Asymptotically Uniformly Minimax Detection and Isolation in Network Monitoring

Abstract

This paper addresses the problem of multiple hypothesis testing (detection and isolation of mean vectors) in the case of Gaussian linear model with nuisance parameters. An invariant constrained asymptotically uniformly minimax test is proposed to solve this problem. The invariance of the test with respect to the nuisance parameters is obtained by projecting the measurement vector onto a subspace of invariant statistics. The proposed test minimizes the maximum probability of false isolation uniformly with respect to the lower bounded projections of the vectors defining the alternative hypotheses. This minimization is achieved provided that the signal-to-noise ratio (SNR) becomes arbitrary large. The asymptotic probabilities of false alarm and false isolations and their nonasymptotic bounds are analytically established. To illustrate the practical relevance of the proposed test, it is applied to the problem of network monitoring. It is aimed to detect and isolate volume anomalies in network origin-destination (OD) traffic demands from simple link load measurements. The ambient traffic, i.e. the OD traffic matrix corresponding to the nonanomalous network state, is unknown and considered as a nuisance parameter. An original linear parsimonious model of the ambient traffic which is indispensable for the proposed asymptotically optimal test is designed. The statistical performances of this approach to detect and isolate the anomalies are evaluated by using real data from the Abilene network.

Constructive minimax classification of discrete observations with arbitrary loss function

“…where inequality (37) comes from (12), (13), (14), (15) and inequality (38) comes from (16), (18) and q k ≥ 0 for all k. It follows that…”

“…For instance, the famous book [10] does not describe any algorithm to compute a minimax test. On the second hand, the minimax test is often established for a specific issue [12,13,14,15,16] but the algorithm can not be easily extended to an other observation model.…”

“…If (δ * , γ * ) is a solution to the LP problem, then δ * ∈ D * on account of (12)- (15). Moreover, max 1≤k≤K R(θ k , δ * ) ≤ γ * on account of (16).…”

Box-constrained optimization for minimax supervised learning

“…so that the solution δ C of ( 8) is the Bayes classifier given by ( 10) with the priors (11). The least favorable priors are generally difficult to compute as underlined in [12,[26][27][28]. Subsection 2.2 is devoted to the calculation of the minimum Bayes risk V (π) over the simplex.…”

The cybercrime process : an overview of scientific challenges and methods

“…Detection can also be performed in a signal mode, using statistical approaches that present the advantage to avoid a priori knowledge (comparing with Bayesian approaches) [8]. The variables used are: the traffic rate, abnormal packets, CPU utilization, etc.…”