An Improved Composite Hypothesis Test for Markov Models with Applications in Network Anomaly Detection

2015/09/05 by Jing Zhang, Ioannis Ch. Paschalidis, Zhang, Jing +1
Computer Science · Physics and Astronomy · #Bayesian Modeling and Causal Inference #Complex Network Analysis Techniques #FOS: Computer and information sciences #FOS: Electrical engineering #Information Theory (cs.IT) #Network Security and Intrusion Detection #Systems and Control (eess.SY) #electronic engineering #information engineering

paper · pdf · doi:10.48550/arxiv.1509.01706

openalex publication_date 2015/09/05 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/01

Abstract

Recent work has proposed the use of a composite hypothesis Hoeffding test for statistical anomaly detection. Setting an appropriate threshold for the test given a desired false alarm probability involves approximating the false alarm probability. To that end, a large deviations asymptotic is typically used which, however, often results in an inaccurate setting of the threshold, especially for relatively small sample sizes. This, in turn, results in an anomaly detection test that does not control well for false alarms. In this paper, we develop a tighter approximation using the Central Limit Theorem (CLT) under Markovian assumptions. We apply our result to a network anomaly detection application and demonstrate its advantages over earlier work.

Citations

• The Large-Sample Distribution of the Likelihood Ratio for Testing Composite Hypotheses
• Sharp asymptotics of large deviations in ℝ d

Related

• Robust Anomaly Detection in Dynamic Networks
• Size-Consistent Statistics for Anomaly Detection in Dynamic Networks
• Network Anomaly Detection: A Survey and Comparative Analysis of Stochastic and Deterministic Methods
• Active Hypothesis Testing for Quickest Anomaly Detection
• A Cooperative Statistical Approach for Abnormal Node Detection with Adversary Resistance