EWMA techniques for computer intrusion detection through anomalous changes in event intensity

Nong Ye, Connie Borror, Yebin Zhang

Research output: Contribution to journalArticlepeer-review

27 Scopus citations


Intrusion detection is used to monitor and capture intrusions into computer and network systems, which attempt to compromise the security of computer and network systems. To protect information systems from intrusions and thus assure the reliability and quality of service of information systems, it is highly desirable to develop techniques that detect intrusions into information systems. Many intrusions manifest in dramatic changes in the intensity of events occurring in information systems. Because of the ability of exponentially weighted moving average (EWMA) control charts to monitor the rate of occurrences of events based on the their intensity, we apply three EWMA statistics to detect anomalous changes in the events intensity for intrusion detections. They include the EWMA chart for autocorrelated data, the EWMA chart for uncorrelated data and the EWMA chart for monitoring the process standard deviation. The objectives of this paper are to provide design procedures for realizing these control charts and investigate their performance using different parameter settings based on one large dataset. The early detection capability of these EWMA techniques is also examined to provide the guidance about the design capacity of information systems.

Original languageEnglish (US)
Pages (from-to)443-451
Number of pages9
JournalQuality and Reliability Engineering International
Issue number6
StatePublished - Nov 2002


  • Anomaly detection
  • Computer audit data
  • Exponentially weighted moving average (EWMA)
  • Information assurance
  • Intrusion detection

ASJC Scopus subject areas

  • Safety, Risk, Reliability and Quality
  • Management Science and Operations Research


Dive into the research topics of 'EWMA techniques for computer intrusion detection through anomalous changes in event intensity'. Together they form a unique fingerprint.

Cite this