Scalable chi-square distance versus conventional statistical distance for process monitoring with uncorrelated data variables

Multivariate statistical process control charts are often used for process monitoring to detect out-of-control anomalies. However, multivariate control charts based on conventional statistical distance measures, such as the one used in the Hotelling's T-2 control chart, cannot scale up to large amounts of complex process data, e.g. data with a large number of variables and a high rate of data sampling. In our previous work we developed a multivariate statistical process monitoring procedure based on a more scalable chi-square distance measure and tested this procedure for detecting out-of control anomalies-intrusions-in a computer process using computer audit data. The testing results demonstrated the comparable performance of the scalable chi-square procedure to that of Hotelling's T-2 control chart. To establish the chi-square procedure as a generic, viable multivariate statistical processing monitoring procedure, we conduct a series of further studies to understand the detection power and limitations of the chi-square procedure for processes with various kinds of data and various types of out-of-control anomalies in addition to the scalability and demonstrated performance of the chi-square procedure for computer intrusion detection. This paper reports on one of these studies that investigates the effectiveness of the scalable chi-square procedure in detecting out-of-control anomalies in processes with uncorrelated data variables, each of which has a normal probability distribution. The results of this study indicate that the chi-square procedure is at least as effective as Hotelling's T-2 control chart for monitoring processes with uncorrelated data variables. Copyright (C) 2003 John Wiley Sons, Ltd.