Parameter estimation for sums of correlated gamma random variables. Application to anomaly detection in Internet Traffic

Abstract : A new family of distributions, constructed by summing correlated gamma random variables, is studied. First, a simple closed-form expression for their density is derived. Second, the three parameters characterizing such a density are estimated by using the maximum likelihood (ML) principle. Numerical simulation are conducted to compare the performance of the ML estimator against those of the conventional estimator of moments. Finally, a multiresolution multivariate gamma based modeling of Internet traffic illustrate the potential interest of the proposed distributions for the detection of anomalies. Aggregated times series of IP packet counts are split into adjacent non overlapping time blocks. The distribution of these series are modeled by the proposed multivariate gamma based distributions, over a collection of different aggregation levels. The anomaly detection strategy is based on tracking changes along time of the corresponding multiresolution parameters.