic packet counting watermarking scheme for robust traffic tracing in network flows,

    S. Qiao, H. Zhu, L. Sha, M. Wang, and Q. Guo, “DynMark: A dynamic packet counting watermarking scheme for robust traffic tracing in network flows,”Computers & Security, vol. 157, p. 104571, 2025

    2025

  5. [13]

    An efficient hexadecimal network flow watermark method for tracking attack traffic connection chain,

    J. Cui, K. Han, L. Sha, W. Liu, X. Zhang, and G. Li, “An efficient hexadecimal network flow watermark method for tracking attack traffic connection chain,”Scientific Reports, vol. 13, p. 21111, 2023

    2023

  6. [14]

    Multi-flow attacks against network flow watermarking schemes,

    N. Kiyavash, A. Houmansadr, and N. Borisov, “Multi-flow attacks against network flow watermarking schemes,” inProc. 17th USENIX Security Symposium, 2008, pp. 307–320

    2008

  7. [15]

    New attacks on timing-based network flow watermarks,

    Z. Lin and N. Hopper, “New attacks on timing-based network flow watermarks,” inProc. 21st USENIX Security Symposium, 2012

    2012

  8. [16]

    DeMarking: A defense for network flow watermarking in real-time,

    Y . Yuan, J. Ge, and G. Cheng, “DeMarking: A defense for network flow watermarking in real-time,”Computers & Security, vol. 152, p. 104355, May 2025

    2025

  9. [17]

    Network flow watermarking: A survey,

    A. Iacovazzi and Y . Elovici, “Network flow watermarking: A survey,” IEEE Communications Surveys & Tutorials, vol. 19, no. 1, pp. 512–530, 2017

    2017

  10. [18]

    Writing on dirty paper,

    M. H. M. Costa, “Writing on dirty paper,”IEEE Trans. Inf. Theory, vol. 29, no. 3, pp. 439–441, 1983

    1983

  11. [19]

    Content-aware quantization index modulation: Leveraging data statistics for enhanced image watermarking,

    J. Mao, H. Tang, S. Lyu, Z. Zhou, and X. Cao, “Content-aware quantization index modulation: Leveraging data statistics for enhanced image watermarking,”IEEE Trans. Inf. Forensics Secur., vol. 19, pp. 1935–1947, 2024

    1935

  12. [20]

    Optimized dithering for quantization index modulation,

    S. Lyu, “Optimized dithering for quantization index modulation,” in Proc. IEEE Int. Conf. Acoust. Speech Signal Process. (ICASSP), 2023, pp. 1–5

    2023

  13. [21]

    The theory of queues with a single server,

    D. V . Lindley, “The theory of queues with a single server,”Math. Proc. Cambridge Philos. Soc., vol. 48, no. 2, pp. 277–289, 1952

    1952

  14. [22]

    The stability of a queue with non-independent inter- arrival and service times,

    R. M. Loynes, “The stability of a queue with non-independent inter- arrival and service times,”Math. Proc. Cambridge Philos. Soc., vol. 58, no. 3, pp. 497–520, 1962

    1962

  15. [23]

    On the stochastic matrices associated with certain queuing processes,

    F. G. Foster, “On the stochastic matrices associated with certain queuing processes,”Annals of Mathematical Statistics, vol. 24, no. 3, pp. 355– 360, 1953

    1953

  16. [24]

    S. P. Meyn and R. L. Tweedie,Markov Chains and Stochastic Stability. London: Springer-Verlag, 1993

    1993

  17. [25]

    Asmussen,Applied Probability and Queues, 2nd ed

    S. Asmussen,Applied Probability and Queues, 2nd ed. Springer, 2003

    2003

  18. [26]

    Durrett,Probability: Theory and Examples, 5th ed

    R. Durrett,Probability: Theory and Examples, 5th ed. Cambridge University Press, 2019

    2019

  19. [27]

    Wide-area traffic: The failure of Poisson modeling,

    V . Paxson and S. Floyd, “Wide-area traffic: The failure of Poisson modeling,”IEEE/ACM Trans. Networking, vol. 3, no. 3, pp. 226–244, 1995

    1995

  20. [28]

    The role of the Weibull distribution in modelling traffic in Internet access and backbone core networks,

    A. Arfeen, K. Pawlikowski, D. McNickle, and A. Willig, “The role of the Weibull distribution in modelling traffic in Internet access and backbone core networks,”Journal of Network and Computer Applications, vol. 141, pp. 1–22, 2019

    2019

  21. [29]

    Characterization of tor traffic using time based features,

    A. Habibi Lashkari, G. Draper Gil, M. S. I. Mamun, and A. A. Ghorbani, “Characterization of tor traffic using time based features,” inProc. 3rd Int. Conf. Information Systems Security and Privacy (ICISSP), Porto, Portugal, 2017, pp. 253–262, dataset: ISCXTor2016, https://www.u...

    2017

  22. [30]

    Characterization of encrypted and VPN traffic using time-related fea- tures,

    G. Draper Gil, A. Habibi Lashkari, M. S. I. Mamun, and A. A. Ghorbani, “Characterization of encrypted and VPN traffic using time-related fea- tures,” inProc. 2nd Int. Conf. Information Systems Security and Privacy (ICISSP), Rome, Italy, 2016, pp. 407–414, dataset: ISCXVPN2016,...

    2016

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.