Dynamic anomaly detection in sensor networks

In the problem of quickest change detection, a sequence of random variables is observed sequentially by a decision maker. At some unknown time instant, the emergence of an anomaly leads to a change in the distribution of the observations. The goal in quickest change detection is to detect this change as quickly as possible, subject to constraints on the frequency of false alarm events. One important application of the theory of quickest change detection is in the context of anomaly detection in sensor networks used to monitor engineering systems. Sensor network related detection problems can vary significantly depending on the spatial evolution of the anomaly in the network as time progresses. Settings involving static anomalies, i.e., anomalies that are perceived by all sensors concurrently and that affect sensors persistently, have been extensively studied in the quickest change detection literature. In addition, semi-dynamic quickest change detection settings that involve anomalies that affect sensors at different time instants, albeit in a persistent manner, have recently received more attention. In this dissertation, our goal is to study the problem of dynamic anomaly detection in sensor networks, i.e., the case where anomalies may not affect sensors persistently, but may move around the network affecting different sets of sensors with time. The objective is to design anomaly detection procedures that are provably optimal with respect to delay-false alarm trade-off formulations. We study the quickest dynamic anomaly detection problem under multiple settings by imposing different assumptions on the spatial evolution of the anomaly. In particular, we consider the case where anomalies evolve according to a discrete-time Markov chain model, for which we develop asymptotically optimal procedures which we compare with more computationally feasible heuristic detection algorithms that require less model knowledge. The Markov model definition incorporates anomalies the size of which may be constant or vary with time. In addition, we study the worst-path dynamic anomaly detection setting, where we assume that the trajectory of the anomaly is unknown and deterministic, and that candidate detection procedures are evaluated according to the anomaly path that maximizes their detection delay. We consider the worst-path setting under the assumption that the anomaly affects a fixed size of sensors, as well as study the problem of worst-path anomaly detection when the size of the anomaly changes with time. For the two worst-path settings we establish that algorithms from quickest change detection literature can be modified to result in provably asymptotically optimal, and in some cases, exactly optimal procedures. A detailed performance analysis of the proposed algorithms is conducted, and concise guidelines regarding the design of proposed tests are provided. Numerical studies of the proposed detection schemes are presented for all studied settings and for a variety of test cases, such as different network sizes, probability distributions, and degrees of model knowledge. Finally, we outline problems of interest for future work, such as the extension of proposed algorithms and techniques in settings where model knowledge is limited

Data-Efficient Quickest Change Detection with On-Off Observation Control

In this paper we extend the Shiryaev's quickest change detection formulation by also accounting for the cost of observations used before the change point. The observation cost is captured through the average number of observations used in the detection process before the change occurs. The objective is to select an on-off observation control policy, that decides whether or not to take a given observation, along with the stopping time at which the change is declared, so as to minimize the average detection delay, subject to constraints on both the probability of false alarm and the observation cost. By considering a Lagrangian relaxation of the constraint problem, and using dynamic programming arguments, we obtain an \textit{a posteriori} probability based two-threshold algorithm that is a generalized version of the classical Shiryaev algorithm. We provide an asymptotic analysis of the two-threshold algorithm and show that the algorithm is asymptotically optimal, i.e., the performance of the two-threshold algorithm approaches that of the Shiryaev algorithm, for a fixed observation cost, as the probability of false alarm goes to zero. We also show, using simulations, that the two-threshold algorithm has good observation cost-delay trade-off curves, and provides significant reduction in observation cost as compared to the naive approach of fractional sampling, where samples are skipped randomly. Our analysis reveals that, for practical choices of constraints, the two thresholds can be set independent of each other: one based on the constraint of false alarm and another based on the observation cost constraint alone.Comment: Preliminary version of this paper has been presented at ITA Workshop UCSD 201

Delay Optimal Event Detection on Ad Hoc Wireless Sensor Networks

We consider a small extent sensor network for event detection, in which nodes take samples periodically and then contend over a {\em random access network} to transmit their measurement packets to the fusion center. We consider two procedures at the fusion center to process the measurements. The Bayesian setting is assumed; i.e., the fusion center has a prior distribution on the change time. In the first procedure, the decision algorithm at the fusion center is \emph{network-oblivious} and makes a decision only when a complete vector of measurements taken at a sampling instant is available. In the second procedure, the decision algorithm at the fusion center is \emph{network-aware} and processes measurements as they arrive, but in a time causal order. In this case, the decision statistic depends on the network delays as well, whereas in the network-oblivious case, the decision statistic does not depend on the network delays. This yields a Bayesian change detection problem with a tradeoff between the random network delay and the decision delay; a higher sampling rate reduces the decision delay but increases the random access delay. Under periodic sampling, in the network--oblivious case, the structure of the optimal stopping rule is the same as that without the network, and the optimal change detection delay decouples into the network delay and the optimal decision delay without the network. In the network--aware case, the optimal stopping problem is analysed as a partially observable Markov decision process, in which the states of the queues and delays in the network need to be maintained. A sufficient statistic for decision is found to be the network-state and the posterior probability of change having occurred given the measurements received and the state of the network. The optimal regimes are studied using simulation.Comment: To appear in ACM Transactions on Sensor Networks. A part of this work was presented in IEEE SECON 2006, and Allerton 201

Quickest Change Detection of a Markov Process Across a Sensor Array

Recent attention in quickest change detection in the multi-sensor setting has been on the case where the densities of the observations change at the same instant at all the sensors due to the disruption. In this work, a more general scenario is considered where the change propagates across the sensors, and its propagation can be modeled as a Markov process. A centralized, Bayesian version of this problem, with a fusion center that has perfect information about the observations and a priori knowledge of the statistics of the change process, is considered. The problem of minimizing the average detection delay subject to false alarm constraints is formulated as a partially observable Markov decision process (POMDP). Insights into the structure of the optimal stopping rule are presented. In the limiting case of rare disruptions, we show that the structure of the optimal test reduces to thresholding the a posteriori probability of the hypothesis that no change has happened. We establish the asymptotic optimality (in the vanishing false alarm probability regime) of this threshold test under a certain condition on the Kullback-Leibler (K-L) divergence between the post- and the pre-change densities. In the special case of near-instantaneous change propagation across the sensors, this condition reduces to the mild condition that the K-L divergence be positive. Numerical studies show that this low complexity threshold test results in a substantial improvement in performance over naive tests such as a single-sensor test or a test that wrongly assumes that the change propagates instantaneously.Comment: 40 pages, 5 figures, Submitted to IEEE Trans. Inform. Theor

Multi-variate quickest detection of significant change process

The paper deals with a mathematical model of a surveillance system based on a net of sensors. The signals acquired by each node of the net are Markovian process, have two different transition probabilities, which depends on the presence or absence of a intruder nearby. The detection of the transition probability change at one node should be confirmed by a detection of similar change at some other sensors. Based on a simple game the model of a fusion center is then constructed. The aggregate function defined on the net is the background of the definition of a non-cooperative stopping game which is a model of the multivariate disorder detectionvoting stopping rule, majority voting rule, monotone voting strategy, change-point problems, quickest detection, sequential detection, simple game