Yann Labit

Feedback control for router management and TCP/IP network stability

Several works have established links between congestion control in communication networks and feedback control theory. In this paper, following this paradigm, the design of an AQM (active queue management) ensuring the stability of the congestion phenomenon at a router is proposed. To this end, a modified fluid flow model of TCP (transmission control protocol) that takes into account all delays of the topology is introduced. Then, appropriate tools from control theory are used to address the stability issue and to cope with the time-varying nature of the multiple delays. More precisely, the design of the AQM is formulated as a structured state feedback for multiple time delay systems through the quadratic separation framework. The objective of this mechanism is to ensure the regulation of the queue size of the congested router as well as flow rates to a prescribed level. Furthermore, the proposed methodology allows to set arbitrarily the QoS (quality of service) of the communications following through the controlled router. Finally, a numerical example and some simulations support the exposed theory.

Evaluation of active measurement tools for bandwidth estimation in real environment

Available bandwidth - as well as capacity or achievable bandwidth - on a path or a link is one of the very important parameters to measure or estimate in a network: it is of high interest for many networking functions (routing, admission and congestion control, load balancing, etc). Active probing techniques provide the easiest and the more flexible approach, for estimating available bandwidth. In addition, they can be used for different network technologies or structures. Many techniques and tools for available bandwidth estimation appeared recently, but little attention has been given to the accuracy of the estimated values in the real Internet, most of previous studies focusing on validating the accuracy of these tools on local platform. Therefore, this paper deals with evaluating the accuracy of active estimation tools in the real wide area Internet. We use passive monitoring tools for this purpose. We then built a platform combining active and passive equipments, and define a methodology for evaluating active probing techniques using passive tools. The passive evaluation relies on DAG system cards that represent references for such kind of measurements. This paper then discusses the results we got in the different experiments with different tools. In particular, we use traffic generators for changing the characteristics of the traffic on the Internet paths, which we are making our measurements on. It is useful for analyzing the accuracy of active estimation tools according to network and traffic conditions.

An energy-efficient clock synchronization protocol for Wireless Sensor Networks

The behavior of Wireless Sensor Networks (WSN) is nowadays widely analyzed. One of the most important issues is related to their energy consumption, as this has a major impact on the network lifetime. Another important application requirement is to ensure data sensing synchronization, which leads to additional energy consumption as a high number of messages is sent and received at each node. Our proposal consists in implementing a combined synchronization protocol based on the IEEE 1588 standard that was designed for wired networks and the PBS (Pairwise Broadcast Synchronization) protocol that was designed for sensor networks, as none of them is able to provide the needed synchronization accuracy for our application on its own. The main goals of our new synchronization protocol are: to ensure the accuracy of local clocks up to a tenth of a microsecond and to provide an important energy saving. Our results obtained using NS-2 (Network Simulator) show that the performance of our solution (IEEE 1588-PBS) matches our application requirements with regard to the synchronization, with a significant improvement in energy saving.

An unknown input sliding observer for anomaly detection in TCP/IP networks

This paper deals with the issue of anomaly detection in TCP/IP networks based on a control theory approach. Using a previously developed sliding mode observer, an improvement of the anomaly detection and reconstruction is proposed. More specifically, the ability of distinguishing false/true positives and false/true negatives in a prescribed finite time is ensured thanks to the design of an unknown input observer combined to some low pass filters. A high quality of service (QoS) is thus guaranteed to the network. To elucidate the proposed method, a network topology is then tested via Simulink as well as via the network simulator NS-2. Finally, detailed results analysis confirm the enhancement brought to the detection of an anomaly flowing through the network.

Sliding Mode Observer for Anomaly Detection in TCP/AQM Networks

In recent years, traffic monitoring and especially anomaly estimation have constituted an open problem in the network community. This paper proposes to design an observer-based sliding mode control for time delay systems representing TCP fluid flow model. The main advantage of the sliding observer lies in estimating, in a finite time, system states while exhibiting fundamental robustness against perturbation signals like attacks or more generally anomalies. Fault is then reconstructed from the observer dynamics using smoothing techniques. The feasibility of the proposed method is studied via Simulink.

An efficient and lightweight method for Service Level Agreement assessment

Traditional approaches to on-line end-to-end Service Level Agreement (SLA) assessment have focused on the estimation of network QoS parameters. These approaches, however, face a trade-off between accuracy and the amount of resources needed to achieve such accuracy. This paper offers an alternative approach, where instead of estimating QoS parameters, we propose an effective and lightweight solution for directly detecting SLA violations. Our solution monitors the Inter-Packet Arrival Time (IPAT) at an end-point, wherein current IPAT distributions are periodically compared with a set of reference IPAT distributions as the main basis for detecting SLA violations. A mapping of the IPAT distribution with the current network conditions is derived, and a training algorithm that dynamically acquires the set of reference IPAT distributions is designed. For the comparison of the IPAT distributions, we propose a variant of the Hausdorff Distance algorithm. Our variant provides a better accuracy than the traditional Hausdorff Distance, while presenting linear complexity. Our proposal is validated in a real testbed, by comparing the SLA violations detected and the resources required in terms of bandwidth, with other existing alternatives as well as with perfect knowledge of current network QoS status.

Sliding Modes for Anomaly Observation in TCP Networks: From Theory to Practice

Anomaly detection has been an active open problem in the networks community for several years. In this brief, we aim at detecting such abnormal signals by control theory techniques. Several classes of sliding mode observers are proposed for a fluid flow model of the transmission control protocol (TCP)/internet protocol network. Comparative simulations via network simulator NS-2 show the enhancement brought by a higher order sliding mode observer. The efficiency of this observer opens the way toward observing traffics with real TCP flow characteristics. To achieve this end, trace replay techniques for TCP traffic traces are presented. Finally, experiments lead to successful anomaly estimation under real traffic conditions.

On designing Lyapunov-Krasovskii based AQM for routers supporting TCP flows

For the last few years, we assist to a growing interest of designing AQM (active queue management) using control theory. In this paper, we focus on the synthesis of an AQM based on the Lyapunov theory for time delay systems. With the help of a recently developed Lyapunov-Krasovskii functional and using a state space representation of a linearized fluid model of TCP, two robust AQMs stabilizing the TCP model are constructed. Notice that our results are constructive and the synthesis problem is reduced to a convex optimization scheme expressed in terms of linear matrix inequalities (LMIs). Finally, an example extracted from the literature and simulations via NS simulator [Fall, K., et al., www.isi.edu/nsnam/ns/] support our study.

HIDDEN: Hausdorff Distance Based Intrusion Detection Approach DEdicated to Networks

DoS attacks represent a big threat for the Internet. While most of attack detection techniques are based on passive monitoring of traffic, we propose a detection method, HIDDEN, based on active measurements, the objective being to make possible the real-time detection and classification of DoS attacks, without intrusive probing. The originality of our contribution relies on the use of the entropy function computed from probabilities of time series of measured ICMP request/echo delays. However, the evaluation of the method exhibits a dramatic number of false positives. It has then been enriched by the use of the Hausdorff distance on probabilities of time series, which significantly decreases the number of false positives. In addition, a method for discriminating ICMP attacks from others (TCP/UDP attacks) using icmp_seq has been added. Experiments for evaluating the effectiveness of the approach have been run on the French operational RENATER network, on which artificial attacks have been generated using TFN2K [14]. Results exhibit that TCP, UDP and ICMP DoS attacks have been accurately detected in less than 1 second.

Design and Performance Evaluation of a State-Space Based AQM

Recent research has shown the link between congestion control in communication networks and feedback control system. In this paper, the design of an active queue management (AQM) which can be viewed as a controller, is considered. Based on a state space representation of a linearized fluid flow model of TCP, the AQM design is converted to a state feedback synthesis problem for time delay systems. Finally, an example extracted from the literature and simulations via a network simulator NS (under cross traffic conditions) support our study.