Continuous Monitoring of a Computer Network Using Multivariate Adaptive Estimation

Monitoring computer network traffic is a pressing problem in cyber-security. Such traffic can be represented as a data stream, an unending sequence of data points subject to unknown dynamics. This paper is concerned with statistical anomaly detection on such streams, where the detector must operate continuously without supervision. In this so-called continuous monitoring context, we develop a change detection methodology based on multivariate adaptive estimation that has the benefit of reducing the burden on the analyst to set the values of control parameters. This methodology is shown to have utility in simulated experiments, and is exercised on real NETFLOW data extracted from the Imperial College network.