Invariant Properties and Bounds on a Finite Time Consensus Algorithm

Abstract

Finite time consensus algorithms compute consensus values exactly and in a finite number of steps, contrasting with asymptotic consensus algorithms. In the literature, there exists few approaches deriving finite time convergence for discrete consensus algorithms. In this paper we focus on an analysis of finite time convergence based on the observability matrix for consensus networks. We introduce analytical results extending the applicability of network observability theory to consensus and other distributed algorithms. New analytical bounds on the number of steps to compute consensus are provided as well as counterexamples which are disproving a conjecture on the minimum of steps to compute consensus. A polynomial time algorithm is described to calculate empirically the exact number of steps to compute consensus values. We have implemented a consensus-based network intrusion detection system based on the observability matrix approach of consensus networks. This implementation validates empirically our analytical results. We also compare the performance of the finite time consensus with an implementation of the same intrusion detection system using asymptotic consensus. Although the finite time algorithm provides exact solutions, tests show that it needs less iterations to obtain a consensus solution.

Appendix

Network intrusion detection systems monitor computer network infrastructures, seeking to identify malicious intends through the analysis of network traffic. Typically detection is broken down into two phases: an observation phase where network traffic information is collected and an analysis phase where the observed traffic is analyzed and categorized into benign or malignant network traffic. Traffic observation is performed through sensors that collect information about specific features of network traffic. As today’s computer networks are quite large, composed of several heterogeneous sub-networks, traffic observation often needs to be done distributively with sensors placed at different strategic locations. Figure 3 exemplifies this situation, showing sensors distributed across a supervised network, where each sensor is in charge of observing the local traffic of a sub-network.

Fig. 3.

Topology of a network intrusion detection system.

Typically, in a large computer network, sensors are doing more than simply observing local traffic in sub-networks, they also perform analysis of the local sub-network traffic. In that case, sensors are full scale sensing and analytical devices. As traffic analysis is performed at the level of each sensor, local traffic can be classified and remedial actions can be taken if an intrusive behavior is detected. However, in some cases, a certain degree of aggregation of local analysis results can be helpful to address for example attacks from concurrent sources such as distributed denial of service (DDoS), to develop network wide coordinated responses to attacks or simply to increase the detection accuracy of each local analysis based on information from other sub-networks. If data aggregation is a key component of an intrusion detection system then this component must be designed to maintain the survivability and robustness of the system. Consensus algorithms are a relevant choice in this context as they provide protocols to compute aggregation functions in a completely distributed manner, eliminating issues such as single point of failure and others related to centralized computing of network data.

Toulouse et al. [18] have introduced a network intrusion detection system in which aggregation and fusion of local traffic analysis is computed distributively using an average consensus algorithm. In order to accomplish this task, sensors communicate with each other through what we call a consensus network. In Fig. 3, the consensus network is a ring network linking the four sensor nodes. While exchanging information with their neighbors in the consensus network, nodes repeatedly average a sum of values representing their diagnostic about the state of the local traffic as well as the diagnostic of their neighbors. Through local averaging, sensors approximate a consensus value which is used as measurement of some relevant network wide state of the monitored network system.