Statistical Anomaly Detection via Composite Hypothesis Testing for Markov Models
Statistical Anomaly Detection via Composite Hypothesis Testing for Markov Models
复制标题
DOI：
10.1109/tsp.2017.2771722
复制
发表时间：
2017-02
影响因子：
5.4
通讯作者：
Jing Zhang;I. Paschalidis
中科院分区：
文献类型：
--
作者：
Jing Zhang;I. Paschalidis
在马尔可夫假设下，利用复合假设Hoeffding检验的检验统计量的经验测度的中心极限定理，建立检验统计量的弱收敛结果，从而推导出检验所需阈值的一个新的估计量。我们首先通过大量的数值实验证明了我们的估计器比现有估计器的优点。我们发现我们的估计器在保持令人满意的检测概率的同时更好地控制了假警报。然后，我们用阈值估计器应用Hoeffding测试来检测两个不同应用领域中的异常：一个在通信网络中，另一个在运输网络中。前者旨在加强网络安全，后者旨在建设更智能的城市交通系统。
Under Markovian assumptions, we leverage a central limit theorem for the empirical measure in the test statistic of the composite hypothesis Hoeffding test so as to establish weak convergence results for the test statistic, and, thereby, derive a new estimator for the threshold needed by the test. We first show the advantages of our estimator over an existing estimator by conducting extensive numerical experiments. We find that our estimator controls better for false alarms while maintaining satisfactory detection probabilities. We then apply the Hoeffding test with our threshold estimator to detect anomalies in two distinct applications domains: One in communication networks and the other in transportation networks. The former application seeks to enhance cyber security and the latter aims at building smarter transportation systems in cities.