Based on the info above, please answer this quesion $-$ Does detecting illegitimate TCP state sequences fit into the network traffic analysis patterns? Yes, it is a step which comes after the one where it is determined whether there is anomalous network traffic. No$,$ it is irrelevant. Yes, the two terms are in fact synonymous. Yes, it is the step where it is determined whether there is anomalous network traffic.