2017/11/28 by Matthew Price-Williams, Price-Williams, Matthew, Nick Heard +1 · 1 citation
Computer Science · Physics and Astronomy · #Anomaly Detection Techniques and Applications #Applications (stat.AP) #Complex Network Analysis Techniques #FOS: Computer and information sciences #Network Security and Intrusion Detection
paper · pdf · doi:10.48550/arxiv.1711.10416
openalex publication_date 2017/11/28 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
This paper introduces a statistical model for the arrival times of connection events in a computer network. Edges between nodes in a network can be interpreted and modelled as point processes where events in the process indicate information being sent along that edge. A model of normal behaviour can be constructed for each edge in the network by identifying key network user features such as seasonality and self-exciting behaviour, where events typically arise in bursts at particular times of day. When monitoring the network in real time, unusual patterns of activity could indicate the presence of a malicious actor. Four different models for self-exciting behaviour are introduced and compared using data collected from the Imperial College and Los Alamos National Laboratory computer networks.