Parameter estimation for sums of correlated gamma random variables. Application to anomaly detection in internet traffic

A new family of distributions, constructed by summing two correlated gamma random variables, is studied. First, a simple closed form expression for their density is derived. Second, the three parameters characterizing such a density are estimated by using the maximum likelihood (ML) principle. Numerical simulations are conducted to compare the performance of the ML estimator against those of the conventional estimator of moments. Finally, a multiresolution multivariate gamma based modeling of Internet traffic illustrates the potential interest of the proposed distributions for the detection of anomalies. Aggregated times series of IP packet counts are split into adjacent non overlapping time blocks. The distribution of the resulting time series are modeled by the proposed multivariate gamma based distributions, over a collection of different aggregation levels. The anomaly detection strategy is based on tracking changes along time of the corresponding multiresolution parameters.