## 3 Model and Scheme
### Model of CCES  
CCES means the network covert channel model based on end spreading, which can be represented as:  
\[\langle P_{s},P_{r},M,T_{s,r}\rangle, \tag{3}\]  
where \(P_{s}\), \(P_{r}\), \(M\), and \(T_{s,r}\) stand for message sender, message receiver, original message, and message transmission, respectively.  
In CCES, the goal is to deliver the original message \(M\) from sender \(P_{s}\) to receiver \(P_{r}\) through a transmission operator \(T_{s,r}\). \(T_{s,r}\) can be formulated as a mapping:  
\[T_{s,r}:(P_{s},M^{\prime})\mapsto(P_{r},M^{\prime\prime}) \tag{4}\]  
where \(M^{\prime}\) represents the preprocessed and modulated form of the original message \(M\) and \(M^{\prime\prime}\) denotes the reconstructed message at the receiver side.  
Message preprocessing is a conversion process in which \(M\) is converted into \(M^{\prime}\) by \(F_{1}\), as shown in (5):  
\[F_{1}(M)\Leftrightarrow M\
eg M^{\prime}\Leftrightarrow M\
eg(m^{\prime}_{1 },m^{\prime}_{2},\cdots,m^{\prime}_{k},\cdots,m^{\prime}_{t}), \tag{5}\]  
where \(F_{1}\) is the encoding rule being shared by \(P_{s}\) and \(P_{r}\), \(M^{\prime}\) is the converted \(M\), and \(m^{\prime}_{k}\) is the subgroup in \(M^{\prime}\).  
Pseudo-random sequence modulation means that the pseudo-random sequence (PRS) generated by a pseudo-random sequence generator is modulated by \(m^{\prime}_{k}\) in \(M^{\prime}\) in turn. Thus,  
\[\begin{split} M_{PRS}&=F_{2}(M^{\prime},PRS)\\ &=\Big{\{}(m_{prs})_{1},\cdots,(m_{prs})_{k},\cdots,(m_{prs})_{ t}\Big{\}},\end{split} \tag{6}\]  
Figure 1: Schematic diagram of end spreading.  
where \(F_{2}\) represents the modulation algorithm.  
End spreading sequence generation is the conversion process from \(M_{PRS}\) to end spreading sequences (ESs) in which \(M_{PRS}\) is processed by \(F_{3}\). Thus,  
\[\begin{split} ESs&=F_{3}(M_{PRS})\\ &=\Big{\{}ESs_{1},ESs_{2},\cdots,ESs_{l},\cdots,ESs_{u}\Big{\}}, \end{split} \tag{7}\]  
where end spreading sequence generation algorithm is denoted by \(F_{3}\). Assuming the end spreading degree is \(e\), the length of ESS in the above equation is \(u\) (where \(u=e\cdot t\))  
End spreading sequence demodulation is the inverse conversion process of end spreading sequence generation and pseudo-random sequence modulation in which end information is extracted from ESs and demodulated to \(M^{\prime}\) by \(F\), as shown in Equation (8):  
\[M^{\prime}=F(ESs,PRS), \tag{8}\]  
where \(F\) means the demodulation algorithm and PRS is generated by the same pseudo-random sequence generator in pseudo-random sequence modulation.  
Message reverting is the reverse conversion process of message preprocessing in which \(P_{r}\) decodes \(M^{\prime}\) and recovers \(M\) by \(F_{1}^{-1}\), as shown in Equation (9):  
\[M=F_{1}^{-1}(M^{\prime}), \tag{9}\]  
where \(F_{1}^{-1}\) is the inverse function of \(F_{1}\).  
In summary, CCES is a kind of hybrid network covert channel, characterized by storage and behavior. The original message is not only loaded on the end information of the packet header but also relies upon the behavior of sequences. As far as we know, few detection or mitigation technologies have discussed this type of covert channel since the end information is the stationary opponent in the packet header and a large amount of end information is utilized in the end hopping system. The CCES model is depicted in Figure 2.