Sliding Modes for Anomaly Observation in TCP Networks: From Theory to Practice

Anomaly detection has been an active open problem in the networks community for several years. In this brief, we aim at detecting such abnormal signals by control theory techniques. Several classes of sliding mode observers are proposed for a fluid flow model of the transmission control protocol (TCP)/internet protocol network. Comparative simulations via network simulator NS-2 show the enhancement brought by a higher order sliding mode observer. The efficiency of this observer opens the way toward observing traffics with real TCP flow characteristics. To achieve this end, trace replay techniques for TCP traffic traces are presented. Finally, experiments lead to successful anomaly estimation under real traffic conditions.