# SACT: A New Model of Covert Communication Based on SDN
## 5 Experimental Results
### Anti Attack Ability
#### 5.3.2 Mapping Synchronization Test  
In the experiment, we get the data stream in the network by intercepting attack. When mapping dynamic synchronization is not added, the mapping relationship in the controller is static. For example, the MAC address of one side of network communication is \(C8-D3-FA-E2-F2-88\), the minimum interval arrival delay of the current network is \(T_{\text{min}}=30\) ms, and the interval sequence step size is \(\Delta=20\) ms. The mapping relationship after watermark transformation is shown in Table 2.  
In order to analyze the problem more intuitively, we give the mapping diagram, as shown in Figure 14. The mapping relationship is a stable one-to-one relationship in the whole monitoring process. When the attacker intercepts the system, it is relatively easy to get the potential watermark conversion relationship. It is easier for the attacker to find the watermark and even get the watermark content, which makes the whole system in an insecure state.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Character** & **Binary Code** & **Delay Sequence** \\ \hline
2 & 0011 0010 & (30,110,130) \\
3 & 0011 0011 & (30,110,150) \\
3 & 0011 1000 & (30,130,110) \\ A & 0100 0001 & (50,50,30) \\ C & 0100 0011 & (50,50,70) \\ E & 0100 0101 & (50,50,90) \\ F & 0100 0110 & (50,50,110) \\ \hline \hline \end{tabular}
\end{table}
Table 2: Coding mapping relation.  
Figure 13: Time delay distribution after simulation of distribution.  
We add mapping dynamic synchronization, changing the current mapping scheme by using the timestamp returned by NTP server. Thus, the diversity of communication traffic delay sequence is realized, which makes it difficult for the attacker to analyze and obtain the information beneficial to his attack, so as to confuse the attacker. The same network environment is used in the experiment. As the monitoring time goes on, the mapping relationship will become more and more complex. The mapping diagram at this time is shown in Figure 15.  
In the field of anonymous communication, whether anonymous communication can be realized safely and effectively is the main evaluation criterion. In addition, the evaluation criterion include cost, efficiency, and deployment difficulty. We made a horizontal comparison between our mechanism and the work in [PERSON] et al. [17] and [PERSON] et al. [19], and the result is shown in the Table 3.  
Figure 14: Mapping graph without dynamic transition synchronization.  
Figure 15: Mapping graph with dynamic transition synchronization.  
In Table 3, we can see that our system SACT is dynamic and easy to deploy on the basis of maintaining effective anonymous communication, which ensures our system has higher security and flexibility.  
Summary: We introduce the system test environment, then test it from three aspects: detection rate, false alarm rate, and antidetection ability. The experimental results show that the proposed scheme can maintain a good detection rate in most of the our conditions, making the detection similarity of the watermarked data stream far lower than the lower boundary of the confidence interval threshold, and the false alarm rate is low. It can accord the distribution of the watermark delay sequence with the normal data flow. In addition, we make the mapping relationship disordered, thus improving the ability of antidetection and hidden tracking of watermark information.