EWMA Based Threshold Algorithm for Intrusion Detection


  • Petar Čisar
  • Saša Bošnjak
  • Sanja Maravić Čisar


Intrusion detection, EWMA, threshold algorithm, optimization, network traffic, autocorrelation


Intrusion detection is used to monitor and capture intrusions into computer and network systems which attempt to compromise their security. Many intrusions manifest in dramatic changes in the intensity of events occuring in computer networks. Because of the ability of exponentially weighted moving average control charts to monitor the rate of occurrences of events based on their intensity, this technique is appropriate for implementation in threshold based algorithms.


Download data is not yet available.

Author Biographies

Petar Čisar

Telekom Srbija
Prvomajska 2-4
Subotica, Serbia

Saša Bošnjak

Faculty of Economics
Segedinski put 9-11
Subotica, Serbia

Sanja Maravić Čisar

Subotica Tech
Marka Oreškovica 16
Subotica, Serbia




How to Cite

Čisar, P., Bošnjak, S., & Čisar, S. M. (2012). EWMA Based Threshold Algorithm for Intrusion Detection. COMPUTING AND INFORMATICS, 29(6+), 1089–1101. Retrieved from https://www.cai.sk/ojs/index.php/cai/article/view/133