Multivariate T² control chart based on james-Stein and successive difference covariance matrix estimators for intrusion detection

computer system or network and analyse the monitoring results to find signs of intrusion. The multivariate control chart, which is often used in the intrusion detection system, is Hotelling's T². In this study, the Hotelling's T² chart performance for intrusion detection is improved using the successive difference covariance matrix to estimate the covariance matrix and James-Stein estimator to estimate the mean vector. The control limits of the proposed chart are calculated using kernel density estimation. The performance of the proposed method, using T² based on kernel density estimation control limit, outperforms the other control chart approaches in both training and testing dataset.