Cusum techniques for timeslot sequences with applications to network surveillance

We develop two cusum change-point detection algorithms for data network monitoring applications where numerous and various performance and reliability metrics are available to aid with the early identification of realized or impending failures. We confront three significant challenges with our cusum algorithms: (1) the need for nonparametric techniques so that a wide variety of metrics can be included in the monitoring process, (2) the need to handle time varying distributions for the metrics that reflect natural cycles in work load and traffic patterns, and (3) the need to be computationally efficient with the massive amounts of data that are available for processing. The only critical assumption we make when developing the algorithms is that suitably transformed observations within a defined timeslot structure are independent and identically distributed under normal operating conditions. To facilitate practical implementations of the algorithms, we present asymptotically valid thresholds. Our research was motivated by a real-world application and we use that context to guide the design of a simulation study that examines the sensitivity of the cusum algorithms.