ATD: Efficient online detection based on multiple sensors, with applications to cybersecurity and discovery of biological threats

American University, Washington DC

Investigators

Abstract

The project focuses on threat detection schemes based on simultaneously observed multiple data sequences. The proper use of multiple sources of information, or multiple sensors, ensures high sensitivity of the detection procedure. However, multiple streams of diverse information can cause false alarms. What are the optimal statistical techniques of combining mixed types of data to yield a quick and error-free detection? Proposed statistical methods deal with potential threats by detecting heterogeneities and anomalies and locating change points in the distribution of multidimensional data. It is assumed that a number of sensors simultaneously collect and report data sequences. When a significant event occurs and a potential threat appears, the distribution of one or several sequences changes. The goal is to detect a threat as soon as possible, subject to a low rate of false alarms. Derivation of optimal threat detection algorithms on multiple sequences will be based on the recently developed theory and methodology of multiple comparisons in sequential experiments. These new techniques introduced by the PI and his student led to tests of multiple hypotheses that control both the familywise error rate and the familywise power at a low expected sampling cost. This suggests several approaches to the quick multi-sensor change-point detection. Analogues of CUSUM, Bayesian, and asymptotically pointwise optimal change-point detection tools will be developed based on the new methodology in order to control the probability of a false alarm, the missed discovery rate, and to minimize the mean detection delay under these constraints. Quick detection of threats by discovering changes in distributions, patterns, and trends is one of the most vital problems in quality control, market analysis, epidemiology, climatology, target tracking, and other fields. Among wide areas of application, this project particularly focuses on detecting breaches in cyber security and biological threats such as epidemics and bioterrorist attacks. The project will provide general tools for the prompt reaction to threatening anomalies in real situations such as (i) recognizing a pre-epidemic pattern and signalling an epidemic threat based on geospatial public health surveillance data in different regions, (ii) detecting computer threats and breaches in cyber security, based on multiple data streams, and (iii) detecting potential threats from extual analysis of communication networks. An important modern application of change-point detection on multiple data streams appears in DNA sequencing. The possibility of utilizing the prior information in sequential change-point analysis of multiple data streams opens doors for wide applications. It will allow to predict threats and make forecasts for a number of processes that exhibit a two-phase or multi-phase behavior, such as the epidemics and inter-epidemic periods, economic growth and recession, and spikes in energy prices. Developed methods of fast change-point detection will be used for the early detection of unknown targets and intrusions, fraud activity, unusual behavior at vital locations, detection and classification of pre-epidemic trends, and also, for the prevention of epidemics and terrorist attacks.