• Corpus ID: 236777056

Sequential Multivariate Change Detection with Calibrated and Memoryless False Detection Rates

  title={Sequential Multivariate Change Detection with Calibrated and Memoryless False Detection Rates},
  author={Oliver Cobb and Arnaud Van Looveren and Janis Klaise},
Responding appropriately to the detections of a sequential change detector requires knowledge of the rate at which false posi-tives occur in the absence of change. Setting detection thresholds to achieve a desired false positive rate is challenging. Existing works resort to setting time-invariant thresholds that focus on the expected runtime of the detector in the absence of change, either bounding it loosely from below or targeting it directly but with asymptotic arguments that we show cause… 

Figures and Tables from this paper


Change Detection with the Kernel Cumulative Sum Algorithm
This work describes a kernel-based variant of the Cumulative Sum (CUSUM) change detection algorithm that can detect changes under less restrictive assumptions, and derives bounds on the performance of the algorithm, including the expected delay and the average time to false alarm.
Towards Non-Parametric Drift Detection via Dynamic Adapting Window Independence Drift Detection (DAWIDD)
A novel concept drift detection method, Dynamic Adapting Window Independence Drift Detection (DAWIDD), which aims for non-parametric drift detection of diverse drift characteristics and establishes a mathematical equivalence of the presence of drift to the dependency of specific random variables in an according drift process.
Learning from Time-Changing Data with Adaptive Windowing
A new approach for dealing with distribution change and concept drift when learning from data sequences that may vary with time is presented, using sliding windows whose size is recomputed online according to the rate of change observed from the data in the window itself.
High‐dimensional, multiscale online changepoint detection
A new method for high‐dimensional, online changepoint detection in settings where a p‐variate Gaussian data stream may undergo a change in mean, and it is proved that the patience, or average run length, of the procedure is at least at the desired nominal level.
Real-Time Nonparametric Anomaly Detection in High-Dimensional Settings
This work model anomalies as persistent outliers and propose to detect them via a cumulative sum-like algorithm via an asymptotic lower bound and an ascyptotic approximation for the average false alarm period of the proposed algorithm.
Online Multivariate Anomaly Detection and Localization for High-dimensional Settings
A sequential and multivariate anomaly detection method that scales well to high-dimensional datasets and follows a nonparametric, data-driven, and semi-supervised approach that can quickly and accurately detect challenging anomalies, such as changes in the correlation structure and stealth low-rate cyberattacks.
Nearly Optimal Change-Point Detection with an Application to Cybersecurity
The SR procedure is a better cyber “watch dog” than the popular CUSUM procedure and statistically traffic's intensity can be well described by the proposed Gaussian model with σ2 = aμ instead of the traditional Poisson model, which requires ρ2 = μ.
Adaptive threshold computation for CUSUM-type procedures in change detection and isolation problems
Scan B-statistic for kernel change-point detection
This article proposes a computationally efficient kernel-based statistics for change-point detection inspired by the recently developed B-statistics and characterization of the tail probability of these statistics using the change-of-measure technique, which focuses on characterizing the tail of the detection statistics rather than obtaining its asymptotic distribution under the null distribution.
A pdf-Free Change Detection Test Based on Density Difference Estimation
A novel probability density function-free change detection test, which is based on the least squares density-difference estimation method and operates online on multidimensional inputs and is able to operate immediately after having been configured by adopting a reservoir sampling mechanism.