Modeling Computer Network Data Using Markov Modulated Poisson Processes

• Activity Number: 141 - Statistical Analysis of Cyber-Security Data
• Type: Invited
• Date/Time: Monday, July 31, 2017 : 10:30 AM to 12:20 PM
• Sponsor: Royal Statistical Society
• Author(s): Mark Briers*
• Companies: Alan Turing Institute
• Keywords: Markov Modulated Poisson Process ; Cyber Security ; Particle Filters ; Sequential Monte Carlo ; Expectation Maximization

Abstract

There are a number of latent factors, such as the presence of a user executing processes on a client machine, that determines the communication rate of machines across a computer network. A Markov Modulated Poisson Process (MMPP) is a Poisson process whose rate ?(t) evolves according to a continuous time Markov chain, making it a natural choice for modelling computer network data. In this talk, we will demonstrate that an MMPP is an appropriate model for network traffic data rates. In undertaking such an analysis, we will introduce a numerically stable estimation procedure for the Expectation step when performing parameter estimation using the Expectation Maximization algorithm.