[noelwelsh]

Caveat: I only skimmed the paper.

The combination of two things set off alarm bells: firstly, the problem observed is that a continuous sequence of zero readings is erroneously treated as an "ok". Second, the variance is modelled as a normal distribution (Section 3.1). Since the normal is symmetric, if the mean is sufficiently close to zero readings below zero will be within one standard deviation. You can't ever have readings below zero in the type of systems under consideration. It seems this is the flaw in the original work, and furthermore this assumption is carried through to the fix (with some ad-hoc modifications [remember, I only skimmed the paper]). It seems to me that a cleaner model would drop this assumption of normality and use an asymmetric distribution (say, the Poisson) in its place. I would be interested in any comments from those who read the paper in more depth.

[nethergoat]

This is precisely the approach they take. Section 3.4 ("The Model") begins, "The heart of the model is to treat incoming events as a Poisson process..."