Sequential Change-point Detection Research Articles

Detection of Hijacking DDoS Attack Based on Air Interface Traffic

Massive machine type communication (mMTC) network contains massive access devices, which increases the risk of distributed denial of service (DDoS) attacks. Especially, the DDoS attack launched by hijacked devices cannot be detected through traditional cryptography-based authentication because that the hijacked devices have legitimate identities. In this letter, we propose to exploit the characteristics of access traffic at the air interface to detect this kind of DDoS attack, and then identify the suspicious devices. We analyze both the characteristics of access traffic based on MTC traffic arrival model and the random access mechanism proposed by 3GPP to construct test statistics, and propose a sequential change point detection (SCPD) scheme to test whether there are anomalies as quickly as possible. After that, we identify the hijacked devices based on the abnormal traffic. Simulation experiments confirm the effectiveness of our detection scheme.

Poisson QMLE for change-point detection in general integer-valued time series models

We consider together the retrospective and the sequential change-point detection in a general class of integer-valued time series. The conditional mean of the process depends on a parameter \(\theta ^*\) which may change over time. We propose procedures which are based on the Poisson quasi-maximum likelihood estimator of the parameter, and where the updated estimator is computed without the historical observations in the sequential framework. For both the retrospective and the sequential detection, the test statistics converge to some distributions obtained from the standard Brownian motion under the null hypothesis of no change and diverge to infinity under the alternative; that is, these procedures are consistent. Some results of simulations as well as real data application are provided.

Optimum Multi-Stream Sequential Change-Point Detection With Sampling Control

In multi-stream sequential change-point detection it is assumed that there are <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$M$ </tex-math></inline-formula> processes in a system and at some unknown time, an occurring event changes the distribution of the samples of a particular process. In this article, we consider this problem under a sampling control constraint when one is allowed, at each point in time, to sample a single process. The objective is to raise an alarm as quickly as possible subject to a proper false alarm constraint. We show that under sampling control, a simple myopic-sampling-based sequential change-point detection strategy is second-order asymptotically optimal when the number <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$M$ </tex-math></inline-formula> of processes is fixed. This means that the proposed detector, even by sampling with a rate <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$1/M$ </tex-math></inline-formula> of the full rate, enjoys the same detection delay, up to some additive finite constant, as the optimal procedure. Simulation experiments corroborate our theoretical results.

A holistic approach to power efficiency in a clock offset based Intrusion Detection Systems for Controller Area Networks

Controller Area Network (CAN) is an in-vehicle communication protocol, which provides an efficient and reliable communication link between Electronic Control Units (ECUs) in real time. Recent studies have shown that attackers can take remote control of the targeted vehicle by exploiting the vulnerabilities of the CAN protocol. Motivated by this fact, we propose an Intrusion Detection System (IDS), called Clock Offset-based IDS (COIDS), to monitor in-vehicle network activities to detect any intrusion. Precisely, COIDS measures and then exploits the clock offset of transmitter ECU’s clock for fingerprinting ECU. COIDS next leverages the derived fingerprints to construct a baseline of ECU’s normal clock behavior using an active learning technique. Based on the baseline of normal behavior, COIDS uses the Cumulative Sum method to detect any abnormal deviation in clock offset. Further, COIDS uses a sequential change-point detection technique to determine the exact time of intrusion. Generally, COIDS has to run on every ECU to monitor the network behavior. This can turn out to be a significant power overhead for a hardware-constrained ECU. Thus, we next develop a cooperative game model to optimize the active time duration of COIDS in an ECU. We performed exhaustive experiments on real world publicly available datasets primarily to assess the effectiveness of COIDS against a wide range of in-vehicle network attacks. Our results show that COIDS detects intrusions faster than the best performed IDS in the state-of-the-art. Further, the results show that our designed cooperative game model significantly reduces the power overhead of the ECU without compromising the performance.

An Asymptotic Theory of Joint Sequential Changepoint Detection and Identification for General Stochastic Models

The paper addresses a joint sequential changepoint detection and identification/isolation problem for a general stochastic model, assuming that the observed data may be dependent and non-identically distributed, the prior distribution of the change point is arbitrary, and the post-change hypotheses are composite. The developed detection–identification theory generalizes the changepoint detection theory developed by Tartakovsky (2019) to the case of multiple composite post-change hypotheses when one has not only to detect a change as quickly as possible but also to identify (or isolate) the true post-change distribution. We propose a multi-hypothesis change detection–identification rule and show that it is nearly optimal, minimizing moments of the delay to detection as the probability of a false alarm and the probabilities of misidentification go to zero.

Nonparametric sequential change-point detection for multivariate time series based on empirical distribution functions

The aim of sequential change-point detection is to issue an alarm when it is thought that certain probabilistic properties of the monitored observations have changed. This work is concerned with nonparametric, closed-end testing procedures based on differences of empirical distribution functions that are designed to be particularly sensitive to changes in the contemporary distribution of multivariate time series. The proposed detectors are adaptations of statistics used in a posteriori (offline) change-point testing and involve a weighting allowing to give more importance to recent observations. The resulting sequential change-point detection procedures are carried out by comparing the detectors to threshold functions estimated through resampling such that the probability of false alarm remains approximately constant over the monitoring period. A generic result on the asymptotic validity of such a way of estimating a threshold function is stated. As a corollary, the asymptotic validity of the studied sequential tests based on empirical distribution functions is proven when these are carried out using a dependent multiplier bootstrap for multivariate time series. Large-scale Monte Carlo experiments demonstrate the good finite-sample properties of the resulting procedures. The application of the derived sequential tests is illustrated on financial data.

Open-end nonparametric sequential change-point detection based on the retrospective CUSUM statistic

The aim of online monitoring is to issue an alarm as soon as there is significant evidence in the collected observations to suggest that the underlying data generating mechanism has changed. This work is concerned with open-end, nonparametric procedures that can be interpreted as statistical tests. The proposed monitoring schemes consist of computing the so-called retrospective CUSUM statistic (or minor variations thereof) after the arrival of each new observation. After proposing suitable threshold functions for the chosen detectors, the asymptotic validity of the procedures is investigated in the special case of monitoring for changes in the mean, both under the null hypothesis of stationarity and relevant alternatives. To carry out the sequential tests in practice, an approach based on an asymptotic regression model is used to estimate high quantiles of relevant limiting distributions. Monte Carlo experiments demonstrate the good finite-sample behavior of the proposed monitoring schemes and suggest that they are superior to existing competitors as long as changes do not occur at the very beginning of the monitoring. Extensions to statistics exhibiting an asymptotic mean-like behavior are briefly discussed. Finally, the application of the derived sequential change-point detection tests is succinctly illustrated on temperature anomaly data.

Optimal Sequential Detection of Signals With Unknown Appearance and Disappearance Points in Time

The paper addresses a sequential changepoint detection problem, assuming that the duration of change may be finite and unknown. This problem is of importance for many applications, e.g., for signal and image processing where signals appear and disappear at unknown points in time or space. In contrast to the conventional optimality criterion in quickest change detection that requires minimization of the expected delay to detection for a given average run length to a false alarm, we focus on a reliable maximin change detection criterion of maximizing the minimal probability of detection in a given time (or space) window for a given local maximal probability of false alarm in the prescribed window. We show that the optimal detection procedure is a modified CUSUM procedure. We then compare operating characteristics of this optimal procedure with popular in engineering the Finite Moving Average (FMA) detection algorithm and the ordinary CUSUM procedure using Monte Carlo simulations, which show that typically the later algorithms have almost the same performance as the optimal one. At the same time, the FMA procedure has a substantial advantage -- independence to the intensity of the signal, which is usually unknown. Finally, the FMA algorithm is applied to detecting faint streaks of satellites in optical images.

Sequential change point detection for high-dimensional data using nonconvex penalized quantile regression.

In this paper, a sequential change point detection method is developed to monitor structural change in smoothly clipped absolute deviation (SCAD) penalized quantile regression (SPQR) models. The asymptotic properties of the test statistic are derived from the null and alternative hypotheses. In order to improve the performance of the SPQR method, we propose a post-SCAD penalized quantile regression estimator (P-SPQR) for high-dimensional data. We examined the finite sample properties of the proposed methods via Monte Carlo studies under different scenarios. A real data application is provided to demonstrate the effectiveness of themethod.

Quickest change point detection with multiple postchange models

We study the sequential quickest change point detection for systems with multiple possible postchange models. A change point is the time instant at which the distribution of a random process changes. In many practical applications, the prechange model can be easily obtained, yet the postchange distribution is unknown due to the unexpected nature of the change. In this article, we consider the case that the postchange model is from a finite set of possible models. The objective is to minimize the average detection delay (ADD), subject to upper bounds on the probability of false alarm (PFA). Two different quickest change detection algorithms are proposed under Bayesian and non-Bayesian settings. Under the Bayesian setting, the prior probabilities of the change point and prior probabilities of possible postchange models are assumed to be known, yet this information is not available under the non-Bayesian setting. Theoretical analysis is performed to quantify the analytical performance of the proposed algorithms in terms of exact or asymptotic bounds on PFA and ADD. It is shown through theoretical analysis that when PFA is small, both algorithms are asymptotically optimal in terms of ADD minimization for a given PFA upper bound. Numerical results demonstrate that the proposed algorithms outperform existing algorithms in the literature.

Sequential change-point detection in a multinomial logistic regression model

Abstract Change-point detection in categorical time series has recently gained attention as statistical models incorporating change-points are common in practice, especially in the area of biomedicine. In this article, we propose a sequential change-point detection procedure based on the partial likelihood score process for the detection of changes in the coefficients of multinomial logistic regression model. The asymptotic results are presented under both the null of no change and the alternative of changes in coefficients. We carry out a Monte Carlo experiment to evaluate the empirical size of the proposed procedure as well as its average run length. We illustrate the method by using data on a DNA sequence. Monte Carlo experiments and real data analysis demonstrate the effectiveness of the proposed procedure.

Sequential subspace change point detection

We consider the online monitoring of multivariate streaming data for changes that are characterized by an unknown subspace structure manifested in the covariance matrix. In particular, we consider the covariance structure changes from an identity matrix to an unknown spiked covariance model. We assume the postchange distribution is unknown and propose two detection procedures: the largest-eigenvalue Shewhart chart and the subspace-cumulative sum (CUSUM) detection procedure. We present theoretical approximations to the average run length (ARL) and the expected detection delay (EDD) for the largest-eigenvalue Shewhart chart and provide analysis for tuning parameters of the subspace-CUSUM procedure. The performance of the proposed methods is illustrated using simulation and real data for human gesture detection and seismic event detection.

Self-Normalized Sequential Change-point Detection

Self-Normalized Sequential Change-point Detection

On the problems of sequential statistical inference for Wiener processes with delayed observations

We study the sequential hypothesis testing and quickest change-point (or disorder) detection problems with linear delay penalty costs for observable Wiener processes under (constantly) delayed detection times. The method of proof consists of the reduction of the associated delayed optimal stopping problems for one-dimensional diffusion processes to the equivalent free-boundary problems and solution of the latter problems by means of the smooth-fit conditions. We derive closed-form expressions for the Bayesian risk functions and optimal stopping boundaries for the associated weighted likelihood ratio processes in the original problems of sequential analysis.

Rapid sensing-based emergency detection: A sequential approach

The upsurge of smart devices has enabled the realization of safe, efficient smart cities that improve the quality of life of their citizens. A prevalent class of smart city services that are attracting increasing attention are Smart Emergency Response and Management (SERM) systems, where sensing paradigms such as crowd sensing and IoT-centric sensing are employed to facilitate the detection of, and response to a crisis situation. In this paper, we study the detection of an abnormal change in a monitored variable through crowd sensed and heterogeneous data, where the change is suggestive of an emergency situation. We formulate our problem as a sequential change-point detection problem, where the underlying distribution of the variable changes at an unknown time. We aim to detect the change-point with minimal delay, subject to a false alarm constraint. We utilize Shiryaev’s test to construct two variants of the solution depending on the structure of the received data contributions and mobility of participating sensing elements. We conduct simulations experiments to show the performance of these variants in terms of the delay-false alarm trade-off in different scenarios.

LPD Communication: A Sequential Change-Point Detection Perspective

In this paper, we establish a framework for low probability of detection (LPD) communication from a sequential change-point detection (SCPD) perspective, where a transmitter, Alice, wants to hide her signal transmission to a receiver, Bob, under the surveillance of an adversary, Willie. The new framework facilitates to model LPD communication and further evaluate its performance under the condition that Willie has no prior knowledge on when the transmission from Alice starts and that Willie wants to detect the existence of the communication as quickly as possible in real-time manner. We consider three different sequential tests for Willie, i.e., the Shewhart test, the cumulative sum (CUSUM) test, and the Shiryaev-Roberts (SR) test, to model the detection procedure. Communication is said to be covert if it stops before detection by Willie with high probability. Covert probability defined as the probability that Willie is not alerted during the communication procedure is investigated. We formulate an optimization problem aimed at finding the transmit power and transmission duration such that the total amount of information that can be transmitted is maximized subject to a high covert probability. Under Shewhart test, closed-form approximations of the optimal transmit power and transmission duration are derived, which well approximate the solutions obtained from exhaustive search. As for CUSUM and SR tests, we provide an effective algorithm to search the optimal solution. Numeric results are presented to show the performance of LPD communication.

Sequential change point detection in ARMA-GARCH models

ABSTRACTThis study investigates a sequential procedure to detect changes in the parameter of ARMA-GARCH models. Following the test procedure by Berkes et al. [Sequential change-point detection in GARCH(p,q) models. Econ Theory. 2004;20:1140–1167], we introduce a stopping time for monitoring procedure based on quasi-likelihood score function of ARMA-GARCH model. The asymptotic properties of the monitoring procedure are established under the null and alternative hypotheses. We demonstrate the validity of the test procedure through simulation study. A real data application is provided for illustration.

Sketching for sequential change-point detection

We present sequential change-point detection procedures based on linear sketches of high-dimensional signal vectors using generalized likelihood ratio (GLR) statistics. The GLR statistics allow for an unknown post-change mean that represents an anomaly or novelty. We consider both fixed and time-varying projections, derive theoretical approximations to two fundamental performance metrics: the average run length (ARL) and the expected detection delay (EDD); these approximations are shown to be highly accurate by numerical simulations. We further characterize the relative performance measure of the sketching procedure compared to that without sketching and show that there can be little performance loss when the signal strength is sufficiently large, and enough number of sketches are used. Finally, we demonstrate the good performance of sketching procedures using simulation and real-data examples on solar flare detection and failure detection in power networks.

A Likelihood Ratio Approach to Sequential Change Point Detection for a General Class of Parameters

In this article, we propose a new approach for sequential monitoring of a general class of parameters of a d-dimensional time series, which can be estimated by approximately linear functionals of the empirical distribution function. We consider a closed-end method, which is motivated by the likelihood ratio test principle and compare the new method with two alternative procedures. We also incorporate self-normalization such that estimation of the long-run variance is not necessary. We prove that for a large class of testing problems the new detection scheme has asymptotic level α and is consistent. The asymptotic theory is illustrated for the important cases of monitoring a change in the mean, variance, and correlation. By means of a simulation study it is demonstrated that the new test performs better than the currently available procedures for these problems. Finally, the methodology is illustrated by a small data example investigating index prices from the dot-com bubble. Supplementary materials for this article are available online.

Sequential change-point detection based on nearest neighbors

We propose a new framework for the detection of change-points in online, sequential data analysis. The approach utilizes nearest neighbor information and can be applied to sequences of multivariate observations or non-Euclidean data objects, such as network data. Different stopping rules are explored, and one specific rule is recommended due to its desirable properties. An accurate analytic approximation of the average run length is derived for the recommended rule, making it an easy off-the-shelf approach for real multivariate/object sequential data monitoring applications. Simulations reveal that the new approach has better performance than likelihood-based approaches for high dimensional data. The new approach is illustrated through a real dataset in detecting global structural changes in social networks.