BZPEERReading, trust and collaboration for research
Menu

Discover

GraphFollow connections around a paper, topic or saved view.

Workspaces

HomePick up where your research flow left off.InboxHandle requests, replies and notifications from one place.CollectionsCurate reading lists, evidence sets and shareable dossiers.ResearchSee your private provenance graph, trail and imports.CollaborationMove from discovery into focused discussion rooms.PublishDraft, preview and publish full-text research articles.

Network

ExpertsFind specialists worth following or asking for help.CommunitiesJoin research circles organized around shared work.PartnersSee external organizations active around the same topics.

Opportunities

ListingsBrowse roles, calls and collaborations with clearer fit signals.

Account

Log inReturn to your reading and collaboration workspace.Create accountStart saving work, following people and joining teams.
Log inCreate account

Researcher profile

Aleksey S. Polunchenko

Aleksey S. Polunchenko contributes to research discovery and scholarly infrastructure.

ResearcherAffiliation not importedOpen to collaborate
Computationmath.STMethodologyStatistics TheoryApplications

Trust snapshot

Quick read

Trust 21 - Emerging
18works
0followers
5topics
4close collaborators

Actions

Decide how to stay connected

Follow researcher0

Research graph

See the researcher in context

Open full explorer

Inspect adjacent work, topics, institutions and collaborators without jumping out to a separate graph page.

Building this graph slice

BZPEER is loading the nearby papers, people, topics and institutions for this page.

Published work

18 published item(s)

preprint2016arXiv

A Note on Efficient Performance Evaluation of the Cumulative Sum Chart and the Sequential Probability Ratio Test

We establish a simple connection between certain in-control characteristics of the CUSUM Run Length and their out-of-control counterparts. The connection is in the form of paired integral (renewal) equations. The derivation exploits Wald's likelihood ratio identity and the well-known fact that the CUSUM chart is equivalent to repetitive application of Wald's SPRT. The characteristics considered include the entire Run Length distribution and all of the corresponding moments, starting from the zero-state ARL. A particular practical benefit of our result is that it enables the in- and out-of-control characteristics of the CUSUM Run Length to be computed concurrently. Moreover, due to the equivalence of the CUSUM chart to a sequence of SPRTs, the ASN and OC functions of an SPRT under the null and under the alternative can all be computed simultaneously as well. This would double up the efficiency of any numerical method one may choose to devise to carry out the actual computations.

0 citations0 reviewsNo code linkedOpen access
preprint2016arXiv

An Analytic Expression for the Distribution of the Generalized Shiryaev-Roberts Diffusion

We consider the quickest change-point detection problem where the aim is to detect the onset of a pre-specified drift in "live"-monitored standard Brownian motion; the change-point is assumed unknown (nonrandom). The topic of interest is the distribution of the Generalized Shryaev-Roberts (GSR) detection statistic set up to "sense" the presence of the drift. Specifically, we derive a closed-form formula for the transition probability density function (pdf) of the time-homogeneous Markov diffusion process generated by the GSR statistic when the Brownian motion under surveillance is "drift-free", i.e., in the pre-change regime; the GSR statistic's (deterministic) nonnegative headstart is assumed arbitrarily given. The transition pdf formula is found analytically, through direct solution of the respective Kolmogorov forward equation via the Fourier spectral method to achieve separation of the spacial and temporal variables. The obtained result generalizes the well-known formula for the (pre-change) stationary distribution of the GSR statistic: the latter's stationary distribution is the temporal limit of the distribution sought in this work. To conclude, we exploit the obtained formula numerically and briefly study the pre-change behavior of the GSR statistic versus three factors: (a) drift-shift magnitude, (b) time, and (c) the GSR statistic's headstart.

0 citations0 reviewsNo code linkedOpen access
preprint2016arXiv

Exact Distribution of the Generalized Shiryaev-Roberts Stopping Time Under the Minimax Brownian Motion Setup

We consider the quickest change-point detection problem where the aim is to detect the onset of a pre-specified drift in "live"-monitored standard Brownian motion; the change-point is assumed unknown (nonrandom). The object of interest is the distribution of the stopping time associated with the Generalized Shryaev-Roberts (GSR) detection procedure set up to "sense" the presence of the drift in the Brownian motion under surveillance. Specifically, we seek the GSR stopping time's survival function (the tail probability that no alarm is triggered by the GSR procedure prior to a given point in time), and distinguish two scenarios: (a) when the drift never sets in (pre-change regime) and (b) when the drift is in effect ab initio (post-change regime). Under each scenario, we obtain a closed-form formula for the respective survival function, with the GSR statistic's (deterministic) nonnegative headstart assumed arbitrarily given. The two formulae are found analytically, through direct solution of the respective Kolmogorov forward equation via the Fourier spectral method to achieve separation of the spacial and temporal variables. We then exploit the obtained formulae numerically and characterize the pre- and post-change distributions of the GSR stopping time depending on three factors: (a) magnitude of the drift, (b) detection threshold, and (c) the GSR statistic's headstart.

0 citations0 reviewsNo code linkedOpen access
preprint2016arXiv

Optimal Design of the Shiryaev-Roberts Chart: Give Your Shiryaev-Roberts a Headstart

We offer a numerical study of the effect of headstarting on the performance of a Shiryaev-Roberts (SR) chart set up to control the mean of a normal process. The study is a natural extension of that previously carried out by Lucas and Crosier for the CUSUM scheme in their seminal 1982 paper published in Technometrics. The Fast Initial Response (FIR) feature exhibited by a headstarted CUSUM turns out to be also characteristic of an SR chart (re-)started off a nonzero initial score. However, our main result is the observation that a FIR SR with a carefully designed {\em optimal} headstart is not just faster to react to an initial out-of-control situation, it is nearly {\em the} fastest {\em uniformly}, i.e., assuming the process under surveillance is equally likely to go out of control effective any sample number. The performance improvement is the greater, the fainter the change. We explain the optimization strategy, and tabulate the optimal initial score, control limit, and the corresponding "worst possible" out-of-control Average Run Length (ARL), considering mean-shifts of diverse magnitudes and a wide range of levels of the in-control ARL.

0 citations0 reviewsNo code linkedOpen access
preprint2015arXiv

On Robustness of the Shiryaev-Roberts Procedure for Quickest Change-Point Detection under Parameter Misspecification in the Post-Change Distribution

The gist of the quickest change-point detection problem is to detect the presence of a change in the statistical behavior of a series of sequentially made observations, and do so in an optimal detection-speed-vs.-"false-positive"-risk manner. When optimality is understood either in the generalized Bayesian sense or as defined in Shiryaev's multi-cyclic setup, the so-called Shiryaev-Roberts (SR) detection procedure is known to be the "best one can do", provided, however, that the observations' pre- and post-change distributions are both fully specified. We consider a more realistic setup, viz. one where the post-change distribution is assumed known only up to a parameter, so that the latter may be "misspecified". The question of interest is the sensitivity (or robustness) of the otherwise "best" SR procedure with respect to a possible misspecification of the post-change distribution parameter. To answer this question, we provide a case study where, in a specific Gaussian scenario, we allow the SR procedure to be "out of tune" in the way of the post-change distribution parameter, and numerically assess the effect of the "mistuning" on Shiryaev's (multi-cyclic) Stationary Average Detection Delay delivered by the SR procedure. The comprehensive quantitative robustness characterization of the SR procedure obtained in the study can be used to develop the respective theory as well as to provide a rational for practical design of the SR procedure. The overall qualitative conclusion of the study is an expected one: the SR procedure is less (more) robust for less (more) contrast changes and for lower (higher) levels of the false alarm risk.

0 citations0 reviewsNo code linkedOpen access
preprint2015arXiv

Real-time financial surveillance via quickest change-point detection methods

We consider the problem of efficient financial surveillance aimed at "on-the-go" detection of structural breaks (anomalies) in "live"-monitored financial time series. With the problem approached statistically, viz. as that of multi-cyclic sequential (quickest) change-point detection, we propose a semi-parametric multi-cyclic change-point detection procedure to promptly spot anomalies as they occur in the time series under surveillance. The proposed procedure is a derivative of the likelihood ratio-based Shiryaev-Roberts (SR) procedure; the latter is a quasi-Bayesian surveillance method known to deliver the fastest (in the multi-cyclic sense) speed of detection, whatever be the false alarm frequency. We offer a case study where we first carry out, step by step, statistical analysis of a set of real-world financial data, and then set up and devise (a) the proposed SR-based anomaly-detection procedure and (b) the celebrated Cumulative Sum (CUSUM) chart to detect structural breaks in the data. While both procedures performed well, the proposed SR-derivative, conforming to the intuition, seemed slightly better.

0 citations0 reviewsNo code linkedOpen access
preprint2014arXiv

An Exact Formula for the Average Run Length to False Alarm of the Generalized Shiryaev-Roberts Procedure for Change-Point Detection under Exponential Observations

We derive analytically an exact closed-form formula for the standard minimax Average Run Length (ARL) to false alarm delivered by the Generalized Shiryaev-Roberts (GSR) change-point detection procedure devised to detect a shift in the baseline mean of a sequence of independent exponentially distributed observations. Specifically, the formula is found through direct solution of the respective integral (renewal) equation, and is a general result in that the GSR procedure's headstart is not restricted to a bounded range, nor is there a "ceiling" value for the detection threshold. Apart from the theoretical significance (in change-point detection, exact closed-form performance formulae are typically either difficult or impossible to get, especially for the GSR procedure), the obtained formula is also useful to a practitioner: in cases of practical interest, the formula is a function linear in both the detection threshold and the headstart, and, therefore, the ARL to false alarm of the GSR procedure can be easily computed.

0 citations0 reviewsNo code linkedOpen access
preprint2014arXiv

Optimal Design and Analysis of the Exponentially Weighted Moving Average Chart for Exponential Data

We study optimal design of the Exponentially Weighted Moving Average (EWMA) chart by a proper choice of the smoothing factor and the initial value (headstart) of the decision statistic. The particular problem addressed is that of quickest detection of an abrupt change in the parameter of a discrete-time exponential model. Both pre- and post-change parameter values are assumed known, but the change-point is not known. For this change-point detection scenario, we examine the performance of the conventional one-sided EWMA chart with respect to two optimality criteria: Pollak's minimax criterion associated with the maximal conditional expected delay to detection and Shiryaev's multi-cyclic setup associated with the stationary expected delay to detection. Using the integral-equations approach, we derive the exact closed-form formulae for all of the required performance measures. Based on these formulae we find the optimal smoothing factor and headstart by solving the corresponding two bivariate constraint optimization problems. Finally, the performance of the optimized EWMA chart is compared against that of the Shiryaev--Roberts--$r$ procedure in the minimax setting, and against that of the original Shiryaev--Roberts procedure in the multi-cyclic setting. The main conclusion is that the EWMA chart, when fully optimized, turns out to be a very competitive procedure, with performance nearly indistinguishable from that of the known-to-be-best Shiryaev--Roberts--$r$ and Shiryaev--Roberts procedures.

0 citations0 reviewsNo code linkedOpen access
preprint2013arXiv

An Accurate Method for Determining the Pre-Change Run-Length Distribution of the Generalized Shiryaev--Roberts Detection Procedure

Change-of-measure is a powerful technique used across statistics, probability and analysis. Particularly known as Wald's likelihood ratio identity, the technique enabled the proof of a number of exact and asymptotic optimality results pertaining to the problem of quickest change-point detection. Within the latter problem's context we apply the technique to develop a numerical method to compute the Generalized Shiryaev--Roberts (GSR) detection procedure's pre-change Run-Length distribution. Specifically, the method is based on the integral-equations approach and uses the collocation framework with the basis functions chosen so as to exploit a certain change-of-measure identity and a specific martingale property of the GSR procedure's detection statistic. As a result, the method's accuracy and robustness improve substantially, even though the method's theoretical rate of convergence is shown to be merely quadratic. A tight upper bound on the method's error is supplied as well. The method is not restricted to a particular data distribution or to a specific value of the GSR detection statistic's "headstart". To conclude, we offer a case study to demonstrate the proposed method at work, drawing particular attention to the method's accuracy and its robustness with respect to three factors: (a) partition size, (b) change magnitude, and (c) Average Run Length (ARL) to false alarm level. Specifically, assuming independent standard Gaussian observations undergoing a surge in the mean, we employ the method to study the GSR procedure's Run-Length's pre-change distribution, its average (i.e., the usual ARL to false alarm) and standard deviation. As expected from the theoretical analysis, the method's high accuracy and robustness with respect to the foregoing three factors are confirmed experimentally. We also comment on extending the method to handle other performance measures and other procedures.

0 citations0 reviewsNo code linkedOpen access
preprint2013arXiv

Efficient Performance Evaluation of the Generalized Shiryaev--Roberts Detection Procedure in a Multi-Cyclic Setup

We propose a numerical method to evaluate the performance of the emerging Generalized Shiryaev--Roberts (GSR) change-point detection procedure in a "minimax-ish" multi-cyclic setup where the procedure of choice is applied repetitively (cyclically) and the change is assumed to take place at an unknown time moment in a distant-future stationary regime. Specifically, the proposed method is based on the integral-equations approach and uses the collocation technique with the basis functions chosen so as to exploit a certain change-of-measure identity and the GSR detection statistic's unique martingale property. As a result, the method's accuracy and robustness improve, as does its efficiency since using the change-of-measure ploy the Average Run Length (ARL) to false alarm and the Stationary Average Detection Delay (STADD) are computed simultaneously. We show that the method's rate of convergence is quadratic and supply a tight upperbound on its error. We conclude with a case study and confirm experimentally that the proposed method's accuracy and rate of convergence are robust with respect to three factors: (a) partition fineness (coarse vs. fine), (b) change magnitude (faint vs. contrast), and (c) the level of the ARL to false alarm (low vs. high). Since the method is designed not restricted to a particular data distribution or to a specific value of the GSR detection statistic's headstart, this work may help gain greater insight into the characteristics of the GSR procedure and aid a practitioner to design the GSR procedure as needed while fully utilizing its potential.

0 citations0 reviewsNo code linkedOpen access
preprint2012arXiv

Efficient Computer Network Anomaly Detection by Changepoint Detection Methods

We consider the problem of efficient on-line anomaly detection in computer network traffic. The problem is approached statistically, as that of sequential (quickest) changepoint detection. A multi-cyclic setting of quickest change detection is a natural fit for this problem. We propose a novel score-based multi-cyclic detection algorithm. The algorithm is based on the so-called Shiryaev-Roberts procedure. This procedure is as easy to employ in practice and as computationally inexpensive as the popular Cumulative Sum chart and the Exponentially Weighted Moving Average scheme. The likelihood ratio based Shiryaev-Roberts procedure has appealing optimality properties, particularly it is exactly optimal in a multi-cyclic setting geared to detect a change occurring at a far time horizon. It is therefore expected that an intrusion detection algorithm based on the Shiryaev-Roberts procedure will perform better than other detection schemes. This is confirmed experimentally for real traces. We also discuss the possibility of complementing our anomaly detection algorithm with a spectral-signature intrusion detection system with false alarm filtering and true attack confirmation capability, so as to obtain a synergistic system.

0 citations0 reviewsNo code linkedOpen access
preprint2012arXiv

Nearly Optimal Change-Point Detection with an Application to Cybersecurity

We address the sequential change-point detection problem for the Gaussian model where baseline distribution is Gaussian with variance σ^2 and mean μsuch that σ^2=aμ, where a>0 is a known constant; the change is in μfrom one known value to another. First, we carry out a comparative performance analysis of four detection procedures: the CUSUM procedure, the Shiryaev-Roberts (SR) procedure, and two its modifications - the Shiryaev-Roberts-Pollak and Shiryaev-Roberts-r procedures. The performance is benchmarked via Pollak's maximal average delay to detection and Shiryaev's stationary average delay to detection, each subject to a fixed average run length to false alarm. The analysis shows that in practically interesting cases the accuracy of asymptotic approximations is "reasonable" to "excellent". We also consider an application of change-point detection to cybersecurity - for rapid anomaly detection in computer networks. Using real network data we show that statistically traffic's intensity can be well-described by the proposed Gaussian model with σ^2=aμinstead of the traditional Poisson model, which requires σ^2=μ. By successively devising the SR and CUSUM procedures to "catch" a low-contrast network anomaly (caused by an ICMP reflector attack), we then show that the SR rule is quicker. We conclude that the SR procedure is a better cyber "watch dog" than the popular CUSUM procedure.

0 citations0 reviewsNo code linkedOpen access
preprint2012arXiv

On optimality of the Shiryaev-Roberts procedure for detecting a change in distribution

In 1985, for detecting a change in distribution, Pollak introduced a specific minimax performance metric and a randomized version of the Shiryaev-Roberts procedure where the zero initial condition is replaced by a random variable sampled from the quasi-stationary distribution of the Shiryaev-Roberts statistic. Pollak proved that this procedure is third-order asymptotically optimal as the mean time to false alarm becomes large. The question of whether Pollak's procedure is strictly minimax for any false alarm rate has been open for more than two decades, and there were several attempts to prove this strict optimality. In this paper, we provide a counterexample which shows that Pollak's procedure is not optimal and that there is a strictly optimal procedure which is nothing but the Shiryaev-Roberts procedure that starts with a specially designed deterministic point.

0 citations0 reviewsNo code linkedOpen access
preprint2011arXiv

State-of-the-Art in Sequential Change-Point Detection

We provide an overview of the state-of-the-art in the area of sequential change-point detection assuming discrete time and known pre- and post-change distributions. The overview spans over all major formulations of the underlying optimization problem, namely, Bayesian, generalized Bayesian, and minimax. We pay particular attention to the latest advances in each. Also, we link together the generalized Bayesian problem with multi-cyclic disorder detection in a stationary regime when the change occurs at a distant time horizon. We conclude with two case studies to illustrate the cutting edge of the field at work.

0 citations0 reviewsNo code linkedOpen access
preprint2011arXiv

Third-order Asymptotic Optimality of the Generalized Shiryaev-Roberts Changepoint Detection Procedures

Several variations of the Shiryaev-Roberts detection procedure in the context of the simple changepoint problem are considered: starting the procedure at $R_0=0$ (the original Shiryaev-Roberts procedure), at $R_0=r$ for fixed $r>0$, and at $R_0$ that has a quasi-stationary distribution. Comparisons of operating characteristics are made. The differences fade as the average run length to false alarm tends to infinity. It is shown that the Shiryaev-Roberts procedures that start either from a specially designed point $r$ or from the random "quasi-stationary" point are order-3 asymptotically optimal.

0 citations0 reviewsNo code linkedOpen access
preprint2009arXiv

A Numerical Approach to Performance Analysis of Quickest Change-Point Detection Procedures

For the most popular sequential change detection rules such as CUSUM, EWMA, and the Shiryaev-Roberts test, we develop integral equations and a concise numerical method to compute a number of performance metrics, including average detection delay and average time to false alarm. We pay special attention to the Shiryaev-Roberts procedure and evaluate its performance for various initialization strategies. Regarding the randomized initialization variant proposed by Pollak, known to be asymptotically optimal of order-3, we offer a means for numerically computing the quasi-stationary distribution of the Shiryaev-Roberts statistic that is the distribution of the initializing random variable, thus making this test applicable in practice. A significant side-product of our computational technique is the observation that deterministic initializations of the Shiryaev-Roberts procedure can also enjoy the same order-3 optimality property as Pollak's randomized test and, after careful selection, even uniformly outperform it.

0 citations0 reviewsNo code linkedOpen access
preprint2009arXiv

Numerical Comparison of Cusum and Shiryaev-Roberts Procedures for Detecting Changes in Distributions

The CUSUM procedure is known to be optimal for detecting a change in distribution under a minimax scenario, whereas the Shiryaev-Roberts procedure is optimal for detecting a change that occurs at a distant time horizon. As a simpler alternative to the conventional Monte Carlo approach, we propose a numerical method for the systematic comparison of the two detection schemes in both settings, i.e., minimax and for detecting changes that occur in the distant future. Our goal is accomplished by deriving a set of exact integral equations for the performance metrics, which are then solved numerically. We present detailed numerical results for the problem of detecting a change in the mean of a Gaussian sequence, which show that the difference between the two procedures is significant only when detecting small changes.

0 citations0 reviewsNo code linkedOpen access