Network anomaly estimation for TCP/AQM networks using an observer

Abstract—Network anomaly detection is an active researcharea in network community. Researchers have approached thisproblem using various techniques such as artificial intelligence,machine learning, state machine modeling, statistical approaches.The purpose of this preliminary work is to design an observerfor network anomaly estimation for TCP/AQM (TransmissionControl Protocol/Active Queue Management) networks usingtime delay system approach. Collaborating an observer with anAQM, constant anomalies considered as perturbations for thenetwork can be detected. We illustrate the effectiveness of res ultsvia SIMULINK and the NS-2 simulator.Keywords: Network anomaly detection, Observer, AQM, Timedelay system. I. M OTIVATIONS Network anomalies typically refer to circumstances whennetwork operations deviate from normal network behavior.Detecting anomalies such as malfunctioning network devices,network overload, flash crowds, worms, port scans, riskyinternal user behavior, malicious denial of service attacks(DoS), network intrusions that disrupt the normal deliveryof network services has become an important key issue forthe network community. Such anomalies can be found at anytime in the traffic and degrade Quality of Service (QoS) ofthe network: congestion at first, then non-responsive routersand even worse. Network anomalies (in sense that there is adeviation from the normal network condition) can be roughlyclassified into two categories. The first category is related tonetwork failures and performance problems (like file serverfailures, broadcast storms, etc...). The second major categoryof network anomalies is security-related problems (like DoSor DDoS detections) in detecting active security threats. Avariety of tools and techniques exists to detect anomaliesmainly based on information theory called IDS (IntrusionDetection Systems) and ADS (Anomaly Detection Systems).They both look for ”bad things” on a system or network,things that may be potential security incidents. An IDS usesa defined set of rules or filters that have been crafted to catcha specific, malicious event. IDS are based on two principaltechniques to detect the anomalies/intrusions of the traffi c:First, the use of signatures i.e. of specific formats of packa gesor particular successions of packages giving place to the attack.This technique is not well adapted to the detection of thevariations of the traffic which has not a particular signatur e(like flash crowd or of DDoS without signature). Secondly,the use of statistical profiles of the traffic can be used. Butnowadays, approaches which used the statistics are mainlylimited to first order (average and standard deviation). Thevery strong natural variability of the traffic [1] produced astrong fluctuation of these measurements, thus inducing ver yhigh level of false positives (false alarms) and false negatives(missed detections). Recent studies take into account a richerform of the statistical structure of the traffic (correlatio n,spectral density ...) [2], [3], [4], [5], [6]. An ADS, on theother hand, operates only from a baseline of normal activity.As described above, behavior that varies from this standardis noted. While an IDS looks mainly for a misuse signature,the ADS looks for a strange event which leads to unapprovednetwork changes.In this paper, we propose to design an observer in the timedelay systems framework for the anomalies detection. Themain advantage of this technique is that we avoid the problemof false positives/negatives appeared in statistical approaches.The observer synthesis is based on a linearized fluid flowmodel of the TCP/AQM behaviour. Consequently, an AQMregulating the queue size of the router buffer is required toensure the relevance of the observer. Hence, the observer mustbe associated to an AQM to perform its diagnosis. Note thattaking into account the drop probability fixed by the AQM, thedetecting mechanism is independent of the former (as long asthe AQM is able to regulate the queue size at a prescribedlevel).The paper is organized as follows. The second part presentsthe problem statement introducing the model of a network sup-porting TCP and AQM for congestion control. Then, sectionIII is dedicated to the observer design for the detection andthe estimation of anomalies. Section IV presents application ofthe exposed theory and simulation results using SIMULINKand NS-2 (see [7]). Finally, Section V concludes the paper.Notations: For two symmetric matrices, A and B, A > (≥)B means that A−B is (semi-) positive definite. A