A Nonparametric Cusum Algorithm for Timeslot Sequences with Applications to Network Surveillance

Abstract

We adapt the classic cusum change-point detection algorithm for applications to data network monitoring where various and numerous performance and reliability metrics are available to aid with early identification of realized or impending failures. Three significant challenges that must be overcome are: 1) the need for a nonparametric technique so that a wide variety of metrics (including discrete metrics) can be included in the monitoring process, 2) the need to handle time varying distributions for the metrics that reflect natural cycles in work load and traffic patterns, and 3) the need to be computationally efficient with data processing of the massive number of metrics that are available from IT environments.

Statistical Techniques for Detecting Cyberattacks on Computer Networks Based on an Analysis of Abnormal Traffic Behavior

“…If the Y distribution is unknown, logarithmical verisimilitude correspondence s(y t ) needed to be replaced by statistical characteristics u(y t ) with comparable features: average value u(y) need to be negative to H 0 and positive after H 1 . Such method also could be named CUSUM nonparametric algorithm [18]. an Analysis of Abnormal Traffic Behavior Copyright © 2020 MECS I.J.…”

“…Computer Network and Information Security, 2020, 6, 1-13 and to save herewith false alerts rank (FAR) on the low level. CUMSUM nonparametrical multidimentional algorithm has several ostensive advantages [18]. Firstly, it uses minimum of available data that is very important, because of the permanent distribution (legitimate traffic) and changed (attack) traffic, usually, are not known beforehand.…”