{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,11]],"date-time":"2026-06-11T16:38:24Z","timestamp":1781195904995,"version":"3.54.1"},"reference-count":41,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2022,1,10]],"date-time":"2022-01-10T00:00:00Z","timestamp":1641772800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62003086"],"award-info":[{"award-number":["62003086"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Shanghai Pujiang Program","award":["21PJ1422000"],"award-info":[{"award-number":["21PJ1422000"]}]},{"name":"Guangdong Basic and Applied Basic Research Foundation","award":["2020A1515110148"],"award-info":[{"award-number":["2020A1515110148"]}]},{"name":"Heilongjiang Industrial Revitalization Major Project on Engineering and Science","award":["2019ZX02A01"],"award-info":[{"award-number":["2019ZX02A01"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>Dynamic traffic monitoring is a critical part of industrial communication network cybersecurity, which can be used to analyze traffic behavior and identify anomalies. In this paper, industrial networks are modeled by a dynamic fluid-flow model of TCP behavior. The model can be described as a class of systems with unmeasurable states. In the system, anomalies and normal variants are represented by the queuing dynamics of additional traffic flow (ATF) and can be considered as a disturbance. The novel contributions are described as follows: (1) a novel continuous terminal sliding-mode observer (TSMO) is proposed for such systems to estimate the disturbance for traffic monitoring; (2) in TSMO, a novel output injection strategy is proposed using the finite-time stability theory to speed up convergence of the internal dynamics; and (3) a full-order sliding-mode-based mechanism is developed to generate a smooth output injection signal for real-time estimations, which is directly used for anomaly detection. To verify the effectiveness of the proposed approach, the real traffic profiles from the Center for Applied Internet Data Analysis (CAIDA) DDoS attack datasets are used.<\/jats:p>","DOI":"10.3390\/sym14010124","type":"journal-article","created":{"date-parts":[[2022,1,10]],"date-time":"2022-01-10T22:03:13Z","timestamp":1641852193000},"page":"124","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":10,"title":["A Continuous Terminal Sliding-Mode Observer-Based Anomaly Detection Approach for Industrial Communication Networks"],"prefix":"10.3390","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7820-0107","authenticated-orcid":false,"given":"Long","family":"Xu","sequence":"first","affiliation":[{"name":"Key Laboratory of Measurement and Control of CSE, Ministry of Education, School of Automation, Southeast University, Nanjing 210096, China"},{"name":"3onedata Co., Ltd., Shenzhen 518055, China"},{"name":"3onedata Qitong Co., Ltd., Shanghai 201601, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wei","family":"Xiong","sequence":"additional","affiliation":[{"name":"Key Laboratory of Measurement and Control of CSE, Ministry of Education, School of Automation, Southeast University, Nanjing 210096, China"},{"name":"3onedata Co., Ltd., Shenzhen 518055, China"},{"name":"3onedata Qitong Co., Ltd., Shanghai 201601, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3616-1215","authenticated-orcid":false,"given":"Minghao","family":"Zhou","sequence":"additional","affiliation":[{"name":"School of Electrical and Electronic Engineering, Harbin University of Science and Technology, Harbin 150001, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1859-384X","authenticated-orcid":false,"given":"Lei","family":"Chen","sequence":"additional","affiliation":[{"name":"Advanced Research Institute of Multidisciplinary Science, Beijing Institute of Technology, Beijing 100081, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2022,1,10]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1109\/MCOM.2018.1700621","article-title":"A multi-level DDoS mitigation framework for the industrial internet of things","volume":"56","author":"Yan","year":"2018","journal-title":"IEEE Commun. Mag."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Sarker, I.H., Abushark, Y.B., Alsolami, F., and Khan, A.I. (2020). Intrudtree: A machine learning based cyber security intrusion detection model. Symmetry, 12.","DOI":"10.20944\/preprints202004.0481.v1"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Zegzhda, D., Lavrova, D., Pavlenko, E., and Shtyrkina, A. (2020). Cyber attack prevention based on evolutionary cybernetics approach. Symmetry, 12.","DOI":"10.3390\/sym12111931"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"31","DOI":"10.1109\/JSYST.2013.2294120","article-title":"Data-stream-based intrusion detection system for advanced metering infrastructure in smart grid: A feasibility study","volume":"9","author":"Faisal","year":"2015","journal-title":"IEEE Syst. J."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"1092","DOI":"10.1109\/TPWRD.2014.2300099","article-title":"Multiattribute SCADA-specific intrusion detection system for power networks","volume":"29","author":"Yang","year":"2014","journal-title":"IEEE Trans. Power Del."},{"key":"ref_6","unstructured":"Skybakmoen, T. (2014). Next Generation Firewall Comparative Analysis- Security, NSS Labs."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"2623","DOI":"10.1109\/TAC.2010.2069350","article-title":"Design of sliding mode control subject to packet losses","volume":"55","author":"Niu","year":"2010","journal-title":"IEEE Trans. Autom. Control"},{"key":"ref_8","first-page":"3701","article-title":"Security defense module of Modbus TCP communication based on region\/enclave rules","volume":"35","author":"Zhang","year":"2014","journal-title":"Comput. Eng. Des."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"151","DOI":"10.1145\/347057.347421","article-title":"Fluid-based analysis of a network of AQM routers supporting TCP flows with an application to RED","volume":"30","author":"Misra","year":"2000","journal-title":"Comput. Commun. Rev."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"255","DOI":"10.1109\/TNSM.2009.04.090405","article-title":"Feedback control for router management and TCP\/IP network stability","volume":"6","author":"Ariba","year":"2009","journal-title":"IEEE Trans. Netw. Service Manag."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"945","DOI":"10.1109\/TAC.2002.1008360","article-title":"Analysis and design of controllers for AQM routers supporting TCP flows","volume":"47","author":"Hollot","year":"2002","journal-title":"IEEE Trans. Autom. Control"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"506","DOI":"10.1049\/iet-cta.2009.0477","article-title":"Traffic monitoring in transmission control protocol\/active queue management networks through a time-delay observer","volume":"6","author":"Ariba","year":"2012","journal-title":"IET Control Theory Appl."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"1201","DOI":"10.1109\/TFUZZ.2018.2873971","article-title":"Observer-based event-triggered adaptive decentralized fuzzy control for nonlinear large-scale systems","volume":"27","author":"Cao","year":"2018","journal-title":"IEEE Trans. Fuzzy Syst."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Wang, Y., Xie, X., Chadli, M., Xie, S., and Peng, Y. (2020). Sliding mode control of fuzzy singularly perturbed descriptor systems. IEEE Trans. Fuzzy Syst., early access.","DOI":"10.1109\/TFUZZ.2020.2998519"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"5647","DOI":"10.1109\/TIE.2019.2931517","article-title":"Finite-time continuous terminal sliding mode control of servo motor systems","volume":"67","author":"Hou","year":"2020","journal-title":"IEEE Trans. Ind. Electron."},{"key":"ref_16","unstructured":"Hou, H., Yu, X., and Fu, Z. (2020). Sliding-mode control of uncertain time-varying systems with state delays: A non-negative constraints approach. IEEE Trans. Syst. Man, Cybern. Syst., early access."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"1043","DOI":"10.1109\/TPEL.2020.3000785","article-title":"An Improved Adaptive Sliding Mode Observer for Middle- and High-Speed Rotor Tracking","volume":"36","author":"Xu","year":"2021","journal-title":"IEEE Trans. Power Electron."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"5913","DOI":"10.1109\/TIE.2019.2952824","article-title":"An improved delay-suppressed sliding-mode observer for sensorless vector-controlled PMSM","volume":"67","author":"Gong","year":"2021","journal-title":"IEEE Trans. Ind. Electron."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"1933","DOI":"10.1109\/TAC.2016.2588885","article-title":"Adaptive Sliding-Mode Control of Markov Jump Nonlinear Systems with Actuator Faults","volume":"62","author":"Li","year":"2017","journal-title":"IEEE Trans. Autom. Control"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"1667","DOI":"10.1109\/TSMC.2017.2720968","article-title":"Sliding Mode Control of Fuzzy Singularly Perturbed Systems With Application to Electric Circuit","volume":"48","author":"Wang","year":"2018","journal-title":"IEEE Trans. Syst. Man, Cybern. Syst."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Rahme, S., Labit, Y., and Gouaisbaut, F. (2009, January 20\u201325). Sliding mode observer for anomaly detection in TCP\/AQM networks. Proceedings of the IEEE Second International Conference on Communication Theory, Reliability, and Quality of Service (CTRQ\u20192009), Colmar, France.","DOI":"10.1109\/CTRQ.2009.18"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1031","DOI":"10.1109\/TCST.2012.2198648","article-title":"Sliding modes for anomaly observation in TCP networks: From theory to practice","volume":"21","author":"Rahme","year":"2013","journal-title":"IEEE Trans. Control Syst. Technol."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"1808","DOI":"10.1109\/TMECH.2019.2928642","article-title":"Discrete-time terminal sliding-mode tracking control with alleviated chattering","volume":"24","author":"Hou","year":"2019","journal-title":"IEEE ASME Trans. Mechatron"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Hou, H., Yu, X., and Fu, Z. (2021). Sliding mode control of networked control systems: An auxiliary matrices-based approach. IEEE Trans. Autom. Control, early access.","DOI":"10.1109\/TAC.2021.3103882"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"4733","DOI":"10.1109\/TAC.2019.2904435","article-title":"Reduced-Order Sliding-Mode-Observer-Based Fault Estimation for Markov Jump Systems","volume":"64","author":"Yang","year":"2019","journal-title":"IEEE Trans. Autom. Control"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Chen, S., Zhang, X., Wu, X., Tan, G., and Chen, X. (2019). Sensorless Control for IPMSM Based on Adaptive Super-Twisting Sliding-Mode Observer and Improved Phase-Locked Loop. Energies, 12.","DOI":"10.3390\/en12071225"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Zheng, W., Xia, B., Wang, W., Lai, Y., Wang, M., and Wang, H. (2019). State of Charge Estimation for Power Lithium-Ion Battery Using a Fuzzy Logic Sliding Mode Observer. Energies, 12.","DOI":"10.3390\/en12132491"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"993","DOI":"10.1002\/rnc.3051","article-title":"High-gain observers in nonlinear feedback control","volume":"24","author":"Khalil","year":"2014","journal-title":"Int. J. Robust. Nonlinear Control."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"842","DOI":"10.1002\/asjc.934","article-title":"Active disturbance rejection control of a magnetic suspension system","volume":"17","year":"2015","journal-title":"Asian J. Control"},{"key":"ref_30","first-page":"842","article-title":"Disturbance observer for estimating higher order disturbances in time series expansion","volume":"17","author":"Kim","year":"2015","journal-title":"IEEE Trans. Autom. Control"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"751","DOI":"10.1137\/S0363012997321358","article-title":"Finite-time stability of continuous autonomous systems","volume":"38","author":"Bhat","year":"2000","journal-title":"SIAM J. Control Optim."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"371","DOI":"10.1016\/j.automatica.2006.08.015","article-title":"Delay-range-dependent stability for systems with time-varying delay","volume":"43","author":"He","year":"2007","journal-title":"Automatica"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"127","DOI":"10.1016\/j.comcom.2018.02.007","article-title":"The Industrial Internet of Things as an enabler for a Circular Economy Hy-LP: A novel IIoT protocol, evaluated on a wind park\u2019s SDN\/NFV-enabled 5G industrial network","volume":"119","author":"Hatzivasilis","year":"2018","journal-title":"Comput. Commun."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"6","DOI":"10.1109\/MNET.2003.1248656","article-title":"Packet level traffic measurements from the sprint IP backbone","volume":"17","author":"Chuck","year":"2003","journal-title":"IEEE Netw."},{"key":"ref_35","unstructured":"Jacobson, V., and Braden, R.T. (2020, May 17). TCP extensions for long-delay paths. Network Working Group Request for Comments: 1072. Available online: https:\/\/www.rfc-editor.org\/info\/rfc1072."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"281","DOI":"10.1145\/1030194.1015499","article-title":"Sizing router buffers","volume":"34","author":"Appenzeller","year":"2004","journal-title":"Comput. Commun. Rev."},{"key":"ref_37","unstructured":"Stevens, W. (2020, May 17). TCP slow start, congestion avoidance, fast retransmit, and fast recovery algorithms. Network Working Group Request for Comments: 2001. Available online: https:\/\/datatracker.ietf.org\/doc\/html\/rfc2001."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"2159","DOI":"10.1016\/S0005-1098(02)00147-4","article-title":"Non-singular terminal sliding mode control of rigid manipulators","volume":"38","author":"Feng","year":"2002","journal-title":"Automatica"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"1310","DOI":"10.1016\/j.automatica.2014.01.004","article-title":"Chattering free full-order sliding-mode control","volume":"50","author":"Feng","year":"2014","journal-title":"Automatica"},{"key":"ref_40","unstructured":"(2020, May 17). The CAIDA UCSD \u201cDDoS Attack 2007\u201d Dataset. Available online: https:\/\/www.caida.org\/data\/passive\/ddos-20070804_dataset.xml."},{"key":"ref_41","unstructured":"Hollot, C.V., Misra, V., Towsley, D., and Gong, W. (2001, January 24\u201326). On designing improved controllers for AQM routers supporting TCP flows. Proceedings of the IEEE INFOCOM\u2019 2001, Anchorage, AK, USA."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/14\/1\/124\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,13]],"date-time":"2025-10-13T14:01:52Z","timestamp":1760364112000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/14\/1\/124"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,1,10]]},"references-count":41,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2022,1]]}},"alternative-id":["sym14010124"],"URL":"https:\/\/doi.org\/10.3390\/sym14010124","relation":{},"ISSN":["2073-8994"],"issn-type":[{"value":"2073-8994","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,1,10]]}}}