Network anomaly estimation for TCP/AQM networks using an observer

Abstract—Network anomaly detection is an active researcharea in network community. Researchers have approached thisproblem using various techniques such as artiﬁcial intelligence,machine learning, state machine modeling, statistical approaches.The purpose of this preliminary work is to design an observerfor network anomaly estimation for TCP/AQM (TransmissionControl Protocol/Active Queue Management) networks usingtime delay system approach. Collaborating an observer with anAQM, constant anomalies considered as perturbations for thenetwork can be detected. We illustrate the effectiveness of res ultsvia SIMULINK and the NS-2 simulator.Keywords: Network anomaly detection, Observer, AQM, Timedelay system. I. M OTIVATIONS Network anomalies typically refer to circumstances whennetwork operations deviate from normal network behavior.Detecting anomalies such as malfunctioning network devices,network overload, ﬂash crowds, worms, port scans, riskyinternal user behavior, malicious denial of service attacks(DoS), network intrusions that disrupt the normal deliveryof network services has become an important key issue forthe network community. Such anomalies can be found at anytime in the trafﬁc and degrade Quality of Service (QoS) ofthe network: congestion at ﬁrst, then non-responsive routersand even worse. Network anomalies (in sense that there is adeviation from the normal network condition) can be roughlyclassiﬁed into two categories. The ﬁrst category is related tonetwork failures and performance problems (like ﬁle serverfailures, broadcast storms, etc.). The second major categoryof network anomalies is security-related problems (like DoSor DDoS detections) in detecting active security threats. Avariety of tools and techniques exists to detect anomaliesmainly based on information theory called IDS (IntrusionDetection Systems) and ADS (Anomaly Detection Systems). They both look for ”bad things” on a system or network,things that may be potential security incidents. An IDS usesa deﬁned set of rules or ﬁlters that have been crafted to catcha speciﬁc, malicious event. IDS are based on two principaltechniques to detect the anomalies/intrusions of the trafﬁ c:First, the use of signatures i.e. of speciﬁc formats of packa gesor particular successions of packages giving place to the attack.This technique is not well adapted to the detection of thevariations of the trafﬁc which has not a particular signatur e(like ﬂash crowd or of DDoS without signature). Secondly,the use of statistical proﬁles of the trafﬁc can be used. Butnowadays, approaches which used the statistics are mainlylimited to ﬁrst order (average and standard deviation). Thevery strong natural variability of the trafﬁc [1] produced astrong ﬂuctuation of these measurements, thus inducing ver yhigh level of false positives (false alarms) and false negatives(missed detections). Recent studies take into account a richerform of the statistical structure of the trafﬁc (correlatio n,spectral density .) [2], [3], [4], [5], [6]. An ADS, on theother hand, operates only from a baseline of normal activity.As described above, behavior that varies from this standardis noted. While an IDS looks mainly for a misuse signature,the ADS looks for a strange event which leads to unapprovednetwork changes.In this paper, we propose to design an observer in the timedelay systems framework for the anomalies detection. Themain advantage of this technique is that we avoid the problemof false positives/negatives appeared in statistical approaches.The observer synthesis is based on a linearized ﬂuid ﬂowmodel of the TCP/AQM behaviour. Consequently, an AQMregulating the queue size of the router buffer is required toensure the relevance of the observer. Hence, the observer mustbe associated to an AQM to perform its diagnosis. Note thattaking into account the drop probability ﬁxed by the AQM, thedetecting mechanism is independent of the former (as long asthe AQM is able to regulate the queue size at a prescribedlevel). The paper is organized as follows. The second part presentsthe problem statement introducing the model of a network sup-porting TCP and AQM for congestion control. Then, sectionIII is dedicated to the observer design for the detection andthe estimation of anomalies. Section IV presents application ofthe exposed theory and simulation results using SIMULINKand NS-2 (see [7]). Finally, Section V concludes the paper.Notations: For two symmetric matrices, A and B, A > (≥)B means that A−B is (semi-) positive deﬁnite. A