## 4 Theoretical Analysis of Network Congestion Detection Based on Flow Watermarking
### Analysis of the SRW When Packet Loss Occurs  
Figure 5 shows an example of the distortion of watermark '00' when packet loss occurs. When the packets of the third interval are lost, the decoder counts the number of packets, and finds that \(Y_{k2}\) and \(Y_{k3}\) are less than the average value. The decoded watermark is '10'. Similarly, when packets carrying different watermarks face different packet loss, the decoder also obtains different error results.  
Taking \(Pr\big{[}\Big{(}\overline{Y_{r2}^{P}}\geq 0\Big{)}\big{(}\overline{Y_{r3}^ {P}}<0\big{)}\big{]}\) when f = 01 as an example to analyze the SRW when packet loss occurs. After packet loss occurs, \(X_{i,k}^{f}(i\) = 1, 2, 3, 4), \(\overline{Y_{r2}^{f}}\) and \(\overline{Y_{r3}^{f}}\) are defined as \(X_{i,k}^{p}\) (\(i\) = 1, 2, 3, 4), \(\overline{Y_{r2}^{p}}\) and \(\overline{Y_{r3}^{p}}\). Let \(P_{2,k}\) be the number of packets that \(X_{2,k}^{f}\) reduced, and define \(\mu_{p2}\) and \(\sigma_{p2}\) as the mean and variance of \(P_{2,k}\), respectively; it is obvious that \(P_{2,k}\) satisfy _iid_. We have  
\[X_{2,k}^{p}=X_{2,k}^{f}-P_{2,k},X_{3,k}^{p}=X_{3,k^{\prime}}^{f}\overline{X_{ k}^{p}}=\frac{1}{4}\Big{(}X_{1,k}^{p}+X_{2,k}^{p}+X_{3,k}^{p}+X_{4,k}^{p}\Big{)} \tag{31}\]  
Then  
\[E\Big{(}X_{2,k}^{p}\Big{)}=2u_{x}-u_{d2},V\Big{(}X_{2,k}^{p}\Big{)}\leq 4\sigma_ {x}^{2}+\sigma_{d2}^{2} \tag{32}\]  
Figure 5: An example of the distortion of watermark ‘00’ when packet loss occurs.  
\[E\Big{(}X_{3,k}^{P}\Big{)}=0,V\Big{(}X_{3,k}^{P}\Big{)}=0. \tag{33}\]  
It follows that  
\[E\Big{(}\overline{Y_{r2}^{P}}\Big{)}=\frac{1}{4}(4u_{x}-3u_{d2}),V\Big{(} \overline{Y_{r2}^{P}}\Big{)}\leq\frac{1}{16r}\Big{(}70\sigma_{x}^{2}+17\sigma_ {d2}^{2}\Big{)} \tag{34}\]  
\[E\Big{(}\overline{Y_{r3}^{P}}\Big{)}=\frac{1}{4}(u_{d2}-4u_{x}),V\Big{(} \overline{Y_{r3}^{P}}\Big{)}\leq\frac{1}{16r}\Big{(}6\sigma_{x}^{2}+\sigma_{d2 }^{2}\Big{)} \tag{35}\]  
Using the central limit theorem, we obtain:  
\[P\Big{[}\overline{Y_{r2}^{P}}\geq 0\Big{]}\approx 1-\Phi\left(\frac{-E\Big{(} \overline{Y_{r2}^{P}}\Big{)}}{\sqrt{V\Big{(}\overline{Y_{r2}^{P}}\Big{)}}} \right)\geq 1-\Phi\left(\frac{-\sqrt{r}(4u_{x}-3u_{d2})}{\sqrt{70\sigma_{x}^{2}+ 17\sigma_{d2}^{2}}}\right). \tag{36}\]  
Similarly  
\[P\Big{[}\overline{Y_{r3}^{P}}<0\Big{]}\approx\Phi\left(\frac{-E\Big{(} \overline{Y_{r3}^{P}}\Big{)}}{\sqrt{V\Big{(}\overline{Y_{r3}^{P}}\Big{)}}} \right)\geq\Phi\left(\frac{\sqrt{r}(u_{d2}-4u_{x})}{\sqrt{6\sigma_{x}^{2}+ \sigma_{d2}^{2}}}\right). \tag{37}\]  
The SRW when packet loss occurs is  
\[P\Big{[}\Big{(}\overline{Y_{r2}^{P}}\geq 0\Big{)}\Big{(}\overline{Y_{r3}^{P} }<0\Big{)}\Big{]}\geq(1-\Phi(\frac{-\sqrt{r}(4u_{x}-3u_{d2})}{\sqrt{70\sigma_ {x}^{2}+17\sigma_{d2}^{2}}}))\cdot\Phi(\frac{\sqrt{r}(4u_{x}-u_{d2})}{\sqrt{ 6\sigma_{x}^{2}+\sigma_{d2}^{2}}}) \tag{38}\]  
Compared with the SRW without any interference, the SRW when packet loss occurs is lower. The greater the packet loss rate, the greater the change in number of packets in the same interval. And the greater the change of variance and mean, the lower the SRW; thus, the change of the SRW can roughly reflect the packet loss in the network.