Nonparametric Sequential Change-Point Procedure for Network Surveillance Data

• Activity Number: 358
• Type: Contributed
• Date/Time: Tuesday, August 2, 2011 : 10:30 AM to 12:20 PM
• Sponsor: Section on Quality and Productivity
• Author(s): Tatev Ambartsoumian*+
• Companies: University of California at Riverside
• Keywords: nonparametric ; change point ; cusum ; generalized likelihood ratio test ; data monitoring

Abstract

We adapt the Generalized Likelihood Ratio Test based Cusum procedure to detect a change in the distribution of the incoming sequence in the context of computer network monitoring. For the case of the known in-control and out-of-control densities, we propose an analytical approximation formula for determining the threshold value of the GLRT Cusum. We further extend the application of the GLRT Cusum for the case of unknown densities under the following two assumptions: 1) there is enough historical data to estimate the in-control distribution, and 2) the out-of-control density can be derived from the in-control density through a proper transformation. We adjust our analytical approximation formula for the GLRT Cusum threshold so that it can be applied under the unknown densities scenario as well. The use of our proposed nonparametric GLRT Cusum technique and the threshold approximation formulas is illustrated by means of several examples.