Sequential algorithms for moving anomaly detection in networks

Abstract The problem of quickest moving anomaly detection in networks is studied. Initially, the observations are generated according to a prechange distribution. At some unknown but deterministic time, an anomaly emerges in the network. At each time instant, one node is affected by the anomaly and receives data from a post-change distribution. The anomaly moves across the network, and the node that it affects changes with time. However, the trajectory of the moving anomaly is assumed to be unknown. A discrete-time Markov chain is employed to model the unknown trajectory of the moving anomaly in the network. A windowed generalized likelihood ratio–based test is constructed and is shown to be asymptotically optimal. Other detection algorithms including the dynamic Shiryaev-Roberts test, a quickest change detection algorithm with recursive change point estimation, and a mixture cumulative sum (CUSUM) algorithm are also developed for this problem. Lower bounds on the mean time to false alarm are developed. Numerical results are further provided to compare their performances.