## 3 Network Congestion Detection Model Based on Flow Watermarking  
### Congestion Detection Model Based on Watermark  
The network congestion detection model based on flow watermarking is shown in Figure 2, which mainly includes three logical layers: data layer, codec layer and management layer. When a packet reaches the server core, it enters the data layer. The eBPF extracts the header field of the packet for multi-flow identification. The quintuple information of the encoded and decoded flow distributed by the management layer is used as the key to match. If the match is successful, it indicates that the packet belongs to the encoded flow, which enters the codec layer. Otherwise, it indicates that the packet belongs to the non-encoded flow, which is forwarded directly.  
The codec layer includes a watermark encoding module and a watermark decoding module. The watermark encoding module is responsible for embedding the watermark into the encoded flow. According to the watermark distributed by the management layer, eBPF changes the IPD by delaying the forwarding time of the packets or directly forwarding the packets to encode the watermark information. The watermark decoding module is responsible for decoding watermark data destroyed by network congestion. The eBPF counts the number of packets arriving in the corresponding interval of the decoded flow  
Figure 2: The network congestion detection model based on flow watermarking.  
and performs arithmetic operations to obtain the decoding information of the watermark. The information is then passed to the management layer.  
The management layer includes a watermark generation module and a network status analysis module. The watermark generation module generates the watermark data, interval length and quintuple information of encoded and decoded flow in real-time according to the network paths to be detected, detection accuracy and other factors. And it sends them to the codec layer and data layer. The network status analysis module analyzes the information from the watermark decoding module to obtain the network status.  
We formally describe the generation process of the watermark. We select an end-to-end path \(P\) to detect its congestion status. The accuracy of detection is denoted as \(x\), and the unit is millisecond or microsecond. The duration of detection is denoted as \(T\). We select the flow \(f\) passing through the path \(P\). The PPS (Packet Per Second) of \(f\) is denoted as \(R(f)\), and the quintuple identifier is denoted as \(FlowID\). The length of interval is denoted as \(t\), and its value range is:  
\[\frac{n}{R(f)}\leq t\leq x, \tag{1}\]  
where \(n\) is the minimum value of the number of packets in the interval, which can be set to 50, 100, etc.  
\(T\) and \(t\) determine the bits of watermark \(N\), that is  
\[N=g\left(\frac{T}{t}\right), \tag{2}\]  
where the function \(g\) is determined by a specific watermark encoding method.  
According to \(N\) and \(FlowID\), the watermark is obtained. To ensure the randomness of watermark generation, random number \(\tau\) is introduced. The watermark generation function is  
\[Watermark=F(N,FlowID,\tau). \tag{3}\]  
Then network congestion detection model can be defined as:  
\[Network\;Status=Model(Watermark,Traffic) \tag{4}\]  
where the input is \(Watermark\) and \(Traffic\). \(Traffic\) represents the distribution of size and arrival time of flows, which may cover different traffic models, such as micro-burst flow model, elephant flow model, etc. The output is \(Network\;Status\), which indicates the current network status. According to the fine-grained network congestion detection algorithm, it can be divided into normal, slightly congested, moderately congested and heavily congested. Section 5 introduces the algorithm in detail.