Nearly Optimal Change-Point Detection with an Application to Cybersecurity
From MaRDI portal
Abstract: We address the sequential change-point detection problem for the Gaussian model where baseline distribution is Gaussian with variance sigma^2 and mean mu such that sigma^2=amu, where a>0 is a known constant; the change is in mu from one known value to another. First, we carry out a comparative performance analysis of four detection procedures: the CUSUM procedure, the Shiryaev-Roberts (SR) procedure, and two its modifications - the Shiryaev-Roberts-Pollak and Shiryaev-Roberts-r procedures. The performance is benchmarked via Pollak's maximal average delay to detection and Shiryaev's stationary average delay to detection, each subject to a fixed average run length to false alarm. The analysis shows that in practically interesting cases the accuracy of asymptotic approximations is "reasonable" to "excellent". We also consider an application of change-point detection to cybersecurity - for rapid anomaly detection in computer networks. Using real network data we show that statistically traffic's intensity can be well-described by the proposed Gaussian model with sigma^2=amu instead of the traditional Poisson model, which requires sigma^2=mu. By successively devising the SR and CUSUM procedures to "catch" a low-contrast network anomaly (caused by an ICMP reflector attack), we then show that the SR rule is quicker. We conclude that the SR procedure is a better cyber "watch dog" than the popular CUSUM procedure.
Recommendations
- Optimal change-point detection and localization
- Asymptotically optimal methods of early change-point detection
- Optimal detection of changepoints with a linear computational cost
- Detection of intrusions in information systems by sequential change-point methods
- Asymptotic Optimality of Change-Point Detection Schemes in General Continuous-Time Models
- On the optimality of Bayesian change-point detection
- Sequential Change-Point Detection Procedures That are Nearly Optimal and Computationally Simple
- Single and multiple change-point detection with differential privacy
- scientific article; zbMATH DE number 1916873
- A computationally efficient nonparametric approach for changepoint detection
Cited in
(11)- Bayesian Models Applied to Cyber Security Anomaly Detection Problems
- Cusum techniques for timeslot sequences with applications to network surveillance
- A method of cumulative sums in the problem of detection of traffic changes in computer networks
- Sequential negative binomial problems and statistical ecology: a selected review with new directions
- Sequential estimation for the multiple linear regression models with balanced loss functions
- Efficient performance evaluation of the generalized Shiryaev-Roberts detection procedure in a multi-cyclic setup
- Detecting changes in real-time data: a user's guide to optimal detection
- Sequential algorithms for moving anomaly detection in networks
- Asymptotic Nash equilibrium for sequential change detection in adversarial environments
- Detection of intrusions in information systems by sequential change-point methods
- On robustness of the Shiryaev-Roberts change-point detection procedure under parameter misspecification in the post-change distribution
This page was built for publication: Nearly Optimal Change-Point Detection with an Application to Cybersecurity
Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q3165898)
