ATD: Efficient online detection based on multiple sensors, with applications to cybersecurity and discovery of biological threats

ATD：基于多个传感器的高效在线检测，应用于网络安全和生物威胁发现

• 批准号: 1322353
• 负责人: Michael Baron
• 金额: $ 39.25万
• 依托单位: University of Texas at Dallas
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2013
• 资助国家: 美国
• 起止时间: 2013-10-01 至 2015-04-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1322353&HistoricalAwards=false
• 关键词: ATD; Efficient; online; detection; based

The project focuses on threat detection schemes based on simultaneously observed multiple data sequences. The proper use of multiple sources of information, or multiple sensors, ensures high sensitivity of the detection procedure. However, multiple streams of diverse information can cause false alarms. What are the optimal statistical techniques of combining mixed types of data to yield a quick and error-free detection? Proposed statistical methods deal with potential threats by detecting heterogeneities and anomalies and locating change points in the distribution of multidimensional data. It is assumed that a number of sensors simultaneously collect and report data sequences. When a significant event occurs and a potential threat appears, the distribution of one or several sequences changes. The goal is to detect a threat as soon as possible, subject to a low rate of false alarms. Derivation of optimal threat detection algorithms on multiple sequences will be based on the recently developed theory and methodology of multiple comparisons in sequential experiments. These new techniques introduced by the PI and his student led to tests of multiple hypotheses that control both the familywise error rate and the familywise power at a low expected sampling cost. This suggests several approaches to the quick multi-sensor change-point detection. Analogues of CUSUM, Bayesian, and asymptotically pointwise optimal change-point detection tools will be developed based on the new methodology in order to control the probability of a false alarm, the missed discovery rate, and to minimize the mean detection delay under these constraints. Quick detection of threats by discovering changes in distributions, patterns, and trends is one of the most vital problems in quality control, market analysis, epidemiology, climatology, target tracking, and other fields. Among wide areas of application, this project particularly focuses on detecting breaches in cyber security and biological threats such as epidemics and bioterrorist attacks. The project will provide general tools for the prompt reaction to threatening anomalies in real situations such as (i) recognizing a pre-epidemic pattern and signalling an epidemic threat based on geospatial public health surveillance data in different regions, (ii) detecting computer threats and breaches in cyber security, based on multiple data streams, and (iii) detecting potential threats from extual analysis of communication networks. An important modern application of change-point detection on multiple data streams appears in DNA sequencing. The possibility of utilizing the prior information in sequential change-point analysis of multiple data streams opens doors for wide applications. It will allow to predict threats and make forecasts for a number of processes that exhibit a two-phase or multi-phase behavior, such as the epidemics and inter-epidemic periods, economic growth and recession, and spikes in energy prices. Developed methods of fast change-point detection will be used for the early detection of unknown targets and intrusions, fraud activity, unusual behavior at vital locations, detection and classification of pre-epidemic trends, and also, for the prevention of epidemics and terrorist attacks.

该项目的重点是基于同时观察到的多个数据序列的威胁检测方案。多个信息源或多个传感器的正确使用确保了检测程序的高灵敏度。然而，不同信息的多个流可能导致错误警报。什么是最佳的统计技术相结合的混合类型的数据，以产生一个快速和无错误的检测？提出的统计方法通过检测异质性和异常以及定位多维数据分布中的变化点来处理潜在的威胁。假设多个传感器同时收集和报告数据序列。当重大事件发生和潜在威胁出现时，一个或多个序列的分布发生变化。目标是尽快检测到威胁，并降低误报率。多序列最优威胁检测算法的推导将基于最近发展起来的序列实验中多重比较的理论和方法。PI和他的学生引入的这些新技术导致了多个假设的检验，这些假设以较低的预期抽样成本控制了家族错误率和家族功效。这提出了快速多传感器变化点检测的几种方法。类比的CANUM，贝叶斯，渐近逐点最优变点检测工具将开发基于新的方法，以控制误报的概率，错过的发现率，并尽量减少这些约束下的平均检测延迟。通过发现分布、模式和趋势的变化来快速检测威胁是质量控制、市场分析、流行病学、气候学、目标跟踪和其他领域中最重要的问题之一。在广泛的应用领域中，该项目特别侧重于检测网络安全漏洞和流行病和生物恐怖袭击等生物威胁。该项目将提供通用工具，以便对真实的情况下的威胁性异常情况作出迅速反应，例如：（一）根据不同区域的地理空间公共卫生监测数据，识别流行病前的模式并发出流行病威胁信号;（二）根据多个数据流，检测计算机威胁和网络安全漏洞;（三）通过对通信网络的外部分析，检测潜在威胁。多数据流上的变点检测的重要现代应用出现在DNA测序中。利用先验信息进行多数据流序贯变点分析的可能性为广泛的应用打开了大门。它将允许预测威胁，并对一些表现出两阶段或多阶段行为的过程进行预测，例如流行病和流行病期间，经济增长和衰退以及能源价格飙升。开发的快速变化点检测方法将用于早期检测未知目标和入侵、欺诈活动、重要地点的异常行为、流行病前趋势的检测和分类，以及预防流行病和恐怖袭击。