## 1 Introduction  
As the network architecture and functions become more and more complex, both users and operators require better network performance; however, because the rapid growth of network traffic incurs traffic collision, blindly increasing the network bandwidth cannot effectively improve the network performance. Network management faces new challenges; it requires quick awareness of network status and response to the network failures as soon as possible to decrease the dynamic delay. Therefore, efficient network congestion detection is particularly important. Network congestion detection uses software or hardware tools to collect the real-time network status and provides data support for network fault location and routing calculation, which is the basis of network management. Researchers have proposed many network congestion detection methods but there are some shortcomings. Active network congestion detection introduces probes, which occupy the extra bandwidth. Passive network congestion detection captures the packets information through detection points, which lacks the view of global network status. In the SDN (Software Defined Network) -based network congestion detection, the controller frequently communicates with switches and installs flow entries, which increases the number of flow entries and may occupy bandwidth, computing and storage resources. The INT (In-band Network Telemetry) -based network congestion detection encapsulates telemetry commands and data into packets, which reduces the ratio of effective packet payload and increases the burden of switches. The industry has also conducted in-depth research on network congestion detection. Huawei proposed AI Fabric, a datacenter switch based on high-performance AI chips [1]. The switch can collect traffic characteristics and network status information in real-time and achieve zero packet loss. Therefore, AI Fabric can identify faults in seconds timescaleand locate faults in minutes timescale; however, the duration of burst traffic in the current datacenter network is usually a few seconds or milliseconds, so it is not effective in dealing with the micro-burst traffic. More fine-grained and low-overhead network congestion detection is required to cope with the changes in network status on a small timescale, and to achieve more efficient network congestion detection. Network flow watermarking [2] is a technique that determines whether there is a flow association between sender and receiver by changing certain characteristics of network traffic to embed watermark information; it is often used for springboard detection and attack source tracing. Time-based network flow watermarking technique encodes different information by modifying the IPD (Inter-Packet Delay), which embeds management data into the flow transmission process only by delaying sending time of packets. Network congestion may destroy the original feature of the watermark. Figure 1 shows the distortion of IBF (Interval-Based Fingerprinting) [3], which is a time-based network flow watermarking technique when facing network congestion. Before the distortion, the packets of the second interval are moved into the third interval for transmission. The number of packets in the second interval is less than the average number of packets in the three consecutive intervals, which present data '1'. After network congestion occurs, the packets in the first interval are delayed until the second interval, and the packets in the third interval are lost. At this time, the number of packets in the second interval is greater than the average value in the three intervals, which presents data '0'. The variational network status changes the original sparsity of packets and destroys the watermark they carried. The watermark decoding information can roughly feed back the changes in network status. Therefore, we apply the time-based flow watermarking technique to network congestion detection. But the flow watermarking based on user mode cannot cope with high-speed traffic and hurts the network performance.