基于流量统计特征的端口扫描检测算法

根据网络流量的统计特征提出一种慢速端口扫描行为检测算法，以主机数和端口数的比值及被访问主机端口集合之间的相似度为基础，采用非参数累积和CUSUM算法及小波变换方法对流量统计特征进行分析，进而判断是否存在端口扫描行为。实验结果表明，所提取的网络流量特征及算法可以有效地检测异常行为，该方法和Snort相比较具有低的漏报率和误报率。     

Computing the Percentage Points of the Run-Length Distributions of Multivariate CUSUM Control Charts

Multivariate CUSUM control charts are often used instead of the standard Hotelling's control charts in many practical problems when detection of small shifts in the process mean is important. However, design of multivariate CUSUM control charts are usually based on the average run length (ARL). In this work, we will compute the percentage points of the run-length distributions of two multivariate CUSUM control charts. It will be shown that interpretations based on ARL can be misleading since the in-control run-length distribution of a multivariate CUSUM is highly skewed. On the other hand, the percentage points of the run-length distribution provide additional information such as the median run length, early false out-of-control signals, and the skewness of the run-length distribution for a particular scheme. These extra information might provide quality control engineers further knowledge of a particular multivariate CUSUM control chart scheme.     

High Moment Partial Sum Processes of Residuals in ARMA Models and their Applications

Abstract. In this article, we study high moment partial sum processes based on residuals of a stationary autoregressive moving average (ARMA) model with known or unknown mean parameter. We show that they can be approximated in probability by the analogous processes which are obtained from the i.i.d. errors of the ARMA model. However, if a unknown mean parameter is used, there will be an additional term that depends on model parameters and a mean estimator. When properly normalized, this additional term will vanish. Thus the processes converge weakly to the same Gaussian processes as if the residuals were i.i.d. Applications to change‐point problems and goodness‐of‐fit are considered, in particular, cumulative sum statistics for testing ARMA model structure changes and the Jarque–Bera omnibus statistic for testing normality of the unobservable error distribution of an ARMA model.     

A note on the average run length of cumulative sum control charts for count data

This note presents preliminary results on the average run length (ARL) of a Cumulative Sum Control Chart (CUSUM) used to monitor defects or counts, when the count distribution is Neyman Type-A. The ARL for this distribution is contrasted to the more customary Poisson model for counts or defects. We show that the ARL curve of a Neyman Type-A CUSUM always lies below the ARL curve of a Poisson CUSUM.     

Tests for change—points based on recursive u—statistics

Tests for change—points for the location as well as regression models are often based on cumulative sums of recursive residuals. These recursive residuals are also employed in the sequential detection problem. In the context of general estimable parameters (funtionals of the underlying distribution functions), such recursive residuals may be defined in terms of recursive U—statistics. A class of tests for the change—points based on recursive U—statistics has been considered. Along with some invariance principles for recursive U—statistics, asymptotic properties of the proposed tests are studied.     

The Generalized Synthetic Chart

Abstract

The Generalized Synthetic chart is presented and mathematical expressions for its average run length and variance of the run length are developed. The methodology is applied to the EWMA and CUSUM charts and near-optimization procedures are discussed. The synthetic EWMA and CUSUM charts are compared with their standard counterparts, the original synthetic chart, and the Shewhart chart. Significant improvements in detecting power are reported.     

Testing for a break in persistence under long-range dependencies

Abstract.  We show that tests for a break in the persistence of a time series in the classical I (0)/ I (1) framework have serious size distortions when the actual data-generating process (DGP) exhibits long-range dependencies. We prove that the limiting distribution of a CUSUM of squares-based test depends on the true memory parameter if the DGP exhibits long memory. We propose adjusted critical values for the test and give finite sample response curves that allow easy implementation of the test by the practitioner and also ease in computing the relevant critical values. We furthermore prove the consistency of the test for a simple breakpoint estimator also under long memory. We show that the test has satisfying power properties when the correct critical values are used.     

Performance study of change-point detection thresholds for cumulative sum statistic in a sequential context

Sequential detection is based on a recursive statistic and a threshold it must reach to report a change. In this paper, we consider the score-based cumulative sum statistic and propose to evaluate the detection performance of some thresholds on simulated data. Three thresholds come from the literature: the Wald constant, the empirical constant, and the conditional empirical instantaneous threshold (the latter two are built by a simulation-based procedure). Two new thresholds are built by a simulation-based procedure: the first one is instantaneous, the second is a dynamical version of the previous one. The thresholds' performance measured by an estimation of the mean time between false alarm (MTBFA) and the average detection delay (ADD) are evaluated on independent and autocorrelated data for several scenario, according to the detection objective and the real change in the data. The simulations allow us to compare the difference between the thresholds' results and to see that their performances prove to be robust when a parameter of the prechange regime is misestimated or when the data independence assumption is violated. We found also that the conditional empirical threshold is the best at minimizing the detection delay while maintaining the given false alarm rate. However, on real data, we suggest to use the dynamic instantaneous threshold because it is the easiest to build for practical implementation.     

New control charts for monitoring the Weibull percentiles under complete data and Type‐II censoring

In this paper, we propose 3 new control charts for monitoring the lower Weibull percentiles under complete data and Type‐II censoring. In transforming the Weibull distribution to the smallest extreme value distribution, Pascaul et al (2017) presented an exponentially weighted moving average (EWMA) control chart, hereafter referred to as EWMA‐SEV‐Q, based on a pivotal quantity conditioned on ancillary statistics. We extended their concept to construct a cumulative sum (CUSUM) control chart denoted by CUSUM‐SEV‐Q. We provide more insights of the statistical properties of the monitoring statistic. Additionally, in transforming a Weibull distribution to a standard normal distribution, we propose EWMA and CUSUM control charts, denoted as EWMA‐YP and CUSUM‐YP, respectively, based on a pivotal quantity for monitoring the Weibull percentiles with complete data. With complete data, the EWMA‐YP and CUSUM‐YP control charts perform better than the EWMA‐SEV‐Q and CUSUM‐SEV‐Q control charts in terms of average run length. In Type‐II censoring, the EWMA‐SEV‐Q chart is slightly better than the CUSUM‐SEV‐Q chart in terms of average run length. Two numerical examples are used to illustrate the applications of the proposed control charts.     

Control Charts for Monitoring Correlated Poisson Counts with an Excessive Number of Zeros

The zero‐inflated Poisson distribution serves as an appropriate model when there is an excessive number of zeros in the data. This phenomenon frequently occurs in count data from high‐quality processes. Usually, it is assumed that these counts exhibit serial independence, while a more realistic assumption is the existence of an autocorrelation structure between them. In this work, we study control charts for monitoring correlated Poisson counts with an excessive number of zeros. Zero‐inflation in the process is captured via appropriate integer‐valued time series models. Extensive numerical results are provided regarding the performance of the considered charts in the detection of changes in the mean of the process as well as the effects of zero‐inflation on them. Finally, a real‐data practical application is given. Copyright © 2016 John Wiley & Sons, Ltd.