Nonparametric self-exciting models for computer network traffic
File(s)
OA Location
Author(s)
Price-Williams, Matthew
Heard, Nicholas
Type
Journal Article
Abstract
Connectivity patterns between nodes in a computer network can be interpreted and modelled as point processes where events in a process indicate connections being established for data to be sent along that edge. A model of normal connectivity behaviour can be constructed for each edge in a network by identifying key network user features such as seasonality or self-exciting behaviour, since events typically arise in bursts at particular times of day which may be peculiar to that edge. When monitoring a computer network in real time, unusual patterns of activity against the model of normality could indicate the presence of a malicious actor. A flexible, novel, nonparametric model for the excitation function of a Wold process is proposed for modelling the conditional intensities of network edges. This approach is shown to outperform standard seasonality and self-excitation models in predicting network connections, achieving well-calibrated predictions for event data collected from the computer networks of both Imperial College and Los Alamos National Laboratory.
Date Issued
2020-03-01
Date Acceptance
2019-04-17
Citation
Statistics and Computing, 2020, 30, pp.209-220
ISSN
0960-3174
Publisher
Springer (part of Springer Nature)
Start Page
209
End Page
220
Journal / Book Title
Statistics and Computing
Volume
30
Copyright Statement
© The Author(s) 2019. This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.
Sponsor
GCHQ
Grant Number
Price-Williams PO-4177302
Subjects
Science & Technology
Technology
Physical Sciences
Computer Science, Theory & Methods
Statistics & Probability
Computer Science
Mathematics
Computer network
Wold process
Hawkes process
Changepoint estimation
Statistics & Probability
0104 Statistics
0802 Computation Theory and Mathematics
Publication Status
Published
Date Publish Online
2019-05-13