Collaborative Research: Optimal Changepoint Detection and Identification Algorithms with Applications

变点问题处理检测异常或更一般的模式变化。在顺序设置中，只要观察的行为与“正常状态”一致，人们就满足于让过程继续下去。如果状态改变，那么人们感兴趣的是检测改变是否有效，通常是尽可能快地检测。任何检测策略都可能引起错误警报，并且过于努力地试图避免错误警报将导致发生变化的时间与其检测之间的长时间延迟。变点问题的要点是产生一个检测策略，最大限度地减少平均检测延迟的虚警率上的约束。 虽然最快的变点检测问题已经研究了50多年，有显着很少的理论扩展到一般的随机模型，超越独立和同分布的观测值在前和后的变化模式，并分布式传感器设置之前的工作。该项目的目标是调查已知的变点检测程序的属性，并开发新的程序，在一般的系统模型，在实际应用中相关的变化检测和分类，以及提供一个分析框架，以预测其性能。将通过两个关键的应用领域证明理论进展的有用性：（a）迅速检测计算机网络的入侵和中断，（B）有效监测关键基础设施。在这两种情况下，噪声观测的分布发生变化，并且这种变化发生在先验未知的时间点。此外，在这两种情况下，检测都应该及时执行，同时将误报率保持在可接受的水平。我们的结果将使用模拟以及真实的数据（尽可能）进行验证。

Changepoint problems deal with detecting anomalies or more generally changes in patterns. In the sequential setting, as long as the behavior of observations is consistent with the ``normal state," one is content to let the process continue. If the state changes, then one is interested in detecting that a change is in effect, usually as quickly as possible. Any detection policy may give rise to false alarms and attempting to avoid false alarms too strenuously will lead to a long delay between the time of occurrence of the change and its detection. The gist of the changepoint problem is to produce a detection policy that minimizes the average detection delay subject to a bound on the false alarm rate. While the quickest changepoint detection problem has been studied for over fifty years, there has been remarkably little prior work on theoretical extensions to general stochastic models that go beyond independent and identically distributed observations in the pre- and post-change modes, and to the distributed sensor setting. The goal of this project is to investigate the properties of known changepoint detection procedures and to develop novel procedures for change detection and classification under general system models that are relevant in practical applications, as well as to provide an analytical framework to predict their performance. The usefulness of the theoretical advances will be demonstrated through two key application areas: (a) the rapid detection of intrusions and disruptions in computer networks, and (b) the efficient monitoring of critical infrastructures. In both cases, the distributions of the noisy observations change, and this change occurs at an a priori unknown point in time. Also, in both cases, the detection should be performed in a timely manner, while keeping the false alarm rate at an acceptable level. Our results will be validated using simulations as well as real data (to the extent possible).