Wavelet based Denial-of-Service detection

Network Denial-of-Service (DoS) attacks that disable network services by flooding them with spurious packets are on the rise. Criminals with large networks (botnets) of compromised nodes (zombies) use the threat of DoS attacks to extort legitimate companies. To fight these threats and ensure network reliability, early detection of these attacks is critical. Many methods have been developed with limited success to date. This paper presents an approach that identifies change points in the time series of network packet arrival rates. The proposed process has two stages: (i) statistical analysis that finds the rate of increase of network traffic, and (ii) wavelet analysis of the network statistics that quickly detects the sudden increases in packet arrival rates characteristic of botnet attacks.Most intrusion detections are tested using data sets from special security testing configurations, which leads to unacceptable false positive rates being found when they are used in the real world. We test our approach using data from both network simulations and a large operational network. The true and false positive detection rates are determined for both data sets, and receiver operating curves use these rates to find optimal parameters for our approach. Evaluation using operational data proves the effectiveness of our approach.     

An Evaluation of the Crosier's CUSUM Control Chart with Estimated Parameters

We evaluate the performance of the Crosier's cumulative sum (C‐CUSUM) control chart when the probability distribution parameters of the underlying quality characteristic are estimated from Phase I data. Because the average run length (ARL) under estimated parameters is a random variable, we study the estimation effect on the chart performance in terms of the expected value of the average run length (AARL) and the standard deviation of the average run length (SDARL). Previous evaluations of this control chart were conducted while assuming known process parameters. Using the Markov chain and simulation approaches, we evaluate the in‐control performance of the chart and provide some quantiles for its in‐control ARL distribution under estimated parameters. We also compare the performance of the C‐CUSUM chart to that of the ordinary CUSUM (O‐CUSUM) chart when the process parameters are unknown. Our results show that large number of Phase I samples are required to achieve a quite reasonable performance. Additionally, the performance of the C‐CUSUM chart is found to be superior to that of the O‐CUSUM chart. Finally, we recommend the use of a recently proposed bootstrap procedure in designing the C‐CUSUM chart to guarantee, at a certain probability, that the in‐control ARL will be of at least the desired value using the available amount of Phase I data. Copyright © 2015 John Wiley & Sons, Ltd.     

Effective Control Charts for Monitoring the NGINAR(1) Process

In recent years, there has been a growing interest in the control of autocorrelated count data. Existing results focus on the Poisson integer‐valued autoregressive (INAR) process, but this process cannot deal with overdispersion (variance is greater than mean), which is a common phenomenon in count data. We propose to control the autocorrelated count data based on a new geometric INAR (NGINAR) process, which is an alternative to the Poisson one. In this paper, we use the combined jumps chart, the cumulative sum chart, and the combined exponentially weighted moving average chart to detect the shift of parameters in the process. We compare the performance of these charts for the case of an underlying NGINAR(1) process in terms of the average run lengths. One real example is presented to demonstrate good performances of the charts. Copyright © 2015 John Wiley & Sons, Ltd.     

A New Combined Shewhart–Cumulative Sum S Chart for Monitoring Process Standard Deviation

The combined application of a Shewhart chart and cumulative sum (CUSUM) control chart is an effective tool for the detection of all sizes of process shifts as the scheme combines the advantages of a CUSUM at detecting small to moderate shifts and Shewhart for the quick detection of very large shifts. This article proposes new combined Shewhart–CUSUM S charts based on the extreme variations of ranked set sampling technique, for efficient monitoring of changes in the process dispersion. Using Monte Carlo simulations, the combined scheme is designed to minimize the average extra quadratic loss over the entire process shift domain. The results show that the combined Shewhart–CUSUM S charts uniformly outperform several other procedures for detecting increases and decreases in the process variability. Moreover, the proposed scheme can detect changes that are small enough to escape the Shewhart S chart or fairly large to escape detection by the CUSUM S chart. Numerical example is given to illustrate the practical application of the proposed scheme using real industrial data. Copyright © 2015 John Wiley & Sons, Ltd.     

Adaptive nonparametric CUSUM scheme for detecting unknown shifts in location

In this paper, we provide a sequential rank-based adaptive nonparametric cumulative sum control chart for detecting a range of shifts in the location parameter. This chart is a self-starting scheme, and thus can be used to monitor processes at the start-up stages rather than having to wait for the accumulation of sufficiently large calibration samples. It does not require any prior knowledge of the underlying distribution. The choice of the chart parameters is studied and a simulation study demonstrates that the proposed control chart not only performs robustly for different distributions, but also efficiently detects various magnitudes of shifts. An illustrative example is also given to introduce the implementation of this proposed control chart.     

Discussion

In this discussion, we give a short overview of some of the uses of artificial neural networks in practice. This is not intended to be an exhaustive list, but it includes some widely used industrial examples with which we are familiar. From our experience, we also attempt to point out why they are used and what the relative advantages and disadvantages of using a neural network over a traditional statistical method might be.     

Detecting Change Points by Fourier Analysis

The cumulative sum (CUSUM) is a basic diagnostic tool in the analysis of change-point data. It is shown that Fourier analysis of the CUSUM can be a useful supplementary tool in such analyses. The technique is applied to three data sets that have appeared previously in the statistical literature.     

Development of a real-time non-intrusive appliance load monitoring system: An application level model

The research “Behavior Change and Energy Use” (US Department of Energy and Climate Change, 2011) [1] shows that with better information in the monthly electricity bill, the Energy Performance Certificate (EPC) can encourage people to reduce their energy usage. That is why smart meters - the emerging technology to help people to know their monthly energy consumption, are gradually replacing mechanical power meters. In this paper, we investigate a special energy monitoring process named Non-Intrusive Appliance Load Monitoring (NIALM), which is potentially the best method to give consumers pertinent information with respect to power consumption. However, real-time feedback feature in a low cost NIALM system is still a big challenge in such technology because of the complication in NIALM’s algorithms. System on Chip (SoC) technology can solve this challenge. Besides including high-speed interconnection and multi-processors, integrating Field-Programmable Gate Array (FPGA) into SoCs may be the most important evolution, which provides developers a powerful tool to develop a low cost but high performance system. Therefore, in this paper we proposed a development of a real-time NIALM system based on the SoC with FPGA acceleration.     

平稳过程趋势项变点的CUSUM检验

对平稳过程趋势项中的变点检测问题,基于最小二乘估计残差构造CUSUM型统计量.同时,在原假设下得到了其渐近分布,在备择假设下证明了该检验的容许性.蒙特卡罗数值模拟表明,文中所给检验在检验趋势项系数变点时具有较好的势,且犯第一类错误的概率较小.