Cusum techniques for timeslot sequences with applications to network surveillance
Computational Statistics & Data Analysis
Journal of Systems and Software
| Hi-index | 0.00 |
In network surveillance it is important to detect anomalous activity as quickly as possible, and ideally before a major problem develops. Four algorithms are proposed for change-point detection in a univariate setting. Two algorithms modify a classic cusum change-point detection algorithm developed for identically and independently distributed observations. The other two algorithms use Brownian motion theory to simplify threshold calculations. In order to monitor data exhibiting cyclical patterns that do not follow a known distribution, the proposed algorithms evaluate incoming observations using nonparametric techniques and take into account time varying distributions. The algorithms will account for this timeslot non-stationarity in the data by utilizing historical samples of observations within each timeslot. The proposed solution includes an on-line screening feature that fully automates the implementation of the algorithm and eliminates the need for manual oversight up until the point where root cause analysis begin. A fault injection study compares the performance of each algorithm and a real data example illustrates the application.