ATHW: An Active Threat Hunting Network Flow Watermarking Method for Cross-Domain Consumer Electronics Ecosystem

With the widespread use of biometric technologies in consumer electronics such as smart locks and wearable devices, securing biometric data transmission across the “home gateway– ISP/Internet–cloud” path has become increasingly important. Existing cross-domain traffic correlation solutions mainly rely on log aggregation or application-layer identifiers, which often suffer from limited timeliness, weak verifiability, and poor scalability. To address these issues, this paper proposes ATHW, an active threat-hunting network flow watermarking method for cross-domain consumer electronics, which aims to establish verifiable associations between gateway events and cloud-side traffic. ATHW employs a hybrid embedding framework that combines sequence-based synchronization and centroid-based modulation. To improve synchronization stability under network jitter and packet loss, a dual-layer synchronization mechanism with threshold-based redundant decisions is introduced. Meanwhile, a controllable time-slot centroid modulation strategy combined with lightweight redundancy coding is applied to reduce sensitivity to per-packet delay variations and improve watermark recovery reliability. Experimental results show that ATHW maintains high extraction accuracy under packet loss and delay perturbations while preserving favorable robustness and invisibility.