IRUS Total

Nonparametric self-exciting models for computer network traffic

File Description SizeFormat 
Price-Williams-Heard2019_Article_NonparametricSelf-excitingMode.pdfPublished version482.86 kBAdobe PDFView/Open
Title: Nonparametric self-exciting models for computer network traffic
Authors: Price-Williams, M
Heard, N
Item Type: Journal Article
Abstract: Connectivity patterns between nodes in a computer network can be interpreted and modelled as point processes where events in a process indicate connections being established for data to be sent along that edge. A model of normal connectivity behaviour can be constructed for each edge in a network by identifying key network user features such as seasonality or self-exciting behaviour, since events typically arise in bursts at particular times of day which may be peculiar to that edge. When monitoring a computer network in real time, unusual patterns of activity against the model of normality could indicate the presence of a malicious actor. A flexible, novel, nonparametric model for the excitation function of a Wold process is proposed for modelling the conditional intensities of network edges. This approach is shown to outperform standard seasonality and self-excitation models in predicting network connections, achieving well-calibrated predictions for event data collected from the computer networks of both Imperial College and Los Alamos National Laboratory.
Issue Date: 1-Mar-2020
Date of Acceptance: 17-Apr-2019
URI: http://hdl.handle.net/10044/1/70238
DOI: 10.1007/s11222-019-09875-z
ISSN: 0960-3174
Publisher: Springer (part of Springer Nature)
Start Page: 209
End Page: 220
Journal / Book Title: Statistics and Computing
Volume: 30
Copyright Statement: © The Author(s) 2019. This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.
Sponsor/Funder: GCHQ
Funder's Grant Number: Price-Williams PO-4177302
Keywords: Science & Technology
Physical Sciences
Computer Science, Theory & Methods
Statistics & Probability
Computer Science
Computer network
Wold process
Hawkes process
Changepoint estimation
Statistics & Probability
0104 Statistics
0802 Computation Theory and Mathematics
Publication Status: Published
Open Access location: https://rdcu.be/bBGT3
Online Publication Date: 2019-05-13
Appears in Collections:Statistics
Faculty of Natural Sciences