Time-window based multi-stage sampling
A sampling approach for time-window based multi-stage sampling. The sampling system defines multiple time windows for sampling communications received by a computing system. The time windows are segmented into multiple time intervals. A portion of the multiple time intervals are randomly selected for sampling. A portion of the communications received during the selected time intervals are captured for security assurance purposes.
1 . A method, comprising:
determining, by a sampling system and for security evaluation, a time window for validation of communications received by a computer system, wherein the sampling system is implemented using one or more computing nodes;
segmenting, by the sampling system, the time window into multiple time intervals;
randomly selecting, by the sampling system, a set of time intervals from the multiple time intervals for sampling;
capturing, by the sampling system, every k-th communication of the communications received by the computer system within the selected set of time intervals; and
performing one or more security assurance procedures with the captured communications, the performing comprising verifying that a source of a captured communication, of the captured communications, is authorized to access the computer system.
2 . The method of claim 1 , further comprising:
determining, by the sampling system, k values for each time interval within the selected set of time intervals, the k values defining the k-th communication for the capturing.
3 . The method of claim 2 , wherein determining the k values comprise:
determining historical data transaction amounts corresponding to each time interval within the selected set of time intervals, wherein the k values for each time interval are determined based on the corresponding historical data transaction amounts.
4 . The method of claim 1 , wherein randomly selecting the set of time intervals comprises:
determining a threshold percentage of the multiple time intervals to be selected;
randomly selecting a percentage of the multiple time intervals to be included in the set of time intervals, wherein the percentage of the multiple time intervals selected is greater than or equal to the threshold percentage.
5 . The method of claim 1 , wherein segmenting the time window comprises:
determining a number of equally sized time intervals into which the time window is to be segmented; and
segmenting the time window into the number of equally sized time intervals to produce the multiple time intervals.
6 . The method of claim 1 , wherein every k-th communication is captured in real time for processing.
7 . The method of claim 1 , further comprising:
determining, by the sampling system, a corresponding processor to which to direct each communication captured; and
directing each communication captured to the determined corresponding processor for processing.
8 . The method of claim 1 , further comprising:
determining, by the sampling system, a number of communications to be captured to provide a confidence level for the validation; and
determining, by the sampling system, k values for each time interval within the set of time intervals based on the determined number of communications, the k values defining the k-th communication for capturing.
9 . The method of claim 8 , wherein the number of communications is determined to be
n
′
=
n
1
+
Z
2
p
^
(
1
-
p
^
)
ε
2
N
,
wherein n′ is the number of communications, wherein n is equal to
z
2
p
ˆ
(
1
-
p
ˆ
)
ε
2
,
z is a defined z score, ε is a defined margin of error, N is a population size, and {circumflex over (p)} is a population proportion.
10 . The method of claim 8 , wherein the number of communications is determined to be
n
=
z
2
p
^
(
1
-
p
^
)
ε
2
,
wherein n is the number of communications, ε is a defined margin of error, and {circumflex over (p)} is a population proportion.
11 . The method of claim 1 , further comprising:
determining, by the sampling system, that a number of communications captured within a first time interval of the set of time intervals is less than or equal to a threshold number of communications; and
capturing, by the sampling system, every k-th communication within a second time interval for validation, the second time interval being a next subsequent unselected time interval within the time window from the first time interval.
12 . The method of claim 11 , further comprising:
determining, by the sampling system, a k value for the second time interval, the k value defining the k-th communication for the capturing with the second time interval.
13 . The method of claim 12 , wherein determining the k value comprises determining a first historical data transaction amount corresponding to the second time interval, wherein the k value for the second time interval is determined based on the first historical data transaction amount.
14 . The method of claim 1 , further comprising:
determining, by the sampling system, k values for each time interval within the selected set of time intervals using
k
=
[
e
(
d
i
*
p
)
]
,
wherein e is an estimated population within a time interval, d is a desired sample size within the time window, i is an amount of the multiple time intervals, and p is a percentage of the multiple time intervals selected for the selected set of time intervals.
15 . The method of claim 1 , wherein communications captured by the capturing of every k-th communication are utilized for a security assurance determination.
16 . One or more computer-readable media having instructions stored thereon, wherein the instructions, when executed by a sampling system, cause the sampling system to:
determine, for security evaluation, a time window for validation of communications received by a computer system, wherein the sampling system is implemented using one or more computing nodes;
segment the time window into multiple time intervals;
randomly select a set of time intervals from the multiple time intervals for sampling;
capture every k-th communication of the communications received by the computer system within the selected set of time intervals; and
perform one or more security assurance procedures with the captured communications, the performing comprising verifying that a source of a captured communication, of the captured communications, is authorized to access the computer system.
17 . The one or more computer-readable media of claim 16 , wherein the instructions, when executed by the sampling system, further cause the sampling system to:
determine k values for each time interval within the selected set of time intervals, the k values defining the k-th communication for the capturing.
18 . The one or more computer-readable media of claim 17 , wherein to determine the k values comprises to determine historical data transaction amounts corresponding to each time interval within the selected set of time intervals, wherein the k values for each time interval are determined based on the corresponding historical data transaction amounts.
19 . A sampling system, comprising:
memory to store samples; and
one or more processors coupled to the memory, the one or more processors to:
determine, for security evaluation, a time window for validation of communications received by a computer system, wherein the sampling system is implemented using one or more computing nodes;
segment the time window into multiple time intervals;
randomly select a set of time intervals from the multiple time intervals for sampling;
capture every k-th communication of the communications received by the computer system within the selected set of time intervals; and
performing one or more security assurance procedures with the captured communications, the performing comprising verifying that a source of a captured communication, of the captured communications, is authorized to access the computer system.
20 . The sampling system of claim 19 , wherein to randomly select the set of time intervals comprises to:
determine a threshold percentage of the multiple time intervals to be selected;
randomly select a percentage of the multiple time intervals to be included in the set of time intervals, wherein the percentage of the multiple time intervals selected is greater than or equal to the threshold percentage.