arXiv subjects

Alexander G. Tartakovsky

Publications and source records attributed to Alexander G. Tartakovsky.

29 records · Page 2Linked to original sources

arXiv2012

Efficient Computer Network Anomaly Detection by Changepoint Detection Methods

We consider the problem of efficient on-line anomaly detection in computer network traffic. The problem is approached statistically, as that of sequential (quickest) changepoint detection. A multi-cyclic setting of quickest change detection is a natural fit for this problem. We propose a novel score-based multi-cyclic detection algorithm. The algorithm is based on the so-called Shiryaev-Roberts procedure. This procedure is as easy to employ in practice and as computationally inexpensive as the popular Cumulative Sum chart and the Exponentially Weighted Moving Average scheme. The likelihood ratio based Shiryaev-Roberts procedure has appealing optimality properties, particularly it is exactly optimal in a multi-cyclic setting geared to detect a change occurring at a far time horizon. It is therefore expected that an intrusion detection algorithm based on the Shiryaev-Roberts procedure will perform better than other detection schemes. This is confirmed experimentally for real traces. We also discuss the possibility of complementing our anomaly detection algorithm with a spectral-signature intrusion detection system with false alarm filtering and true attack confirmation capability, so as to obtain a synergistic system.

stat.AP↗

arXiv2012

On optimality of the Shiryaev-Roberts procedure for detecting a change in distribution

In 1985, for detecting a change in distribution, Pollak introduced a specific minimax performance metric and a randomized version of the Shiryaev-Roberts procedure where the zero initial condition is replaced by a random variable sampled from the quasi-stationary distribution of the Shiryaev-Roberts statistic. Pollak proved that this procedure is third-order asymptotically optimal as the mean time to false alarm becomes large. The question of whether Pollak's procedure is strictly minimax for any false alarm rate has been open for more than two decades, and there were several attempts to prove this strict optimality. In this paper, we provide a counterexample which shows that Pollak's procedure is not optimal and that there is a strictly optimal procedure which is nothing but the Shiryaev-Roberts procedure that starts with a specially designed deterministic point.

math.ST↗

arXiv2012

Nearly Minimax One-Sided Mixture-Based Sequential Tests

We focus on one-sided, mixture-based stopping rules for the problem of sequential testing a simple null hypothesis against a composite alternative. For the latter, we consider two cases---either a discrete alternative or a continuous alternative that can be embedded into an exponential family. For each case, we find a mixture-based stopping rule that is nearly minimax in the sense of minimizing the maximal Kullback-Leibler information. The proof of this result is based on finding an almost Bayes rule for an appropriate sequential decision problem and on high-order asymptotic approximations for the performance characteristics of arbitrary mixture-based stopping times. We also evaluate the asymptotic performance loss of certain intuitive mixture rules and verify the accuracy of our asymptotic approximations with simulation experiments.

math.ST↗

arXiv2012

Nearly Optimal Change-Point Detection with an Application to Cybersecurity

We address the sequential change-point detection problem for the Gaussian model where baseline distribution is Gaussian with variance σ^2 and mean μsuch that σ^2=aμ, where a>0 is a known constant; the change is in μfrom one known value to another. First, we carry out a comparative performance analysis of four detection procedures: the CUSUM procedure, the Shiryaev-Roberts (SR) procedure, and two its modifications - the Shiryaev-Roberts-Pollak and Shiryaev-Roberts-r procedures. The performance is benchmarked via Pollak's maximal average delay to detection and Shiryaev's stationary average delay to detection, each subject to a fixed average run length to false alarm. The analysis shows that in practically interesting cases the accuracy of asymptotic approximations is "reasonable" to "excellent". We also consider an application of change-point detection to cybersecurity - for rapid anomaly detection in computer networks. Using real network data we show that statistically traffic's intensity can be well-described by the proposed Gaussian model with σ^2=aμinstead of the traditional Poisson model, which requires σ^2=μ. By successively devising the SR and CUSUM procedures to "catch" a low-contrast network anomaly (caused by an ICMP reflector attack), we then show that the SR rule is quicker. We conclude that the SR procedure is a better cyber "watch dog" than the popular CUSUM procedure.

math.ST↗

arXiv2011

State-of-the-Art in Sequential Change-Point Detection

We provide an overview of the state-of-the-art in the area of sequential change-point detection assuming discrete time and known pre- and post-change distributions. The overview spans over all major formulations of the underlying optimization problem, namely, Bayesian, generalized Bayesian, and minimax. We pay particular attention to the latest advances in each. Also, we link together the generalized Bayesian problem with multi-cyclic disorder detection in a stationary regime when the change occurs at a distant time horizon. We conclude with two case studies to illustrate the cutting edge of the field at work.

math.ST↗

arXiv2011

Third-order Asymptotic Optimality of the Generalized Shiryaev-Roberts Changepoint Detection Procedures

Several variations of the Shiryaev-Roberts detection procedure in the context of the simple changepoint problem are considered: starting the procedure at $R_0=0$ (the original Shiryaev-Roberts procedure), at $R_0=r$ for fixed $r>0$, and at $R_0$ that has a quasi-stationary distribution. Comparisons of operating characteristics are made. The differences fade as the average run length to false alarm tends to infinity. It is shown that the Shiryaev-Roberts procedures that start either from a specially designed point $r$ or from the random "quasi-stationary" point are order-3 asymptotically optimal.

math.ST↗

arXiv2009

A Numerical Approach to Performance Analysis of Quickest Change-Point Detection Procedures

For the most popular sequential change detection rules such as CUSUM, EWMA, and the Shiryaev-Roberts test, we develop integral equations and a concise numerical method to compute a number of performance metrics, including average detection delay and average time to false alarm. We pay special attention to the Shiryaev-Roberts procedure and evaluate its performance for various initialization strategies. Regarding the randomized initialization variant proposed by Pollak, known to be asymptotically optimal of order-3, we offer a means for numerically computing the quasi-stationary distribution of the Shiryaev-Roberts statistic that is the distribution of the initializing random variable, thus making this test applicable in practice. A significant side-product of our computational technique is the observation that deterministic initializations of the Shiryaev-Roberts procedure can also enjoy the same order-3 optimality property as Pollak's randomized test and, after careful selection, even uniformly outperform it.

stat.CO↗

arXiv2009

Numerical Comparison of Cusum and Shiryaev-Roberts Procedures for Detecting Changes in Distributions

The CUSUM procedure is known to be optimal for detecting a change in distribution under a minimax scenario, whereas the Shiryaev-Roberts procedure is optimal for detecting a change that occurs at a distant time horizon. As a simpler alternative to the conventional Monte Carlo approach, we propose a numerical method for the systematic comparison of the two detection schemes in both settings, i.e., minimax and for detecting changes that occur in the distant future. Our goal is accomplished by deriving a set of exact integral equations for the performance metrics, which are then solved numerically. We present detailed numerical results for the problem of detecting a change in the mean of a Gaussian sequence, which show that the difference between the two procedures is significant only when detecting small changes.

stat.CO↗

arXiv2007

On Optimality Properties of the Shiryaev-Roberts Procedure

We consider the simple changepoint problem setting, where observations are independent, iid pre-change and iid post-change, with known pre- and post-change distributions. The Shiryaev-Roberts detection procedure is known to be asymptotically minimax in the sense of minimizing maximal expected detection delay subject to a bound on the average run length to false alarm, as the latter goes to infinity. Here we present other optimality properties of the Shiryaev-Roberts procedure.

math.ST↗

arXiv2007

Asymptotic Exponentiality of the Distribution of First Exit Times for a Class of Markov Processes with Applications to Quickest Change Detection

We consider the first exit time of a nonnegative Harris-recurrent Markov process from the interval $[0,A]$ as $A\to\infty$. We provide an alternative method of proof of asymptotic exponentiality of the first exit time (suitably standardized) that does not rely on embedding in a regeneration process. We show that under certain conditions the moment generating function of a suitably standardized version of the first exit time converges to that of $\Exp(1)$, and we connect between the standardizing constant and the quasi-stationary distribution (assuming it exists). The results are applied to the evaluation of a distribution of run length to false alarm in change-point detection problems.

math.PR↗

arXiv2006

Asymptotic Optimality in Bayesian Change-Point Detection Problems Under Global False Alarm Probability Constraint

In 1960s Shiryaev developed Bayesian theory of change detection in independent and identically distributed (i.i.d.) sequences. In Shiryaev's classical setting the goal is to minimize an average detection delay under the constraint imposed on the average probability of false alarm. Recently, Tartakovsky and Veeravalli (2005) developed a general Bayesian asymptotic change-point detection theory (in the classical setting) that is not limited to a restrictive i.i.d. assumption. It was proved that Shiryaev's detection procedure is asymptotically optimal under traditional average false alarm probability constraint, assuming that this probability is small. In the present paper, we consider a less conventional approach where the constraint is imposed on the global, supremum false alarm probability. An asymptotically optimal Bayesian change detection procedure is proposed and thoroughly evaluated for both i.i.d. and non-i.i.d. models when the global false alarm probability approaches zero.

math.ST↗