EWMA Statistic in Adaptive Threshold Algorithm

Intrusion detection is used to monitor and capture intrusions into computer and network systems which attempt to compromise the security of computer and network systems. Many intrusions manifest in dramatic changes in the intensity of events occurring in information systems. Because of the ability of exponentially weighted moving average (EWMA) control charts to monitor the rate of occurrences of events based on their intensity, this technique is widely used in intrusion detection systems (IDS). One of the applications of this technique is in adaptive threshold algorithm. The performance of this method is in function of several parameters. This paper describes an approach to their choice.