It is demonstrated that cross-correlation methods can successfully be applied on a large scale to the detection of seismic events arising in a variety of tectonic settings. The locations of about thousand earthquakes a year occurring in and near China are reported using phase picks from a large national network. We performed more than 100 million cross correlations on the waveforms of more than 18,800 events over 20 years, as recorded by a relatively sparse network; and detected about two thirds of the nationally reported events. Additional events (70% increase), beyond what standard processing detects for China on the sparse network, were also found. A corresponding reduction in detection threshold approaches 0.9 magnitude units for increasing station distance. As networks densify and archives grow, cross-correlation is likely to become more and more useful for purposes of maximizing the number of detected events and hence to improve knowledge of seismicity.
 As a step in the overall process of characterizing seismicity, seismic event detection is more fundamental than event location and identification,. Therefore significant increases in the number of detected events, as a result of using a more effective detection algorithm, may be expected to result in a better understanding of seismicity patterns. The motivation for this project, in which cross correlation is applied on a large scale, follows on the demonstrated success of three earlier, smaller studies which report correlation detectors can achieve a full magnitude unit improvement in detection thresholds compared to a standard STA/LTA type detector for similar events. Gibbons and Ringdal  have shown order of magnitude improvement using a correlation detector for the NORSAR array. Semi-empirical synthetic runs showed this improvement is obtained with acceptable false alarm rates of about one per day [Schaff, 2008]. A case study of 90 events in the 1999 Xiuyan earthquake sequence in China further confirmed a full magnitude unit reduction in detection threshold is possible for a different dataset and region on five regional three component stations 500 to 1500 km away [Schaff and Waldhauser, 2006]. A key question is how well will correlation detectors work for seismicity in general on a large scale and not just specific case examples, since it requires a priori information on the shape of the master waveform template? To be useful as a general tool for monitoring in seismology it also needs to perform satisfactorily for a significant percentage of the seismicity.
2. Data and Methods
 To answer these questions we employ a strategy where we work from an existing catalog of known seismicity determined by independent means on a denser network of stations and then analyze the waveforms recorded at a much sparser regional network applying a correlation detector and standard STA/LTA type processing. This approach then allows us to address the question of what percentage of the seismicity can be detected by either method and to quantify the reduction in magnitude threshold since independent magnitude estimates are also available in the background catalog. Note, this study has not attempted to identify new events from the continuous data streams by using a correlation detector but only examines the time windows at each station for when the arrivals from the known events are expected to occur. Figure 1 shows the 18,886 events in and near China and 363 stations used for this study. The events come from the Annual Bulletin of Chinese Earthquakes (ABCE) from 1985 to 2005. The stations are those for which waveforms are available at the IRIS DMC, amounting to 110 Gb of data. Several of the stations are only temporary deployments. There are only a few long-running stations in China, which correlation techniques work best for, so the actual network of stations for most of the events is quite sparse with large inter-station distances. Out of the 363 stations only two had data for over 50% of the 18,886 events, LSA with 10,891 and WMQ with 9,604. Only fourteen stations (in red on Figure 1) recorded more than 33% of the events. Other stations that were co-located in China had instrument changes which disallow the use of similar correlation measurements to be used for pairs spanning the change. A total of 111 million cross correlations were performed taking about 2 weeks of continuous processing time on a four CPU computer. All events with separation distances less than 150 km were correlated. In other words, every event is a master event to see the maximum number of correlations possible. In practice where using every event as a master is not feasible, the application of subspace detectors can reduce the archive of master templates to a representative subset of basis functions for computational efficiency [Harris, 2006; Harris and Paik, 2006]. We don't apply subspace detectors here, but only explore the end-member case of a correlation detector which is optimal for a known signal embedded in noise. Only Lg-phases have been processed. 50 s windows were used searching forward and backwards 30 s using time-domain cross correlation. The seismograms were filtered from 0.5 to 5 Hz. The cross correlation traces for the three components are averaged together to constructively enhance the detection spikes when present [Schaff, 2008]. A “scaled cross correlation coefficient” (SCC) was used to initially sift the data [Schaff, 2008]. All correlations with SCC > 4.5 were saved. While the cross correlation coefficient (CC) depends on the time-bandwidth product, SCC has the advantage that it is relatively independent of window length and filter band used in the processing [Schaff, 2008]. Each point in the cross correlation trace, CCi, is scaled by the mean absolute value of the moving window (length N) before the point.
 We use a moving window of 20 s and choose n to be 4 samples to avoid side-lobes of the cross correlation function. Intuitively, SCC is a measure of the statistical significance of a detection spike since it quantifies the deviation of the cross correlation coefficient from an empirical distribution of background values based on a moving window throughout the correlation trace.
3. Selection Criteria and False Alarm Minimization
 A study was made to estimate false alarms using real data for selected stations. A selected template was correlated with 36 days of continuous of real, seismic, background noise. From this it is possible to empirically determine curves of the false alarms per day as a function of CC and SCC. For traces that are already sifted with an SCC 6, a CC of 0.24 corresponds to approximately one false alarm per day. We define a false alarm as any data sample of the cross correlation trace that exceeds a certain threshold value. A CC of 0.5 corresponds to 0.0022 false alarms per day. An SCC of 6.65 corresponds to a little over one false alarm per day. Based on the pair-wise distance matrix for the correlations and the lags searched over we can estimate the percent of the 18,886 events for which detections are triggered that would be expected to be false alarms. FalseAlarms = 2 · lags · FAR · npairs/86400s. This gives the false alarms per station, where lags are 30 s, FAR is the false alarm rate per day from above, npairs is total number of pairs from the pair-wise inter-event distance matrix (<150 km) which is less than all possible combinations (0.5nevents(nevents − 1)), and divided by 86400 s in a day.
 To estimate the percent events false alarms out of 18,886 we randomly distribute the estimated false alarms over the individual pair-wise matrices for each station. Following this procedure a CC threshold of 0.5 with a FAR of 0.0022 gives a percent event false alarms of 0.4% out of 18,886 (Table 1) and therefore appears to be so robust for these long 50 s windows that we assume that a trigger at a single station provides a reliable detection. Note: the percent event false alarm cannot be computed solely from the above formula and information in the text as it requires specific knowledge of the structure of each individual pair-wise observation matrix for each station. For the other thresholds corresponding to one false alarm per day, it is necessary to require at least two stations observing that pair to count as a detection to achieve percent event false alarms of 1.3% (Table 1). Using a combination of these criteria (CC > 0.5 at 1+ stations, CC > 0.24 at 2+ stations, or SCC > 6.65 at 2+ stations) we estimate the percent of events that would be false alarms to be less than 3%. Applying these criteria to the time windows corresponding to where the theoretical travel times would arrive for the 18,886 events results in 12,902 events that are detected or 68%. Therefore it is estimated that 65% represent true detections.
Figure 2 shows the magnitude distribution for the 18,886 events and the 12,902 events detected by cross correlation. 8,358 events found by an STA/LTA detector similar to that used by the prototype International Data Center “pIDC” are also shown (44%). An STA window of 1 s and LTA of 30 s are used. Trigger levels at the pIDC range from 3.0 to 4.5 depending on the station. We choose 3.2 or 10 dB as a common level. A detection is made only on P-waves on the vertical component. If the trigger is within 10 s of the expected P-wave arrival it is counted as a detection. Overlapping filter bands of 0.5–1, 0.75–1.5, 1–2, 1.5–3, 2.5–5, 4–8 Hz are searched to enhance the signal to noise ratio (SNR) as a function of frequency content. Finally we used the criterion that 3 or more stations are triggered to form an event detection. The 95% confidence lower limit of the magnitudes detected for correlation is 2.8 whereas for the “pIDC” it is 3.0, yielding a 0.2 unit reduction in magnitude detection threshold. However 2.8 is also the 95% lower limit of all the magnitudes in the catalog. Therefore the range of magnitudes is not low enough to test if correlation improves detection thresholds more than 0.2 units overall. Alternatively, if you measure where the roll-off occurs for level of completeness you get about 3.6 for the correlation and 4.0 for the “pIDC”, corresponding to a reduction of 0.4 units.
 More insight can be gained by plotting magnitude as a function of station distance for all the correlation detection observations (Figure 3). The red line is the 95% lower limit of the magnitudes in 50 km bins of station distance. It is relatively flat around the lower magnitude limit of about 2.8. The green line is the 95% trend from a similar plot for the “pIDC” magnitude vs. station distance and the trend is seen to increase from about 2.9 at zero to 3.5 for 2200 km station distances. It is observed the two lines diverge for greater station distances. The difference between the two 95% trends is plotted in Figure 4. At zero the difference is 0.2 units and then increases to a maximum of 0.9 units at greater station distances. The interpretation of these results is that for longer station distances the magnitudes in the catalog are sufficiently complete to observe nearly an order of magnitude improvement (0.9 units) in threshold reduction between the two techniques. For closer station distances lower magnitude events are not available in this catalog to test if the full unit reduction still holds.
 We see that approximately two thirds of the events in the catalog are detected by cross correlation (12,902), a sizeable fraction indicating that these methods can be applied on a broad scale across diverse tectonic regions. However, this catalog was based on a much denser network of stations than the one that we have waveforms available for. To get an idea of how applying correlation methods to an existing network would improve things it is instructive to see how many events are detected by correlation and an STA/LTA detector on the same network. 7,063 events were detected by correlation out of the 8,358 found by a “pIDC” procedure or 85%. For comparison Schaff and Waldhauser  determined that 95% of the 225,000 events in northern California correlated at four or more stations with CC > 0.7 with at least one other event. Even though the correlation parameters for that study were tailored for location purposes, the criteria is considerably stricter than for detection. Therefore we conclude that correlation is able to detect the great majority of the seismicity for these two large regions of seismicity. This can be an important independent confirmation of the existence of new events and help to weed out false alarms. Besides lowering magnitude detection thresholds correlation also detects more events that the “pIDC” procedure missed due to a variety of reasons. The correlation detector finds 5839 additional events over the 8,358 events from the “pIDC” detector or a 70% increase (Figure 2). Therefore we might expect catalogs for existing networks to also increase with the complementary benefits of correlation detector techniques.
 Correlation detects a sizeable fraction of the seismicity for China (about two thirds) with estimated false alarm rates of less than 3%. These statistics are computed applying the detection algorithms to an extremely sparse regional network of stations compared to the much denser network that the ABCE bulletin was created from for comparison. Geographically the detected events are as well-distributed across various tectonic regimes as the background catalog (Figure 1). When correlation detectors and STA/LTA filters are applied to the same network, correlation finds the significant majority of detections that standard processing detects for China (85%) and for northern California (95%). Correlation detects additional events beyond standard processing for China (70% increase). The correlation detector we are using is also able to detect larger magnitudes which have greater source complexity. The maximum magnitude of 8.1 is detected by both cross correlation and the “pIDC”. It continues to outperform standard processing in that 80 events with M ≥ 6 are detected by correlation whereas only 59 are detected by the “pIDC”. The above conclusions indicate that there is ample waveform similarity for cross correlation to be a broadly useful tool for modern methods in seismology not just in location but also for event detection as data and computer speed increase and along with it the need for automation.
 Overall for China a reduction in magnitude detection threshold of 0.2 units is observed for correlation compared to “pIDC” procedures. Closer examination reveals that this difference increases to 0.9 units with increasing station distance. It is assumed that magnitude completeness of the catalog is the reason a larger improvement is not seen for closer station distances. Therefore the order of magnitude reduction in detection threshold observed for smaller studies [Gibbons and Ringdal, 2006; Schaff and Waldhauser, 2006; Schaff, 2008] comparing correlation detectors for similar events with STA/LTA type algorithms appears to hold on a broad scale, across diverse tectonic regions, for tens of thousands of events.
 Correlation provides an independent and complementary means to confirm detections produced by STA/LTA filters and can help to weed out false alarms. While STA/LTA filters require three station triggers to make a detection and an event association, we note that a relatively high CC for these window lengths and filter bands produces reliable detections for approximately 43% of the events at a single station with false alarms of 0.4%. Therefore a correlation detector may have an advantage for similar events for sparse networks, whereas an STA/LTA detector may fail due to poor station coverage, bad noise that day due to environmental conditions, or coda waves from other earthquakes such as in aftershock sequences.
 We thank IRIS data center for archiving and maintaining access to regional waveform data in and around China as well as the operators of the contributing seismic networks. Also we are grateful for the creators of the ABCE which we used to select events from the continuous data streams. Paul Richards, Felix Waldhauser, and two anonymous reviewers provided constructive comments. This work was funded by Air Force Research Laboratory contract FA8718-05-C-0022. This is Lamont-Doherty Earth Observatory contribution 7253.