We propose an algorithm for simultaneously detecting and locating changepoints in a time series, and a framework for predicting the distribution of the next point in the series. The kernel of the algorithm is a system of equations that computes, for each index i, the probability that the last (most recent) change point occurred at i. We evaluate this algorithm by applying it to the change point detection problem and comparing it to the generalized likelihood ratio (GLR) algorithm. We find that our algorithm is as good as GLR, or better, over a wide range of scenarios, and that the advantage increases as the signal-to-noise ratio decreases.
The increasing incidence of worm attacks in the Internet and the resulting instabilities in the global routing properties of the border gateway protocol (BGP) routers pose a serious threat to the connectivity and the ability of the Internet to deliver data correctly. In this paper we propose a mechanism to detect predict the onset of such instabilities which can then enable the timely execution of preventive strategies in order to minimize the damage caused by the worm. Our technique is based on online statistical methods relying on sequential change-point and persistence filter based detection algorithms. Our technique is validated using a year's worth of real traces collected from BGP routers in the Internet that we use to detect predict the global routing instabilities corresponding to the Code Red II, Nimda and SQL Slammer worms. In computer networks, large scale attacks in theirflnalstagescanreadilybeidentifledbyobservingvery abruptchangesinthenetworktra-c,butintheearlystage of an attack, these changes are hard to detect and di-cult todistinguishfromusualtra-c∞uctuations. Inthispaper, wedevelope-cientadaptivesequentialandbatch-sequential methods for an early detection of attacks from the class of of service attacks". These methods employ statis- tical analysis of data from multiple layers of the network protocol for detection of very subtle tra-c changes, which are typical for these kinds of attacks. Both the sequential and batch-sequential algorithms utilize thresholding of test statistics to achieve a flxed rate of false alarms. The algo- rithmsaredevelopedonthebasisofthechange-pointdetec- tiontheory: todetectachangeinstatisticalmodelsassoon as possible, controlling the rate of false alarms. There are threeattractivefeaturesoftheapproach. First,bothmeth- odsareself-learning,whichenablesthemtoadapttovarious network loads and usage patterns. Second, they allow for detecting attacks with small average delay for a given false alarm rate. Third, they are computationally simple, and hence,canbeimplementedonline. Theoreticalframeworks for both kinds of detection procedures, as well as results of simulations, are presented.