Convergence of Probability Measures. By P. Billingsley. Chichester, Sussex, Wiley, 1968. xii, 253 p. 9 1/4“. 117s.

Convergence of Probability Measures

The literature on nonparametric or distribution-free control charts for univariate variables data is examined. The advantages of these charts have over more traditional distribution-based control charts are demonstrated. Constructive criticism of the li..

Nonparametric Control Charts: An Overview and Some Results

Large-scale computer network attacks in their final stages can readily be identified by observing very abrupt changes in the network traffic. In the early stage of an attack, however, these changes are hard to detect and difficult to distinguish from usual traffic fluctuations. Rapid response, a minimal false-alarm rate, and the capability to detect a wide spectrum of attacks are the crucial features of intrusion detection systems. In this paper, we develop efficient adaptive sequential and batch-sequential methods for an early detection of attacks that lead to changes in network traffic, such as denial-of-service attacks, worm-based attacks, port-scanning, and man-in-the-middle attacks. These methods employ a statistical analysis of data from multiple layers of the network protocol to detect very subtle traffic changes. The algorithms are based on change-point detection theory and utilize a thresholding of test statistics to achieve a fixed rate of false alarms while allowing us to detect changes in statistical models as soon as possible. There are three attractive features of the proposed approach. First, the developed algorithms are self-learning, which enables them to adapt to various network loads and usage patterns. Secondly, they allow for the detection of attacks with a small average delay for a given false-alarm rate. Thirdly, they are computationally simple and thus can be implemented online. Theoretical frameworks for detection procedures are presented. We also give the results of the experimental study with the use of a network simulator testbed as well as real-life testing for TCP SYN flooding attacks

/pdf/a-novel-approach-to-detection-of-intrusions-in-computer-2a4thdbq0c.pdf

A novel approach to detection of intrusions in computer networks via adaptive sequential and batch-sequential change-point detection methods

The analysis of data streams requires methods which can cope with a very high volume of data points. Under the requirement that algorithms must have constant computational complexity and a fixed amount of memory, we develop a framework for detecting changes in data streams when the distributional form of the stream variables is unknown. We consider the general problem of detecting a change in the location and/or scale parameter of a stream of random variables, and adapt several nonparametric hypothesis tests to create a streaming change detection algorithm. This algorithm uses a test statistic with a null distribution independent of the data. This allows a desired rate of false alarms to be maintained for any stream even when its distribution is unknown. Our method is based on hypothesis tests which involve ranking data points, and we propose a method for calculating these ranks online in a manner which respects the constraints of data stream analysis.

Nonparametric Monitoring of Data Streams for Changes in Location and Scale

Nonparametric statistical procedures for the changepoint problem

We consider sequential observation of independent random variables $X_1,\cdots, X_N$ whose distribution changes from $F$ to $G$ after the first $\lbrack N\theta \rbrack$ variables. The object is to detect the unknown change-point quickly without too many false alarms. A nonparametric control chart based on partial weighted sums of sequential ranks is proposed. It is shown that if the change from $F$ to $G$ is small, then as $N \rightarrow \infty$, the appropriately scaled and linearly interpolated graph of partial rank sums converges to a Brownian motion on which a drift sets in at time $\theta$. Using this, the asymptotic performance of the one-sided control chart is compared with one based on partial sums of the $X$'s. Location change, scale change and contamination are considered. It is found that for distributions with heavy tails, the control chart based on ranks stops more frequently and faster than the one based on the $X$'s. Performance of the two procedures are also tested on simulated data and the outcomes are compatible with the theoretical results.

/pdf/a-nonparametric-control-chart-for-detecting-small-disorders-mixgiuzef1.pdf

P. K. Bhattacharya

Papers

A Nonparametric Control Chart for Detecting Small Disorders