http://blog.eqnets.com/2009/08/03/why-poissonian-traffic-models-matter-more-now-than-ever-part-5/ Science, networks, and security Mon, 02 Aug 2010 22:01:13 +0000 hourly 1 http://wordpress.com/ http://blog.eqnets.com/2009/08/03/why-poissonian-traffic-models-matter-more-now-than-ever-part-5/#comment-188 Martingales from finite Markov processes, part 1 « Equilibrium Networks Mon, 15 Feb 2010 04:03:00 +0000 http://blog.eqnets.com/?p=211#comment-188 [...] The question for now is, once you’ve got a finite Markov process, what do you do with it? There are some obvious things. For example, you could apply a Chebyshev-type inequality to detect when the traffic parameters change or the underlying assumptions break down (which, if the model is halfway decent, by definition indicates something interesting is going on–even if it’s not malicious). This idea has been around in network security at least since Denning’s 1986-7 intrusion detection article, though, so it’s not likely to bear any more fruit (assuming it ever did). A better idea is to construct and exploit martingales. One way to do this to advantage starting with an inhomogeneous Poisson process (or in principle, at least, more general one-dimensional point processes) was outlined here and here. [...] [...] The question for now is, once you’ve got a finite Markov process, what do you do with it? There are some obvious things. For example, you could apply a Chebyshev-type inequality to detect when the traffic parameters change or the underlying assumptions break down (which, if the model is halfway decent, by definition indicates something interesting is going on–even if it’s not malicious). This idea has been around in network security at least since Denning’s 1986-7 intrusion detection article, though, so it’s not likely to bear any more fruit (assuming it ever did). A better idea is to construct and exploit martingales. One way to do this to advantage starting with an inhomogeneous Poisson process (or in principle, at least, more general one-dimensional point processes) was outlined here and here. [...]

]]>