I am looking at approaches to detect anomalies in network traffic in terms of packets being sent with a very short inter-arrival time (IAT). Said differently, the longer (possibly) uniform IATs would be treated as normal observations while clusters of very short IATs should be treated as an anomaly.
I was looking into CUSUM via the R package qcc, the majority of the examples look at slight deviances from the normal as a means to detect anomalies with an upper and lower bound. When I ran a contrived dataset through the qcc function, the short time values are reported as run violations and some of my longer IATs are actually flagged as beyond limits.
I'm wondering if CUSUM is really the right choice here?
Furthermore, would it make more sense to model the distribution of the steady-state IATs and then compare to the distribution of the clustered distribution to infer abnormal behaviour?
As I can't 100% guarantee my data is 100% Gaussian; so GMM may not be appropriate.
Any suggestions much appreciated, I am happy to try multiple approaches until I find one that works.