## 2 Related Work
### End Hopping and Spreading  
In recent years, end hopping has also drawn considerable attention and has been applied in multiple fields. Motivated by FHSS for military communication, end hopping hides the service identity and performs proactive network defense by constantly altering end information in a pseudo-random way [17]. Since focusing on the change over the network layer, end hopping could be regarded as a special case of moving target defense (MTD). [PERSON] et al. [27] presented an effective address randomization technique, called random host address mutation (RHM), that turns end hosts into untraceable moving targets and achieves maximum efficacy by allowing address randomization to be highly unpredictable and fast, and adaptive to adversarial behavior, while incurring low operational and reconfiguration overhead. [PERSON] et al. [28] proposed a pattern classification framework for network information hiding methods. By constructing an \"information hiding pattern\" system, they systematically abstractly describe and hierarchically divide network covert channels. The core of their framework is to divide covert channels into storage type and time type according to the data embedding method (such as inter-packet delay modulation, etc. ), and further support advanced features such as pattern combination and hopping. However, the pattern system focuses more on the classification and understanding of methods, and pays less attention to key issues such as robustness and synchronization mechanisms. Their method is particularly lacking in the characterization and support of behavioral covert channels in highly dynamic network environments. In contrast, CCES takes the end spreading as the core, combines m-sequence with end hopping, and constructs a hybrid channel with both storage characteristics and behavioral hiding characteristics, showing excellent robustness and synchronization performance in a high-packet-loss environment. However, resorting to the advanced and automated attack tools, sophisticated attackers could still perform thorough reconnaissance with great ease to enumerate assets of the end hopping system that stays at a low-speed mutating rate. Consequently, pursuing a high-speed end hopping rate has become a research hotspot recently [18]. Taking this as our goal, we need to improve the synchronization mechanism that is linked closely to the hopping rate in the end hopping system. Clock synchronization [29] and timestamp synchronization [30] are both traditional tracking synchronization mechanisms whose performance, however, is seriously influenced by network packet disorder or time delay and limits the end hopping rate at the order of hectosecond or decasecond; such a rate provides skilled adversaries sufficient time to reconnoiter the whole system and reuse the collected reconnaissance information in various stages of attack planning and execution. To get rid of the above quagmire, researchers eagerly seek a novel mechanism for the high-speed end hopping system. In FHSS, the communication session is conducted by converting the narrowband information signal to a signal with a much wider band. Specifically, by significantly expanding the bandwidth used, FHSS allows communication parties to work with a much smaller ratio of signal strength to the noise power, resulting from [PERSON]'s theorem as follows:  
\[C=B\cdot\log_{2}\left(1+S/N\right), \tag{1}\]  
where \(C\), \(B\), \(S\), \(N\), and \(S/N\) represent the channel capacity, channel bandwidth, average received signal power, average noise power, and signal-to-noise ratio (SNR), respectively. It is easy to conclude that the more the noise dominates the signal, the wider the band the signal must occupy to receive it correctly. Put simply, the signal gains higher robustness, but this comes at the expense of bandwidth [31].