Collaborative Research: Optimal Changepoint Detection and Identification Algorithms with Applications

变点问题处理的是检测模式中的异常或更一般的变化。在顺序设置中，只要观察的行为与“正常状态”一致，就满足于让这一过程继续下去。如果状态发生更改，则通常会尽可能快地检测更改是否生效。任何检测策略都可能导致错误警报，而过于努力地试图避免错误警报将导致发生变化的时间与检测到的时间之间的较长延迟。变点问题的要点是产生一种检测策略，使平均检测延迟在虚警率上界的约束下最小化。虽然最快的变点检测问题已经被研究了50多年，但在一般随机模型的理论扩展方面的工作却非常少，这些模型超越了变化前和变化后模式下的独立和同分布观测，以及分布式传感器设置。本项目的目标是研究已知变点检测程序的特性，开发在实际应用中相关的一般系统模型下的变化检测和分类的新程序，并提供一个分析框架来预测其性能。这些理论进步的作用将通过两个关键应用领域得到证明：(A)对计算机网络的入侵和破坏进行快速检测；(B)对关键基础设施进行有效监测。在这两种情况下，噪声观测值的分布都发生了变化，并且这种变化发生在一个先验未知的时间点。此外，在这两种情况下，都应该及时进行检测，同时将误警率保持在可接受的水平。我们的结果将使用模拟和真实数据(在可能的范围内)进行验证。

Changepoint problems deal with detecting anomalies or more generally changes in patterns. In the sequential setting, as long as the behavior of observations is consistent with the ``normal state," one is content to let the process continue. If the state changes, then one is interested in detecting that a change is in effect, usually as quickly as possible. Any detection policy may give rise to false alarms and attempting to avoid false alarms too strenuously will lead to a long delay between the time of occurrence of the change and its detection. The gist of the changepoint problem is to produce a detection policy that minimizes the average detection delay subject to a bound on the false alarm rate. While the quickest changepoint detection problem has been studied for over fifty years, there has been remarkably little prior work on theoretical extensions to general stochastic models that go beyond independent and identically distributed observations in the pre- and post-change modes, and to the distributed sensor setting. The goal of this project is to investigate the properties of known changepoint detection procedures and to develop novel procedures for change detection and classification under general system models that are relevant in practical applications, as well as to provide an analytical framework to predict their performance. The usefulness of the theoretical advances will be demonstrated through two key application areas: (a) the rapid detection of intrusions and disruptions in computer networks, and (b) the efficient monitoring of critical infrastructures. In both cases, the distributions of the noisy observations change, and this change occurs at an a priori unknown point in time. Also, in both cases, the detection should be performed in a timely manner, while keeping the false alarm rate at an acceptable level. Our results will be validated using simulations as well as real data (to the extent possible).