Application of multivariate cumulative sum control charts for detecting cyber attacks

The rapid growth of cyberattacks necessitates the development of advanced anomaly detection methods in network traffic. Traditional univariate statistical control charts, such as Shewhart, CUSUM, and EWMA, face limitations in handling correlated network parameters, leading to missed anomalies or false alarms. This study addresses these challenges by exploring the application of multivariate cumulative sum control charts (MCUSUM) for detecting cyberattacks, emphasizing their ability to account for interdependencies among traffic features. The primary problem lies in the inefficiency of univariate methods in capturing complex correlations within network traffic parameters, which are critical for identifying sophisticated attacks. The study aims to evaluate the effectiveness of MCUSUM variants (Healy, Crosier, Pignatiello-Runger) and Hotelling’s Т2 charts in detecting anomalies caused by cyberattacks. The goal is to determine optimal methods for different attack scenarios, balancing precision, recall, and computational efficiency. The research employs the CSE-CIC-IDS2018 dataset, a comprehensive resource containing labeled examples of normal and attack traffic. Fourteen key features, such as flow duration, packet rates, and header lengths, were selected to train and test the models. Multivariate methods were implemented as follows: Hotelling’s Т2 charts monitor deviations in multivariate means using covariance structures, ideal for abrupt changes like DDoS attacks. Healy’s method projects data onto a predefined shift direction, suitable for predictable attack patterns. Crosier’s approaches adaptively accumulate deviations, reducing false positives for unidirectional anomalies (e.g., traffic flooding). Pignatiello-Runger’s techniques combine long-term trend analysis with quadratic forms, balancing sensitivity and computational load. Experiments revealed distinct performance profiles: Crosier-2 achieved the highest precision (94%) and recall (90%) for small-to-moderate shifts, demonstrating robustness against low-intensity attacks. Pignatiello-Runger-1 excelled in detecting large shifts (93% recall), making it suitable for high-impact attacks. Hotelling’s Т2 showed lower sensitivity to gradual changes (75% recall) but remained effective for sudden traffic spikes (93% precision). Healy’s method, while precise (85%), required prior knowledge of attack vectors, limiting its versatility. The integration of MCUSUM charts into intrusion detection systems (IDS) enhances their capability to identify both known and novel threats, including stealthy malware and low-and-slow attacks. By leveraging multivariate correlations, these methods reduce false alarms and accelerate response times, critical for protecting critical infrastructures. For instance, Crosier-2’s adaptability makes it ideal for real-time monitoring in dynamic networks, while Pignatiello-Runger’s hybrid approach offers a balance for resource-constrained environments. This study underscores the importance of selecting context-appropriate multivariate control charts. Hotelling’s Т2 remains indispensable for detecting abrupt anomalies, whereas MCUSUM variants provide superior performance for subtle, persistent deviations. Future work should focus on optimizing parameter tuning and integrating machine learning to further enhance adaptability. The findings contribute significantly to advancing cybersecurity frameworks, ensuring robust defense mechanisms against evolving cyber threats.