Changepoint problems deal with detecting anomalies or more generally changes in patterns. In the sequential setting, as long as the behavior of observations is consistent with the ``normal state," one is content to let the process continue. If the state changes, then one is interested in detecting that a change is in effect, usually as quickly as possible. Any detection policy may give rise to false alarms and attempting to avoid false alarms too strenuously will lead to a long delay between the time of occurrence of the change and its detection. The gist of the changepoint problem is to produce a detection policy that minimizes the average detection delay subject to a bound on the false alarm rate.
While the quickest changepoint detection problem has been studied for over fifty years, there has been remarkably little prior work on theoretical extensions to general stochastic models that go beyond independent and identically distributed observations in the pre- and post-change modes, and to the distributed sensor setting. The goal of this project is to investigate the properties of known changepoint detection procedures and to develop novel procedures for change detection and classification under general system models that are relevant in practical applications, as well as to provide an analytical framework to predict their performance. The usefulness of the theoretical advances will be demonstrated through two key application areas: (a) the rapid detection of intrusions and disruptions in computer networks, and (b) the efficient monitoring of critical infrastructures. In both cases, the distributions of the noisy observations change, and this change occurs at an a priori unknown point in time. Also, in both cases, the detection should be performed in a timely manner, while keeping the false alarm rate at an acceptable level. Our results will be validated using simulations as well as real data (to the extent possible).
