# SACT: A New Model of Covert Communication Based on SDN
## 3 Materials and Methods
### Watermark Anti Detection Analysis
#### 3.2.3 Effectiveness Analysis  
After the watermark information is transformed into a delay sequence and embedded to data stream, the delay distribution state of the data stream will change. As the number of embedded packets increases, the distribution may gradually tend to uniform distribution.  
Suppose that \(N\) is the number of all packets sent during communication, and \(n\) is the number of packets that the attacker needs to capture to determine the current distribution state of flow delay.  
In the absence of distributed simulation mechanism, watermark delay sequence does not accord with normal distribution. If attackers attack the network, the success rate is shown in Equation (3).  
\[\rho=(N-n)/N \tag{3}\]  
In practical or uncontrolled environments, the delay distribution of the data stream embedded with watermark information is uncertain. Its distribution also tends to be uniform rather than normal in the case of sufficient data packets. So Equation (3) is effective in practical situations. Success rate \(\rho\) only depends on the number of packets the attacker needs to capture. The lower the number of packets needed, the higher the success rate. As the number of packets captured by the attacker increases, the watermark is more likely to be detected.  
When the distributed simulation mechanism works, the distribution state of delay interval obtained by attackers is fitted with that of the normal data flow. The attacker cannot confirm the existence of the watermark.  
When the attackers discover that the delay information of the current detection data stream is abnormal, it is assumed that there are \(m(m\geq 2)\) kinds of code mapping relations preset in the controller, and the dynamic change time slot of the mapping relationship is \(\tau\). The time taken by the attacker to obtain and analyze the mapping relationship is \(t\), and the total communication time is \(T\).  
In the absence of a dynamic synchronization mechanism, the mapping scheme remains unchanged during communication. The success rate of the attacker to confirm the watermark information by acquiring and analyzing the mapping relationship is shown in Equation (4). It can be seen that the success rate is only affected by the time the attackers get the mapping relationship. Since the mapping relationship remains unchanged, the success rate of the next attack directly increases to 1 after the attacker succeeds.  
\[\alpha=(T-t)/T \tag{4}\]  
Controller can make pseudo random selection from the preset coding mapping relationship when dynamic synchronization mechanism exists. The success rate of the attacker to obtain the mapping information is shown in Equation (5).  
\[\beta=(\tau-t)/mT(\tau\geq t,m\geq 2) \tag{5}\]  
It is obvious that if \(\beta<\alpha\), the smaller the dynamic time slot is, the closer \((\tau-t)\) is to 0. When the dynamic change time slot is small enough, the attacker cannot restore the mapping relationship, so as to avoid the leakage of watermark information. If the dynamic time slot is large, the attacker can successfully resolve the code mapping relationship. The system can still reselect a new mapping relationship through the synchronization algorithm after the end of the current dynamic time slot, so as to avoid the attackers from attacking again.  
Through the above analysis, the current anti detection strategy can effectively improve the concealment of watermark information and resist the detection of attackers.