Variable Window Scan Statistics for Poisson Processes

We present methods to do fast online anomaly detection using scan statistics. Scan statistics have long been used to detect statistically significant bursts of events. We extend the scan statistic framework to handle many practical issues that occur in application: dealing with an unknown background rate of events; allowing for slow natural changes in background frequency, the reverse problem of finding an unusual lack of events; and setting the test parameters to maximize power. We demonstrate the utility of these improvements on real and synthetic data sets with comparison to other methods.