近年來，全球在金融科技的投資快速增長。一些金融公司運用技術來改善他們的服務。例如，J.P. Morgan Chase & Co.（JPM）讓客戶透過他們的網站進行網路貸款。但也因為金融科技的發展，金融公司必須面對更大量的網路攻擊。其中較著名的攻擊是分散式拒絕服務(DDoS) 攻擊。它被用於攻擊金融公司的伺服器，使網路服務無法正常使用。 為了偵測DDoS 攻擊，我們提出了一種方法，藉由監控大量檢測器來偵測出其中一小部分檢測器中的數據流產生的分配變化。它可以看作是同時監控大量路由器，每個路由器都會接收到網路流量。當駭客發起攻擊時，其中一小部分路由器接收到異常流量，因此分配產生變化。而我們的目的就是及早發現這些變化，藉此減低駭客攻擊所造成的損失。在本文中，我們證明當檢測器的數目趨近於無窮大時，漸進最佳的檢測延遲取決於一小部分檢測器中數據流的分配變化。本文考慮了三種情況。一是我們所監控的檢測器中大部分的檢測器其數據流分配都產生變化，那我們會立即發現變化。二是在我們所監控的檢測器中，一小部分的檢測器其數據流分配產生變化，則檢測延遲隨著檢測器的數量呈對數增長。三則是在我們所監控的檢測器中，只有非常少的檢測器其數據流分配產生變化。;In the recent years, global investment in FinTech increase rapidly. Some financial companies use technology to improve their service. For example, the retail banking website of J.P. Morgan Chase & Co. (JPM) allows customers to make online loans through their website. Because of the development, financial companies have to face more cyberattacks than before. One of the famous attack is Distributed Denial of Service (DDoS) attack. It is used to shot down the servers of financial companies, so that network services can not be used. In order to detect DDoS attack, we propose a method to detect the distribution changes in a fraction of data streams under a large number of detectors. It can be seem as monitoring a large number of routers at the same time, and each router receives network traffic. When hacker launch an attack, a fraction of routers will receive abnormal traffic. Our task is to detect the change as quickly as possible, to reduce the loss. In this paper, we show how the nearly optimal detection delay depends on the fraction of data streams undergoing distribution changes as the number of detectors goes to infinity. There are three detection domains. In the first domain for moderately large fractions, immediate detection is possible. In the second domain for smaller fractions, the detection delay grows logarithmically with the number of detectors. In the third domain for even smaller fractions.
