We consider online monitoring of the network event data to detect local changes in a cluster when the affected data stream distribution shifts from one point process to another with different parameters. Specifically, we are interested in detecting a change point that causes a shift of the underlying data distribution from a Poisson process to a multivariate Hawkes process with exponential decay temporal kernel, whereby the Hawkes process is considered to account for spatio-temporal between observations. The proposed detection procedure is based on scan score statistics. We derive the asymptotic distribution of the statistic, which enables the self-normalizing property and facilitates the approximation of the false alarm rate and the average run length. Thus, when detecting a change from Poisson to Hawkes process with non-vanishing self-excitation, the procedure does not require estimating the post-change network parameter while assuming the temporal decay parameter. We further present an efficient procedure to accurately determine the false discovery rate via importance sampling, as validated by numerical examples. The good performance of our procedures compared with the benchmarks is tested with numerical experiments with simulated and real stock exchange data.
View on arXiv