A Hierarchical Intrusion Detection Architecture for Wireless Sensor Networks
Model Based Event Detection in Sensor Networks
description
Transcript of Model Based Event Detection in Sensor Networks
The Johns Hopkins University
Model Based Event Detection in Sensor Networks
Jayant Gupchup, Andreas Terzis, Randal Burns, Alex Szalay
The Johns Hopkins University
Outline
• Motivation
• Data & Model
• Experiments and Results
• Discussion
The Johns Hopkins University
Motivation
The Johns Hopkins University
Importance of detecting events
- Fixed Sampling:
High Freq => too much data
Low Freq => miss temporal transients
- Detect Events: Adaptive Sampling
(increase % of usable data)
- Conserve Energy
- Alarm Triggers
- Correlate events and observed
phenomena in large databases
“Event starts”
Detect Event
Increase Sampling Frequency/Trigger
Alarms
“Event ends”
Return to steady behavior
The Johns Hopkins University
Sample Event
Rain Event Non-Event Days
-5
0
5
10
15
20
0 24 48 72 96
hours
Air
Tem
per
atu
re (
cels
ius)
The Johns Hopkins University
Solution: Rough Sketch
- Model observed quantities using Principal Component Analysis (PCA).
- Project original data on a “feature space” (reduce dimensionality)
- Look for observations “deviating” from Average/Expected behavior in the feature space
The Johns Hopkins University
Principal Component Analysis (PCA)
PCA :- Finds axes of maximum
variance
- Reduces original dimensionality
(In e.g. from 2 variables => 1 variable)
First Principal Component
Variable #1
Var
iabl
e #2
X : Points original spaceO : Projection on PC1
The Johns Hopkins University
Motivation for Using PCATypical day: “Fits model well”
-4
-3
-2
-1
0
1
2
3
4
5
0 5 10 15 20 25
hours
Mea
n su
btra
cted
Air
tem
p (C
elsi
us)
observed Temp, PCA reprojection Temp.
residuals (absolute)
Event day: “Large residuals”
-8
-6
-4
-2
0
2
4
6
0 5 10 15 20 25
hours
Me
an
su
btr
act
ed
Air
te
mp
(C
els
ius)
observed Temp. PCA reprojection Temp.
residuals (absolute)
The Johns Hopkins University
Why Not Soil Moisture ?
Reaction to event
Reaction to event
The Johns Hopkins University
LifeUnderYourFeet Data
&
Model Preparation
The Johns Hopkins University
LifeUnderYourFeet data
• 10 MICAz Sensors– Air Temperature (AT)– Soil Temperature (ST)– Soil Moisture– Photo Sensor
The Johns Hopkins University
Air Temp vs. Soil Temp
-6
-4
-2
0
2
4
6
0 5 10 15 20 25
hour
tem
per
atu
re (
cels
ius)
air temperature profile soil temperature (X20 scaleup)
Notice the phase lag for Soil Temperature
The Johns Hopkins University
Data Preparation• Model built on Air temperature and Soil Temperature.
AT1_1 AT1_2 …. … …. AT1_144
AT2_1 AT2_2 …. … …. AT2_144
. . …. … …. .
. . …. … …. .
AT10_1 AT10_2 …. … …. AT10_144
. . …. … …. .
. . …. … …. .
. . …. … …. .
t=10 t=20 … t=1440
1 day,
10 sensors
Size of matrix : [(# of days x 10) X 144]
The Johns Hopkins University
40
50
60
70
80
90
100
110
0 30 60 90 120
Principal Components
% v
ari
an
ce
co
ve
red
air temperature soil temperature
Basis1-4 cover 90.95%
The Johns Hopkins University
PCA Bases (AT & ST)Air Temperature Eigenvectors (Basis vectors)
-0.15
-0.1
-0.05
0
0.05
0.1
0.15
0.2
0 5 10 15 20 25
Hour of day
no
rmal
ied
air
te
mp
erat
ure
eigenvector1 eigenvector2
Eigenvector1 Is the
Diurnal cycle
Soil Temperature eigenvectors (basis vectors)
-0.15
-0.1
-0.05
0
0.05
0.1
0.15
0.2
0.25
0 5 10 15 20 25
Hour of day
No
rmal
ized
so
il
tem
per
atu
re
eigenvector1 eigenvector2
similarity eigenvector1 for ST
&eigenvector2 for AT
The Johns Hopkins University
Methods and Results
The Johns Hopkins University
MethodsThree methods
1) Basic Method – Projections on the first principal component for AT
2) Highpass Method– Removes seasonal drift by looking at sharp changes
in the local neighborhood.
3) Delta method– Makes use of the inertia of the soil and seasonal drift
The Johns Hopkins University
Test Data
• Test Period : 225 days between September, 2005 – July, 2006
• 48 major events were known to occur (taken from the BWI weather station,
http://www.wunderground.com/US/MD/Bwi_Airport.html)
• Offline Analysis
The Johns Hopkins University
Method 1 : Basic Method• Considers only Air Temperature.
• First Basis Vector covers 55% of variation in the data
AT1_1 AT1_2 …. … …. AT1_144
AT2_1 AT2_2 …. … …. AT2_144
. . …. … …. .
AT10_1 AT10_2 …. … …. AT10_144
V1_1
V1_2
.
V1_144
e1_1
e2_1
.
e10_1
X =
Average
E1 E2 … ….. …………….. En-1 En
Day 1 Day 2 Day n
1 day
First Basis Vector (PC1)
The Johns Hopkins University
Method 1: Basic Method (cont.)
Results :
Drawback:- Does not consider seasonal drift- Does not make use of the inertia information
of the soil.
Method Precision Recall False Negatives
Basic 52.459% 64% 18
The Johns Hopkins University
Method 2 : Highpass Method
• Again, Considers only Air Temperature
• Highpass filter on ‘E1’ series. Call this series ‘S1’
• Highpass filters detects sharp changes by considering the local neighborhood only => Removing seasonal drift
• Threshold on ‘S1’, values below the threshold are tagged as events.
The Johns Hopkins University
Method 2: Highpass Method (cont.)
Results :
Drawback:- Does not make use of the inertia information
of the soil.
Method Precision Recall False Negatives
Basic 52.459% 64% 18
Highpass 51.28% 80% 10
The Johns Hopkins University
Method 3 : Delta Method• Considers Air Temperature and Soil Temperature
• Create E1 series for AT and E1 series for ST separately as discussed before
• Highpass filter on AT_E1 & ST_E1
=> AT_S1 & ST_S1
• Delta = AT_S1 – ST_S1 for all days.
• Set a threshold on the Delta series.
The Johns Hopkins University
Method 3: Delta Method (cont.)
Results :
Method Precision Recall False Negatives
Basic 52.459% 64% 18
Highpass 51.28% 80% 10
Delta 54.79% 85.106% 7
The Johns Hopkins University
Event detection for 12/13/2005 – 01/02/2006
Due to the inertia of the soil, ‘Delta method’ shows sharper negative peaks for event days.
-20
-15
-10
-5
0
5
10
15
20
25
0 5 10 15 20 25
days
valu
e
Delta Highpass Known events (BWI weather station)
The Johns Hopkins University
Discussion
The Johns Hopkins University
Future work
• Implement “Online event detection”– Compute Basis vectors from historic data.– Load the ‘basis vectors’ and ‘threshold’ values on the motes.
• Apply technique for faulty sensor detection
• Detect localized events by forming clusters of motes with similar eigencoefficients.
• Consider variants of PCA (Gappy-PCA, online-PCA).
The Johns Hopkins University
Acknowledgements• Ching-Wa Yip 1
- PCA C# library and Discussions.
• Katalin Szlavecz 2 & Razvan Musaloui-E 3
– Domain expertise and data collection.
• Jim Gray 4 & Stuart Ozer 4
– Online database
1 : JHU, Dept of Physics & Astronomy2 : JHU, Dept of Earth and Planetary science3 : JHU, Dept of Computer Science.4 : Microsoft Research
The Johns Hopkins University
Future work
• Online event detection on the motes
• Apply this method for faulty sensor detection
• Detect localized events by forming clusters of motes with similar eigencoefficients.
• Consider incomplete days using Gappy-PCA.
• Explore incremental & robust PCA techniques.
The Johns Hopkins University
Training Set (Air Temp) • Seasons exhibit “Diurnal
Cycles” around their daily mean (DC component)
• Construct Zero-Mean Vectors for each Sensori for each day (remove DC Component)
0
5
10
15
20
25
30
0 6 12 18 24
Hour of the day
Air
Te
mp
era
ture
Winter Air Temp profile Summer Air Temp profile
-1.5
-1
-0.5
0
0.5
1
1.5
2
2.5
0 6 12 18 24
Hour of the day
Mean
sub
tract
ed A
ir
Tem
pera
ture
Mean Profile Air Temperature
• Remove outliers using a
simple median filter to
build the training set X