An unknown input sliding observer for anomaly detection in TCP/IP networks

This paper deals with the issue of anomaly detection in TCP/IP networks based on a control theory approach. Using a previously developed sliding mode observer, an improvement of the anomaly detection and reconstruction is proposed. More specifically, the ability of distinguishing false/true positives and false/true negatives in a prescribed finite time is ensured thanks to the design of an unknown input observer combined to some low pass filters. A high quality of service (QoS) is thus guaranteed to the network. To elucidate the proposed method, a network topology is then tested via Simulink as well as via the network simulator NS-2. Finally, detailed results analysis confirm the enhancement brought to the detection of an anomaly flowing through the network.