2012/02/13 by Aleksey S. Polunchenko, Alexander G. Tartakovsky, Polunchenko, Aleksey S. +3
Decision Sciences · Engineering · Mathematics · #62L10 #62L15 #62P30 #Advanced Statistical Methods and Models #Advanced Statistical Process Monitoring #Applications (stat.AP) #FOS: Computer and information sciences #FOS: Mathematics #Fault Detection and Control Systems #Statistics Theory (math.ST)
paper · pdf · doi:10.48550/arxiv.1202.2849
openalex publication_date 2012/02/13 · openalex created_date 2016/06/24 · openalex updated_date 2026/07/28
We address the sequential change-point detection problem for the Gaussian model where baseline distribution is Gaussian with variance σ2 and mean μsuch that σ2=aμ, where a>0 is a known constant; the change is in μfrom one known value to another. First, we carry out a comparative performance analysis of four detection procedures: the CUSUM procedure, the Shiryaev-Roberts (SR) procedure, and two its modifications - the Shiryaev-Roberts-Pollak and Shiryaev-Roberts-r procedures. The performance is benchmarked via Pollak's maximal average delay to detection and Shiryaev's stationary average delay to detection, each subject to a fixed average run length to false alarm. The analysis shows that in practically interesting cases the accuracy of asymptotic approximations is "reasonable" to "excellent". We also consider an application of change-point detection to cybersecurity - for rapid anomaly detection in computer networks. Using real network data we show that statistically traffic's intensity can be well-described by the proposed Gaussian model with σ2=aμinstead of the traditional Poisson model, which requires σ2=μ. By successively devising the SR and CUSUM procedures to "catch" a low-contrast network anomaly (caused by an ICMP reflector attack), we then show that the SR rule is quicker. We conclude that the SR procedure is a better cyber "watch dog" than the popular CUSUM procedure.