Stochastic events are rife in the real world and modelling such event behaviour continues to be an area for much research. Point processes provide widely applicable models for stochastic activity, and have been used extensively to capture different forms of random behaviour, including ‘self-excitation’. This phenomenon is such that the rate at which events occur is dependent upon the history of the process. In this way, the occurrence of an event can ‘excite’ the process and increase the likelihood of additional events. This construction can be extended to multivariate settings where the effect of events in one process can cross-excite another process. With notions of self and cross-excitation, systems with complex dynamics can be considered, such as those arising in neurology, cyber-security and geophysics, for example.
Univariate and multivariate Hawkes processes provide a useful framework in which to consider excitation effects, allowing for intricate behaviour to be captured in a parametric fashion. Modelling excitation with Hawkes processes gives insight into the internal dynamics of a process, and provides the opportunity to reason about dependence structures and influential effects. Despite their applicability to many areas, point processes assume that events occur asynchronously, with Hawkes processes being no exception. This gives rise to a key challenge in modelling real data with point processes, as finite limits on recording capabilities and storage capacities commonly result in an aggregation of the underlying process to counts of events per time bin. Not only does this binning ‘blur’ the observed process, but it often results in events being recorded with the same time-stamp, invalidating the assumption of asynchronous data. Therefore in order to model count data and obtain meaningful parameter estimates, it is imperative to develop tools which account for the binned nature of the data. In the literature, only a few methods exist for handling binned Hawkes process data, with most approaches being inappropriate or yielding significantly biased or variable estimates. In this thesis we propose a novel optimisation approach for handling parameter estimation of binned Hawkes processes, in both the univariate and multivariate settings, and illustrate performance on simulated and real data from the cyber-security domain.
Modelling excitation behaviour with parametric models such as the Hawkes process provides one key approach for analysis. For the multivariate setting in particular, summarising the dependence structures in a non-parametric manner is another avenue which offers significant value, as no particular model is presumed. By expressing the intricate dynamics as a summary statistic describing the net excitation, we can gain rich insight into complicated cross-correlation structures. Further, monitoring the net excitation effect through time allows us to detect structural changes that may otherwise be hidden. To this end, we introduce the notion of net direction of excitation and define a novel summary metric which can efficiently be applied to count data for quantifying the extent and direction of the net excitation effect. The intuition behind this metric is explored through several motivating examples, including the Hawkes process, and applicability to cyber-security is demonstrated through an illustrative case study.