Abstract
It is often assumed that events cannot occur simultaneously when modelling data with point processes. This raises a problem as realworld data often contains synchronous observations due to aggregation or rounding, resulting from limitations on recording capabilities and the expense of storing high volumes of precise data. In order to gain a better understanding of the relationships between processes, we consider modelling the aggregated event data using multivariate Hawkes processes, which offer a description of mutuallyexciting behaviour and have found wide applications in areas including seismology and finance. Here we generalise existing methodology on parameter estimation of univariate aggregated Hawkes processes to the multivariate case using a Monte Carlo expectation–maximization (MCEM) algorithm and through a simulation study illustrate that alternative approaches to this problem can be severely biased, with the multivariate MCEM method outperforming them in terms of MSE in all considered cases.
Similar content being viewed by others
Avoid common mistakes on your manuscript.
1 Introduction
Modern data acquisition systems in many applications collect vast amounts of data that can be characterised as time series. An area of particular interest is cybersecurity, where network data are recorded and questions arise about the correlation structure and ‘excitational’ effects in and between the resulting time series. We aim to uncover trends within and between such time stamped event data, which we model using point processes. For this, we are particularly interested in the multivariate Hawkes process, which provides a model for ‘mutually exciting’ events. Introduced in Hawkes (1971a, 1971b) primarily to model the occurrence of seismic activity, multivariate Hawkes processes have found wide application to many disciplines due to their ability to model crossexcitation. In the case of financial data, multivariate Hawkes processes have been used to model the joint dynamics of trades and midprice changes of the NYSE (Bowsher 2007) and an overview of literature surrounding the application of these processes to finance is given in Bacry et al. (2015). Additionally Hawkes processes have been considered within cybersecurity for modelling of computer network traffic (Mark et al. 2019; PriceWilliams and Heard 2019) and social media activity, for example in Kobayashi and Lambiotte (2016) where propagation of ‘Twitter cascades’ is considered. As discussed in Shlomovich et al. (2022) practical limitations on storing or recording high resolution data results in an abundance of binned data, that is streams of counts of occurrences per time bin. We can use the counting process representation of a Pvariate point process to model this binned data. Let \(N^{(p)}(t)\) be the pth continuous time count process (\(p= 1, \ldots , P\)) denoting the number of events until time \(t \in {\mathbb {R}}\) where \(N^{(p)}(0) = 0\), \(N^{(p)}(t) = N^{(p)}((0,t])\) for \(t > 0\) and \(N^{(p)}((t,0])\) for \(t < 0\). We further denote
to be the binned (aggregated) process. Then the discretetime vector process \(\varvec{N}_t\) is given by
where \(K = T/\varDelta \) and \(\varDelta \) is the bin width. Here we develop and extend the methodology detailed in Shlomovich et al. (2022) to handle parameter estimation of multivariate binned Hawkes processes. We do this by considering the superposition of the multivariate count process. This is an elegant method which manages to replicate both the marginal and the crosscorrelation structure of the true process. Results from a simulation study, comparing the extended MCEM algorithm to both the INAR(p) and binned loglikelihood approximations are presented in Sect. 3. This method is shown to produce estimates with lower MSE than currently available alternatives. We additionally derive the Hessian of a multivariate Hawkes process with exponential kernel, required for optimization, and present this in “Appendix B” along with the gradient derived in Ozaki (1979).
1.1 Multivariate Hawkes processes
Formally, the Pdimensional Hawkes process \(\varvec{N}(t) = \left[ N^{(1)}(t), \ldots , N^{(P)}(t)\right] \) is a class of stochastic process such that independently for each \(p \in \{1, \ldots P\}\),
where \(\mathrm {d} N^{(p)}(t)=N^{(p)}(t+\mathrm{{d}}t)N^{(p)}(t)\) (Hawkes 1971a). It is characterized via its conditional intensity function (CIF) \(\lambda _{(p)}^{*}(t),\) defined as
where \(\varvec{\nu }>0\) is a Pdimensional vector called the background intensity and \(\varvec{g}(u)\) is the nonnegative excitation kernel such that \(\varvec{g}(u) = 0\) for \(u < 0\) and given by a \(P \times P\) matrix of functions. In this way, the intensity at an arbitrary timepoint is dependent on the history of the multivariate process allowing for both self and mutually exciting behavior. In simple cases, if \(g_{ij}(u)=0\) for all u and \(i \ne j\), then this is noncross exciting behavior. That is the crosscovariances are equal to zero and whilst the processes may be self exciting, they are independent and thus not mutually exciting (Hawkes 1971a). Further, in the bivariate case if \(g_{21}(u)=0\) for all u but \(g_{12} (u) \ne 0\) for all u then \(N^{(1)}(t)\) does not affect the likelihood of events in \(N^{(2)}(t)\), but the converse does not hold. In this case we have one way interaction between the two processes involved.
The CIF from (1) can be written for an exponential kernel as
where \(\varvec{\nu }\), \(\varvec{\alpha } = \left( \alpha _{pm} \right) \), \(\varvec{\beta } = \left( \beta _{pm} \right) \), \(p,m = 1, \ldots P\) are known as the baseline, excitation and decay parameters, respectively. Assuming stationarity of the multivariate Hawkes process we have that the vector of stationary densities is
so that
where \({\varvec{G}}(\omega )\) is the Fourier transform of the excitation kernel \(\varvec{g}(\cdot ),\) given by
Note that \(\varvec{G}(0)\) is commonly referred to as the branching ratio, typically denoted by \(\varvec{\gamma }\), with the condition for stationarity being that the spectral radius \(\rho (\varvec{\gamma })<1\) (Hawkes 1971b).
2 Multivariate MCEM for binned Hawkes processes
In a continuous time framework, maximum likelihood estimation (MLE) can be used to estimate the model parameters from a set of exact multivariate events on the interval [0, T] (Ozaki 1979) denoted
where T is the maximum observation or simulation time, \(t^p_l\) is the lth event in process p, and \(N^{(p)}(T)\) is the total number of events in process p. When we observe an aggregation of these latent continuous times to a count process of events per time bin, we lose information and in particular the likelihood of our observed event times given a parameter set can no longer be computed exactly due to reliance on the underlying timestamps. In particular, the Hawkes process which is defined by its CIF, depends on the history of the process, which if ‘blurred’ by binning or rounding requires correct handling in order to obtain meaningful parameter estimates. In the univariate setting, a method for parameter estimation based on the Whittle likelihood is presented in Cheysson and Lang (2022) and a modified Monte Carlo Expectation Maximisation (MCEM) approach is presented in Shlomovich et al. (2022), termed the Binned Hawkes Expectation Maximisation (BHEM) algorithm; which is extended here for multivariate data.
2.1 The Monte Carlo EM algorithm
The EM algorithm (Dempster et al. 1977) augments observed data by a latent quantity (Wei and Tanner 1990) to iteratively compute the maximizer of a likelihood. Here, the observed data are the multivariate event counts per unit time \( \varvec{N}_t = [N^{(1)}_{t}, \ldots , N^{(P)}_{t}]. \) The latent data, \(\varvec{{\mathcal {T}}}\) are the unobserved, true event times. These are marked timestamps which are not observed due to practical restrictions. We denote the parameter set to be \(\varvec{\varTheta }=\{\varvec{\nu }, \varvec{\alpha }, \varvec{\beta }\}\), where \(\varvec{\nu }\) is \(P \times 1\), and \(\varvec{\alpha }\) and \(\varvec{\beta }\) are \(P \times P\). The following two steps are as detailed in Shlomovich et al. (2022):

1.
In the E (Expectation) step, we compute
$$\begin{aligned} Q_{i+1}(&\varvec{\varTheta }, \varvec{\varTheta }^i) = \nonumber \\&\int _{{\mathbb {T}}} \log (p (\varvec{\varTheta } \mid {\varvec{N}}, \varvec{{\mathcal {T}}})) p ( \varvec{{\mathcal {T}}} \mid {\varvec{N}}, \varvec{\varTheta }^i) \mathrm{{d}}\varvec{{\mathcal {T}}}, \end{aligned}$$(2)where \({\mathbb {T}}\) denotes the sample space for \(\varvec{{\mathcal {T}}}\).

2.
In the M (Maximization) step, maximize the conditional expectation in (2) to obtain the updated parameter estimate, \(\varvec{\varTheta }^{i+1}\).
Monte Carlo methods can be used to numerically compute (2) if it is intractable, forming an algorithm known as MCEM (Wei and Tanner 1990). As we cannot sample the timestamps directly we use importance sampling to simulate proposals \(\varvec{{\mathcal {T}}}^*\) for \(\varvec{{\mathcal {T}}}\) from a feasible alternative distribution, denoted \(q(\varvec{{\mathcal {T}}} \mid {\varvec{N}}, \varvec{\varTheta }^i)\).
Unique to the multivariate formulation is the need to retain the latent covariance structure between the P processes. To this end, we sample the times of the univariate superposition of the Pvariate process. We then split the superposed simulated timestamps to P processes to create proposals matching the multivariate counts. We refer to such viable proposals as consistent. This approach is detailed further in Sect. 2.2. Once sampled, each proposal is weighted according to the probability it came from the desired distribution. That is, given a set of M samples \(\varvec{{\mathcal {T}}}^{*(1)},\ldots ,\varvec{{\mathcal {T}}}^{*(M)}\), we assign weights
and approximate (2) with
It is shown in Shlomovich et al. (2022) that if only proposing consistent event times
where \(\log \left( p(\varvec{{\mathcal {T}}}^{*(k)}\mid \varvec{\varTheta }) \right) \) is given in Daley and VereJones (2003) by
2.2 Multivariate sampling via the superposition process
Generating consistent timestamps for the latent multivariate process such that the true covariance structure is sufficiently captured is an important problem. We propose the following method for this, which allows us to extend the work in Shlomovich et al. (2022) for multivariate count data. Consider \(\varvec{N}_t=[N_{1,t}, \ldots , N_{P,t}]\) being a binned Pvariate Hawkes process with exponential kernel. In order to generate possible multivariate, continuoustime proposal, \(\varvec{{\mathcal {T}}}^{*}\), of the underlying event times, \(\varvec{{\mathcal {T}}}\), we first consider the superposed latent timestamps,
where \({\mathcal {T}}_p\) represents the set of latent times for the pth process, for \(p = 1, \ldots , P\), and thus the superposed binned count process
We map the multivariate parameter set \(\varvec{\varTheta }=\{\varvec{\nu }, \varvec{\alpha }, \varvec{\beta }\}\) to a corresponding set \({\tilde{\varTheta }} = \{{\tilde{\nu }}, {\tilde{\alpha }}, {\tilde{\beta }}\} \) which approximates the univariate superposed process.
It is given that the intensity of the superposed count process \({\tilde{N}}\) can be decomposed as
where \({\tilde{\lambda }}^*(t)\) is the CIF for the superposed process. Using (5) and \(\lambda ^*_p(t)\) defined in Eq. (1) we have that
We approximate the CIF of the superposed process with that of a univariate Hawkes process with exponential kernel and parameters \({\tilde{\varTheta }} = \{{\tilde{\nu }}, {\tilde{\alpha }}, {\tilde{\beta }}\} \). Doing so enables the cross and self excitation effects to be sufficiently captured by the internal correlation structure of the approximated superposed process, which is significantly simpler to generate proposals for. Specifically,
where \({\tilde{\lambda }}^*_{a}(t)\) is the approximated CIF. By equating terms in Eqs. (6) and (7), it is clear that the baseline for the superposed process is simple to handle, and can be defined as \({\tilde{\nu }} = \sum _{p=1}^P \nu _p\).
The choice of \({\tilde{\alpha }}\) and \({\tilde{\beta }}\) requires more care as, from the preceding two Equations, we approximate the contribution to the CIF from excitational effects as
To aid the choice of appropriate \({\tilde{\alpha }}\) and \({\tilde{\beta }}\) we utilise the stationarity intensity of a univariate Hawkes process. We have that
where \({\tilde{\lambda }}_{a}\) is the stationary intensity for \({\tilde{\lambda }}_a^*(t)\) and \({\tilde{\gamma }}\) is the branching ratio for \({\tilde{\lambda }}_a^*(t)\), equal to \({\tilde{\alpha }}/{\tilde{\beta }}\) due to the exponential form of the kernel. As the intensity of the superposed process can be decomposed, as in (5), the stationary intensities can similarly be decomposed. Therefore we have that
where \(K \varDelta = T \). Noting that \({\tilde{\nu }} = \sum _{p=1}^P \nu _p\), we thus have
The relationship in Eq. (9) aids the choice of \({\tilde{\alpha }}\) and \({\tilde{\beta }}\) such that we retain a consistent stationary intensity under the approximation of the CIF with the exponential kernel given in Eq. (7). Further, the form in Eq. (9) is simple to compute as \(E\{N_p (T)\}\) is well approximated by the mean number of events in each process.
We find that a suitable choice for \({\tilde{\beta }}\) is
where \(\omega _{m}\) is the proportion of total events which are observed in process m. This form is reached by considering Eq. (8). The decay rate across events can approximately be given by the mean of the multivariate decays, weighted according to the proportion of events in each process. The benefit of weighting the mean can be seen by reasoning about the case when the processes have significantly different numbers of events. Combining (10) with the relationship for \({\tilde{\gamma }}\) in Eq. (9) we have
It is important to note that as this reparameterisation does not rely on any latent continuous timepoints, but rather just the observed counts and current multivariate parameter estimates, it is efficient to implement in practice.
Empiricial studies show this reparameterization accurately recovers the true CIF of the superposed process. In this way we only simulate a univariate process, albeit a superposed version, and denote the simulated times as \(\tilde{{\mathcal {T}}}^{*}\). In order to generate a realisation of the multivariate Hawkes process, \(\varvec{{\mathcal {T}}}^{*}\), with crosscovariances, we can then uniformly sample the observed number of events in each bin for each process from the \(\tilde{{\mathcal {T}}}^{*}\). In other words, we simulate a consistent set of continuous times for the superposed process matching the observed counts for \({\tilde{N}}(t)\), and then uniformly assign points within each bin to each of the P processes. To reduce variance of the estimates, the allocation of events to the P processes can be conducted \({\tilde{m}}\) times to generate multiple possible multivariate versions of the proposed realisation of \({\tilde{N}}\). If \({\tilde{m}}>1\), the sample which maximises the loglikelihood is selected, otherwise the single multivariate proposal is taken and the MLE is used to estimate the parameters of the multivariate process from the continuoustime proposed realisation. We present results for \({\tilde{m}}=10\) in Sect. 3.
This method provides us with an efficient way of artificially injecting crosscorrelation into the consistent proposals whilst also retaining the marginal properties. In order to speed up the maximisation of the likelihood, we require the gradient and Hessian, given in “Appendix B”. The full algorithm for this multivariate approach is derived and presented in “Appendix C”.
2.3 Sampling method
The question remains of how to best sample the latent times. The sequential simulation method detailed in Shlomovich et al. (2022) is applicable in the multivariate extension due to the reparameterization step meaning we need only sample times for the univariate superposition process. In this case, the normalised weight of the kth Monte Carlo sample (\(k=1, \ldots , M\)) is given by
where M is the number of Monte Carlo samples. Further we note that
where \( \log \left( q\left( \tilde{{\mathcal {T}}}^{*(k)} \mid {\tilde{N}}, {\tilde{\varTheta }}^{i}\right) \right) \) is the loglikelihood of the sequentially sampled superposed times given the superposed counts and reparameterized univariate estimates, and \( \mathrm{{Pr}} \left( \varvec{{\mathcal {T}}}^{*(k)} \mid \tilde{{\mathcal {T}}}^{*(k)} , {\varvec{N}} \right) \) denotes the probability of the random division of superposed timepoints into a Pvariate count process matching the observed counts.
Large differences between \(p\left( \varvec{{\mathcal {T}}}^{*(k)} \mid \varvec{N}\right) \) and \(q(\varvec{{\mathcal {T}}}^{*(k)} \mid \varvec{N})\) can result in the weights being close to zero. Therefore we rescale the exponent term to avoid arithmetic underflow when computing the weights. We have
3 Simulation study
We conduct a simulation study to compare the performance of the multivariate MCEM algorithm to the INAR(p) method introduced in Kirchner (2016). We also compare the results to an approximation which ignores interbin excitation, referred to as the binned loglikelihood method. This approach represents the CIF as a piecewise constant function within each bin, equivalently assuming that \(N_j^{(p)} \sim \mathrm{{Poisson}} \{ \varDelta \lambda ^*_{m} \left( [j1] \varDelta \right) \}\), where \(N_j^{(p)}\) are the counts in the jth bin of the pth process (Mark et al. 2019).
Given parameters \(\varvec{\nu },\) a \(2 \times 1\) matrix, and \(\varvec{\alpha }\) and \(\varvec{\beta }\) both being \(2 \times 2\) matrices, along with some maximum simulation time T, we can simulate realizations of a Hawkes process. The generated events \(\varvec{{\mathcal {T}}}\) represent the underlying process and aggregating these to a chosen binning \(\varDelta \) allows us to simulate the count data \(\{\varvec{N}_t, \, t=1, \ldots , K \}\). We then apply each of the multivariate MCEM methods, INAR(p) and binned loglikelihood approximation.
Boxplots for each of the ten estimated parameters used for characterising the bivariate Hawkes process are given in Fig. 1. The parameters used for simulation are
with \( \varDelta = 1\) and \(T = 2000\). The parameters have been chosen as a stationary case with ample crossexcitation and nonsymmetric selfexcitation. The mean parameter estimates from repeated simulations is presented on the vertical axis. The INAR(p) approximation method can yield highly variable results, which is to be expected as the method is primarily intended for selecting a parametric kernel from continuous time data. The usual implementation of the INAR(p) involves selecting \(\varDelta \) such that there is approximately one event per bin, however for our application this is not possible and so the choice of \(\varDelta \) here is chosen to better reflect real data. A logscale has been used in all four graphs relating to each of \(\varvec{\alpha }\) and \(\varvec{\beta }\). Both the binned loglikelihood, and particularly the INAR(p) method produced large outliers, resulting in very large MSE relative to the MCEM approach. Tables 1 and 2 present summary statistics for the outliertrimmed data. Specifically we remove the top and bottom 5% of parameter estimates for each of the three methods and report the relative bias, mean and standard deviation for each of the parameters and methods. We see that even after removing outliers and negative values from the INAR(p) parameter estimates, the variability is much higher than that of the MCEM. The absolute value of the bias of both the INAR(p) and binned loglikelihood approaches is also larger than that of the MCEM, in some cases significantly so. Overall, the proposed MCEM approach has much improved estimation performance than the other methods. Table 3 additionally presents the ratio between the RMSE using \(T=2000\) and \(T=1000\) for each of the estimation approaches, using 300 Hawkes process realizations for each method. By fixing \(\varDelta \), this allows the effect of doubling the number of bins K to be explored. As with the MLE, for the proposed MCEM method, it is expected that the RMSE reduces by approximately a factor of \(1/\sqrt{2}\) when doubling K. We find that the mean RMSE ratio across the 10 parameters is 0.762 for the MCEM method, and 0.725 for the MLE acting on the continuous time points. However both the INAR(p) and binned loglikelihood methods have a significantly higher mean ratio, of 0.875 and 0.990 respectively.
Evaluation of the methods is additionally explored via goodness of fit. This is an important aspect which allows us to check the validity of the estimates given the data. Often, the random change theorem, given in Daley and VereJones (2003), is used for considering goodness of fit by transforming timepoints using the compensator function
where \({t^p_k}\) is the \(k\mathrm{{th}}\) event in process p. In practice, \(\lambda _{(p)}^{*}(u)\) is estimated using parameter estimates \(\hat{\varvec{\varTheta }}\), and goodness of fit is conducted by considering the distribution of the transformed times, defined as \({\mathcal {T}}^{\dagger } = \{t^{\dagger }_1, t^{\dagger }_2, \ldots \} = \{\varLambda (t_1), \varLambda (t_2), \ldots \}\). By the random time change theorem, \({\mathcal {T}}^{\dagger }\) is a realization of a unit rate Poisson process if and only if \({\mathcal {T}}\) is a realization from the point process defined by \(\varLambda (\cdot )\).
Figure 2 shows QQplots relating to count processes from the simulation study. The continuous times from a single realization of a Hawkes process generated in the simulation study are transformed using each of the parameter estimates from the three approaches considered. The QQplots then compare the distribution of the interarrival times between each of the transformed times and a unit rate exponential distribution. We see that the estimates produced by the MCEM algorithm are indeed a viable parameter set for this realization under an exponential Hawkes model, with the transformed timepoints being distributed very close to the theoretical distribution. We also note that as the binned loglikelihood method ignores the effect of interbin excitation, it is expected that as the average number of counts in a bin increases, the fit from using this method will worsen. Whilst the QQplots given in Fig. 2 demonstrate the viability of the estimated parameters for a specific realization, in order to illustrate goodness of fit across all realizations in the simulation study, Fig. 3 also presents the distribution of Kolmogorov–Smirnov (KS) test statistics. Here, the KS test is used to test the equality of the distribution of the transformed interarrival times to an Exp(1) distribution for each of the three methods considered. This is done for all realizations used in the simulation study, and the distribution of the resulting KS test statistics is presented in Fig. 3. The MLE is also used to produce parameter estimates from the true, continuous time stamps, with the resulting KS test statistics also given in Fig. 3 for easier interpretation. It is clear that the MCEM approach is far more comparable to the MLE results than the binned loglikelihood or INAR(p) methods.
Note, variance estimation has not been discussed here, but parametric bootstrapping would allow for approximations of this to be obtained (Efron 1987).
4 Case study
Network flow data, referred to as NetFlow, assembles records exported by routers and describes communications between devices connected to an enterprise network. Monitoring and analysing NetFlow data has been successful at detecting a range of malicious network behavior (Turcotte et al. 2018). Here we detect both selfexciting effects in the communication between a pair of network devices, termed here as an ‘edge’, and mutuallyexciting activity between such edges in the Los Alamos National Lab (LANL) enterprise network. By modelling the activity in this way, insight into the correlation structure of communications in the network can be obtained and monitored. We consider the methods outlined in Sect. 3 for parameter estimation of aggregated Hawkes processes as the NetFlow data is recorded at a 1 s resolution resulting in multiple events occurring simultaneously.
Figure 4 presents a selected pair of edges in the LANL network with possibe mutuallyexciting Hawkes behavior in the communications over a duration of 45 min, with a total of 171 events. We refer to the counts in the top plot as process 1 and the counts in the bottom plot as process 2. The window selected is chosen as a period of more frequent events surrounded by no activity.
Parameter estimates are found using the MCEM, INAR(p) and binned loglikelihood methods and performance is considered using goodness of fit. This allows us to assess whether the estimates represent viable parameters for modelling the observed data as a mutuallyexciting Hawkes process. To do this, we use the time rescaling theorem discussed in Sect. 3. Figure 5 shows QQplots for the observed times, uniformly redistributed within their respective bins so as to obtain continuous times for the purpose of assessing goodness of fit (Gerhard and Gerstner 2010). From Fig. 5, the parameter estimates obtained via the MCEM algorithm are likely viable parameters. The MCEM parameter estimates are
The branching ratio, defined in Sect. 1.1 is therefore
where \(\oslash \) denotes elementwise division and \(\gamma _{ij}\) is the average number of events in process j directly triggered by each event in process i.
These results indicate that there is mutuallyexciting behavior between these processes in one direction such that process 2 does not affect process 1 but process 1 does affect process 2, where process 1 is presented in blue in Fig. 4 and process 2 in red. There parameter estimates suggest that for each event in process 1, an average of 0.27 events will be triggered in process 2. The baseline parameters given by \(\varvec{\nu }\) indicate the rate of the events is approximately one event every 100 s. Both processes are modelled with selfexcitation, with each event in processes 1 and 2 triggering 0.34 and 0.28 events in their respective processes. Figure 6 shows the estimated excitation kernel components. From this we can see nature of the exciting effects, where \(g_{ij}(x)\) illustrates the excitational effect which process j has on process i.
5 Conclusion
We have presented a novel method for generalising an MCEM algorithm to handle multivariate aggregated data. By reparameterizing our multivariate model in terms of the superposed process we can inject the necessary crosscovariance structure required for generating valid proposals. We also present closed form expressions for the gradient and Hessian of the log likelihood for increased computational efficiency. We further conducted a simulation study to compare this approach to the INAR(p) approximation detailed in Kirchner (2016) and a multivariate extension of the binned log likelihood method from Mark et al. (2019) and Shlomovich et al. (2022). As in the univariate case, the MCEM method outperformed both alternatives in the presented parameter set and moreover the bin width, \(\varDelta \) can vary provided the interval bounds are known. The multivariate extension can be applied for other Hawkes kernels.
References
Bacry, E., Mastromatteo, I., Muzy, J.F.: Hawkes processes in finance. Mark Microstruct Liq 1(1), 1550005 (2015)
Bowsher, C.G.: Modelling security market events in continuous time: Intensity based, multivariate point process models. J. Econom. 141(2), 876–912 (2007)
Cheysson, F., Lang, G.: Spectral estimation of Hawkes processes from count data. arXiv:2003.04314 [math, stat] (2022)
Daley, D.J., VereJones, D.: An Introduction to the Theory of Point Processes, 2nd edn. Springer, New York (2003)
Dempster, A.P., Laird, N.M., Rubin, D.B.: Maximum likelihood from incomplete data via the EM algorithm. J. R. Stat. Soc. Ser. B (Methodol.) 39, 1–38 (1977)
Efron, B.: Better bootstrap confidence intervals. J. Am. Stat. Assoc. 82(397), 171–185 (1987)
Gerhard, F., Gerstner, W.: Rescaling, thinning or complementing? On goodnessoffit procedures for point process models and generalized linear models. In: Advances in Neural Information Processing Systems (NIPS). Curran Associates, Inc. (2010)
Hawkes, A.G.: 1Spectra of some selfexciting and mutually exciting point processes. Biometrika 58(1), 83–90 (1971a)
Hawkes, A.G.: 2Point spectra of some mutually exciting point processes. J. R. Stat. Soc. Ser. B (Methodol.) 33(3), 438–443 (1971b)
Kirchner, M.: Hawkes and INAR(\(\infty \)) processes. Stoch. Process. Appl. 126(8), 2494–2525 (2016)
Kobayashi, R., Lambiotte, R.: TiDeH: timedependent Hawkes process for predicting retweet dynamics. In: Tenth International AAAI Conference on Web and Social Media (2016)
Mark, B., Raskutti, G., Willett, R.: Network estimation from point process data. IEEE Trans. Inf. Theory 65(5), 2953–2975 (2019)
Ozaki, T.: Maximum likelihood estimation of Hawkes’ selfexciting point processes. Ann. Inst. Stat. Math. 31(1), 145–155 (1979)
PriceWilliams, M., Heard, N.A.: Nonparametric selfexciting models for computer network traffic. Stat. Comput. 30, 1–12 (2019)
Shlomovich, L., Cohen, E.A.K., Adams, N., Patel, L.: Parameter estimation of binned hawkes processes. J. Comput. Graph. Stat. pp 1–27 (2022)
Turcotte, M.J.M., Kent, A.D., Hash, C.: Unified host and network data set. In: Data Science for CyberSecurity, Security Science and Technology, pp. 1–22. World Scientific, Singapore (2018)
Wei, G.C.G., Tanner, M.A.: A Monte Carlo implementation of the EM algorithm and the Poor Man’s Data Augmentation algorithms. J. Am. Stat. Assoc. 85(411), 699–704 (1990)
Author information
Authors and Affiliations
Corresponding author
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Leigh Shlomovich is funded by an Industrial Strategy Engineering and Physical Sciences Research Council Scholarship.
Appendices
Appendix A: Algorithmic details
In the simulation study presented here, the number of Monte Carlo samples \(M=10\), and the number of splits \({\tilde{m}} = 10\). The L2 norm of the difference between successive parameter estimates is used for determining convergence. For the case study presented, the MCEM algorithm takes 8.64 s, INAR(p) takes 0.11 s and the binned log likelihood takes 0.14 s. The simulation study presented has additionally been timed on a 2020 MacBookPro 32GB RAM, 2.3 GHz Intel Core i7. The MCEM algorithm takes an average of \(3.76*10^3\) s per realization, INAR(p) takes 0.527 s per realization, where this includes the optimal selection of p and exponential fit. The binned loglikelihood 0.46 s per realization.
Appendix B: Gradient and Hessian of multivariate continuous time Hawkes processes
The likelihood function of the multivariate Hawkes process is given by
where
where \(R_{m n}(k)\) is defined as
and \(R_{m n}(1) = 0\). This can recursively be defined as
Therefore, the gradient can be expressed by the following.
where
\(k \ge 2\) and \(R_{m n}^{\prime }(1) = 0\).
We can also compute the Hessian for the continuous multivariate Hawkes likelihood. There are 15 categories to consider, given here.
where
\(k \ge 2\) and \(R_{mn}^{\prime \prime }(1) = 0.\)
This covers all cases required for the full Hessian matrix.
Appendix C: Multivariate MCEM algorithm
Here we provide an algorithm for the parameter estimation of multivariate aggregated Hawkes processes via the MCEM procedure. Code is available in MATLAB at https://github.com/lshlomovich/MCEM_Multivariate_Hawkes.
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.
About this article
Cite this article
Shlomovich, L., Cohen, E.A.K. & Adams, N. A parameter estimation method for multivariate binned Hawkes processes. Stat Comput 32, 98 (2022). https://doi.org/10.1007/s11222022101212
Received:
Accepted:
Published:
DOI: https://doi.org/10.1007/s11222022101212