# SACT: A New Model of Covert Communication Based on SDN
## 3 Materials and Methods
### Watermark Anti Detection Analysis  
#### 3.2.1 Distributed Simulation Strategy  
After the tracking information is converted into the packet delay sequence according to the watermark encoding scheme, the delay of the information is affected, and the statistical law is different from that of the normal data flow. The interval arrival delay of packets in the network is a random variable in accordance with normal distribution [40]. Distributed simulation methods obtain the approximate reversible transformation function by detecting the statistical distribution of normal interval arrival delay in the network. The encoded packets are modulated according to this transformation function. In this way, the distribution pattern of packets is similar to the distribution of normal data flow in the network, thus avoiding detection by attackers.  
Suppose that controller obtains the delay sequence \((T_{1},T_{2},\cdots,T_{n})\) after watermark information is encoded and modulated. It is transformed into a set of random variables \((tran(T_{1}),tran(T_{2}),\cdots,tran(T_{n}))\) by invertible transformation function, and it accords with the distribution function of normal interval sequence in the network. \(tran(x)\) is a reversible transformation function. After receiving the carrier data stream, the receiver can restore the \((tran(T_{1}),tran(T_{2}),\cdots,tran(T_{n}))\) sequence to the \((T_{1},T_{2},\cdots,T_{n})\) sequence through \(tran^{-1}(x)\) function to confuse the attacker.  
According to the law of probability integral transformation in probability theory:  
1. If the distribution function \(F(x)\) of \(X\) is continuous, then \(Y=F(x)\) is uniformly distributed on the interval \((0,1)\).  
\begin{table}
\begin{tabular}{c c} \hline \hline
**m** & **T/ms** \\ \hline
10 & 60 \\
01 & 80 \\
11 & 100 \\
00 & 120 \\ \hline \hline \end{tabular}
\end{table}
Table 1: L-Bits to N-Packets Codes.  
If \(Y\) is uniformly distributed in the interval \((0,1)\), let \(X=F^{-1}(Y)\), then \(X\) is a random variable whose distribution function is \(F(x)\) for any distribution function \(F(x)\).  
Assume that the current interval sequence of network data flow accords with normal distribution function \(F(x)\), and \(T_{i}(i=1,2,\cdots,n)\) is within \(U(0,1)\). Then the transformation function \(tran(x)\) and its inverse function \(tran^{-1}(x)\) are defined as:  
\[\begin{split}& tran(x)=F^{-1}(x)\\ & tran^{-1}(x)=F(x)\end{split} \tag{2}\]  
The arrival delay sequence \((T_{1},T_{2},\cdots,T_{n})\) of the original interval is transformed into a delay sequence that follows the current network delay distribution function \(F(x)\) through the transformation function \(tran(x)\). The solution of the transformation function can be changed into the solution of the inverse function \(X=F^{-1}(Y)\) of the delay distribution function \(F(x)\) in current network. In this paper, the approximate reversible transformation function of the inverse function \(F^{-1}(x)\) of the network delay distribution function is constructed by using the discrete approximation method in the stochastic simulation method [41]. Then, the delay sequence is modulated to accord with the delay distribution law of network transmission.