Nonstationary Network Traffic Diagnosis Under Correlation Context

• Activity Number: 358
• Type: Contributed
• Date/Time: Tuesday, August 2, 2011 : 10:30 AM to 12:20 PM
• Sponsor: Section on Quality and Productivity
• Author(s): Yingzhuo Fu*+ and Daniel R. Jeske
• Companies: University of California at Riverside and University of California at Riverside
• Keywords: non-stationary ; correlated data ; GLMM

Abstract

Streams of network data are usually correlated, both in short time periods and also in longer time periods. Network data also exhibits non-stationary in the mean structure, frequently with discernable diurnal patterns for example. Data structures of this type present challenges when trying to use standard change-point detection algorithm. We employ a Generalized Linear Mixed Model (GLMM) to model the correlation with embedded random effects, and we capture non-stationarity in the mean structure with fixed effects. The GLMM paradigm also allows the response variable , which is often counts, to be modeled directly. The key step in our modeling process is building the baseline GLMM using historical cycles of the data streams. Conditional on the predicted future realization of the random effects, the data are independent and potential sample paths for future data can be simulated. A transformed CUSUM tracking statistics is then used to detect changes. A control limit is chosen according to a specific false alarm rate. We will illustrate the use of our proposed model with data collected from a real net work and conduct a simulation study to characterize its ability to detect changes.