Statistical Modelling of Computer Network Traffic Event Times

Understand

This paper introduces a statistical model for the arrival times of connection events in a computer network.

• Edges between nodes in a network can be interpreted and modelled as point processes where events in the process indicate information being sent along that edge.
• A model of normal behaviour can be constructed for each edge in the network by identifying key network user features such as seasonality and self-exciting behaviour, where events typically arise in bursts at particular times of day.
• When monitoring the network in real time, unusual patterns of activity could indicate the presence of a malicious actor.