Nearly Optimal Change-Point Detection with an Application to Cybersecurity

Details Nearly Optimal Change-Point Detection with an Application to Cybersecurity Nearly Optimal Change-Point Detection with an Application to Cybersecurity

2012-02-13

arxiv.org/abs/1202.2849v2

Mathematics

Statistics Theory

minor typos and formatting issues fixed, 23 pages, submitted to Sequential Analysis

Scientific paper

We address the sequential change-point detection problem for the Gaussian model where baseline distribution is Gaussian with variance \sigma^2 and mean \mu such that \sigma^2=a\mu, where a>0 is a known constant; the change is in \mu from one known value to another. First, we carry out a comparative performance analysis of four detection procedures: the CUSUM procedure, the Shiryaev-Roberts (SR) procedure, and two its modifications - the Shiryaev-Roberts-Pollak and Shiryaev-Roberts-r procedures. The performance is benchmarked via Pollak's maximal average delay to detection and Shiryaev's stationary average delay to detection, each subject to a fixed average run length to false alarm. The analysis shows that in practically interesting cases the accuracy of asymptotic approximations is "reasonable" to "excellent". We also consider an application of change-point detection to cybersecurity - for rapid anomaly detection in computer networks. Using real network data we show that statistically traffic's intensity can be well-described by the proposed Gaussian model with \sigma^2=a\mu instead of the traditional Poisson model, which requires \sigma^2=\mu. By successively devising the SR and CUSUM procedures to "catch" a low-contrast network anomaly (caused by an ICMP reflector attack), we then show that the SR rule is quicker. We conclude that the SR procedure is a better cyber "watch dog" than the popular CUSUM procedure.

Affiliated with

Also associated with

No associations

Rating

Nearly Optimal Change-Point Detection with an Application to Cybersecurity does not yet have a rating. At this time, there are no reviews or comments for this scientific paper.

If you have personal experience with Nearly Optimal Change-Point Detection with an Application to Cybersecurity, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Nearly Optimal Change-Point Detection with an Application to Cybersecurity will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFWR-SCP-O-87822