UC Riverside

Network surveillance algorithms are becoming increasingly important as the ability to monitor a wide variety of data is rapidly expanding. Traffic metrics are usually count data that display a non-stationary pattern in their mean structure. We propose to model traffic counts using a generalized linear mixed model to capture these features. We then develop three tracking statistics proposed for anomaly detection. Two of the statistics are derived variants of a generalized likelihood ratio approach, which itself is not computationally tractable. The first of these variants is based on an approximation to the integrated likelihood while the second is based on the concept of h-likelihood. We also consider a tracking statistic that is an exponentially weighted moving average. We investigate the properties of the three tracking statistics from the point of view of false alarm rate and detection power, and compare the proposed tracking statistics with current literature. Our comparisons show that the two generalized likelihood ratio variants are preferred choices as SPC tools for network surveillance. Computational aspects of the three procedures are also discussed.