A Nonparametric Adaptive Cusum Method and Its Application in Network Anomaly Detection
Detecting anomalies that disrupt the symmetry in two-way communications is an important task for network defense systems. The subtlety and complexity of anomalous traffic challenge the existing detection methods, and the bottleneck is how to set thresholds to adapt to the variability in network traffic. In this paper, a nonparametric adaptive CUSUM (CUmulative SUM) method is presented to meet this challenge. It has three distinct features: no assumption is made on the distribution of the observations, its detection threshold is self-adjusted so that it can adapt itself to various traffic conditions and it can react to the end of an anomaly within a required delay time.