Maximally Divergent Intervals for Anomaly Detection

We present new methods for batch anomaly detection in multivariate time series. Our methods are based on maximizing the Kullback-Leibler divergence between the data distribution within and outside an interval of the time series. An empirical analysis shows the benefits of our algorithms compared to methods that treat each time step independently from each other without optimizing with respect to all possible intervals.Comment: ICML Workshop on Anomaly Detectio

Viterbi optimization for crime detection and identification

In this paper, we introduce two types of hybridization. The first contribution is the hybridization between the Viterbi algorithm and Baum Welch in order to predict crime locations. While the second contribution considers the optimization based on decision tree (DT) in combination with the Viterbi algorithm for criminal identification using Iraq and India crime dataset. This work is based on our previous work [1]. The main goal is to enhance the results of the model in both consuming times and to get a more accurate model. The obtained results proved the achievement of both goals in an efficient way

DETEKSI ANOMALY PADA SISTEM DETEKSI INTRUSI MENGGUNAKAN METODE HIDDEN MARKOV

ABSTRAKSI: Intrusion detection system (IDS) merupakan aplikasi perangkat lunak yang dapat mendeteksi serangan atau ganguan dalam sebuah sistem atau jaringan. Salah satu jenis IDS adalah Anomaly Detection dimana suatu data trafik jaringan akan dikatakan intrusi apabila mempunyai karakteristik yang berbeda dari kebanyakan data lainnya.Pada Anomaly Detection terdapat sebuah pendekatan yaitu Hidden Markov Model (HMM). HMM adalah sebuah model yang dibangun oleh Markov dimana metode tersebut memiliki parameter berupa matriks – matriks λ (A, B, π) yang dari model tersebut dapat dihitung P(O|λ) dari masing – masing kelas sehingga dapat ditentukan kelas dari sebuah data trafik jaringan. Kelas ditentukan berdasarkan nilai P(O|λ) yang terbesar.Pengujian dilakukan dengan beberapa skenario untuk mengetahui akurasi sistem dilihat dari nilai detection rate dan false positive rate. HMM dapat mendeteksi intrusi dengan tingkat akurasi yang cukup baik dilihat dari nilai detection rate sebesar 74(%). Untuk nilai false positive rate HMM menunjukkan akurasi yang tidak terlalu buruk yaitu sebesar 2,75(%).Kata Kunci : Kata kunci: Intrusion Detection System, Anomaly Detection, Intrusi, Hidden Markov ModelABSTRACT: Intrusion detection system (IDS) is a system that can detect any intrusion or attack on a network or systems. One type of IDS is Anomaly detection, which categorize a network traffic data as an intrusion only if they have a different characteristic from other data.In anomaly detection, there is an aproach which is called as Hidden Markov Model (HMM). HMM is a model built by markov which has parameters as a matriks λ (A, B, π). P(O|λ) can be calculated from that parameters and each class so that we can specify the class of the network traffic data. Class is determined based on the max value of P(O|λ).Testing was carried out with several scenarios to determine the accuracy of the system seen from the detection rate and false positive rate. HMM can detect intrusions with fairly good accuracy based on detection rate 74(%). From false alarm value, HMM accuracy is not toobad 2,75(%).Keyword: Keywords: Intrusion Detection System, Anomaly Detection, Intrusi, Hidden Markov Mode

HMMs for Anomaly Detection in Autonomous Robots

Detection of anomalies and faults is a key element for long-term robot autonomy, because, together with subsequent diagnosis and recovery, allows to reach the required levels of robustness and persistency. In this paper, we propose an approach for detecting anomalous behaviors in autonomous robots starting from data collected during their routine operations. The main idea is to model the nominal (expected) behavior of a robot system using Hidden Markov Models (HMMs) and to evaluate how far the observed behavior is from the nominal one using variants of the Hellinger distance adopted for our purposes. We present a method for online anomaly detection that computes the Hellinger distance between the probability distribution of observations made in a sliding window and the corresponding nominal emission probability distribution. We also present a method for o!ine anomaly detection that computes a variant of the Hellinger distance between two HMMs representing nominal and observed behaviors. The use of the Hellinger distance positively impacts on both detection performance and interpretability of detected anomalies, as shown by results of experiments performed in two real-world application domains, namely, water monitoring with aquatic drones and socially assistive robots for elders living at home. In particular, our approach improves by 6% the area under the ROC curve of standard online anomaly detection methods. The capabilities of our o!ine method to discriminate anomalous behaviors in real-world applications are statistically proved

HMMs for Anomaly Detection in Autonomous Robots

Detection of anomalies and faults is a key element for long-term robot autonomy, because, together with subsequent diagnosis and recovery, allows to reach the required levels of robustness and persistency. In this paper, we propose an approach for detecting anomalous behaviors in autonomous robots starting from data collected during their routine operations. The main idea is to model the nominal (expected) behavior of a robot system using Hidden Markov Models (HMMs) and to evaluate how far the observed behavior is from the nominal one using variants of the Hellinger distance adopted for our purposes. We present a method for online anomaly detection that computes the Hellinger distance between the probability distribution of observations made in a sliding window and the corresponding nominal emission probability distri- bution. We also present a method for onine anomaly detection that computes a variant of the Hellinger distance between two HMMs representing nominal and observed behaviors. The use of the Hellinger distance positively impacts on both detection performance and interpretability of detected anomalies, as shown by results of experiments performed in two real-world application domains, namely, water monitoring with aquatic drones and socially assistive robots for elders living at home. In particular, our approach improves by 6% the area under the ROC curve of standard online anomaly detection methods. The capabilities of our online method to discriminate anomalous behaviors in real-world applications are statistically proved