Anomaly Detection in Wireless Sensor Networks

1
Anomaly Detection in Wireless Sensor Networks

• Michael Bailey
• Distributed Intelligence Lab
• Univ. of Tennessee, Knoxville
• This research is funded in part by Oak Ridge
  National Laboratorys SensorNet Program.

2
Questions From Previous Meeting

• How is our approach different than others?
• We have implemented the FuzzyArt algorithm on
  physical hardware rather than only in simulation.
• We are integrating a mobility component whose
  actions are dependent on the output of the sensor
  network algorithm(s).
• Ongoing work aims to extend the adaptability of
  the anomaly detection algorithm.

3
Questions From Previous Meeting

• How is the sensor network learning what is
  normal? From scratch? From pre-ordained rules?
• From scratch. The number of categories will
  eventually reach saturation after enough data has
  been collected. After that, the creation of a
  new category indicates something unusual has
  happened.

4
Questions From Previous Meeting

• How/when does one define a new category?
• A new category is created if the degree of
  similarity between an input and its closest
  category is lower than the vigilance ?. The
  higher the vigilance, the more categories will be
  created.

5
Questions From Previous Meeting

• How does one set the threshold for anomaly?
• Since the creation of a new category indicates an
  anomaly, changing the vigilance parameter sets
  the threshold.

6
Questions From Previous Meeting

• Which is the 7th reading on the sensor? The
  picture only shows 6.
• Accelerometer and Magnetometer have 2 readings
  each (one each for X and Y axis). The Sounder
  produces no readings.

Sounder
Light Sensor
Accelerometer
Temperature
Magnetometer
Microphone
7
Questions From Previous Meeting

• Is the software standard or developed at UT?
• We wrote the FuzzyArt program running on the
  motes, the operator control program, and the
  intercept program running on the Pioneer robots.
• The TinyOS system that our program runs on is an
  open-source project from UC - Berkeley, as is the
  Deluge program that can wirelessly upload new
  versions of our program to the motes.

8
Questions From Previous Meeting

• Look at the learning rate parameter ? in the
  updating scheme for the weights. I think you
  should consider values different from 1.
• Agreed. Probably the best approach is to use
  fast-commit slow-recode. When a new category
  is formed, it is set to match the input (?1).
  After that, ? lt 1 to prevent established
  categories from being easily modified by noisy or
  erroneous data.

9
Questions From Previous Meeting

• I understand that your new contribution is
  implementing the Kulakov algorithm in the motes
  hardware. Is the hierarchical aspect new? The
  cluster architecture reconfiguration?
• The hierarchical aspect is suggested in the
  Kulakov paper. The cluster configuration can be
  changed through our operator control program. We
  havent implemented a method (such as the LEACH
  protocol) that automatically determines
  clusterheads.

10
Progress Since Last Meeting

• Combined sensor node and clusterhead programs
  into one program
• Every node runs the same program image
• This makes it much easier to dynamically
  reprogram the nodes
• Nodes are assigned roles (sensor node or
  clusterhead) by an operator control program
  running on the laptop

11
Operator Control Program

• Java program to send commands to the nodes
• Can send commands to a single node or broadcast
  to all nodes (multi-hop if necessary)
• Sample commands
• Clusterhead configuration
• FuzzyArt parameters (vigilance, learning rate,
  etc.)
• Radio transmission power

12
Operator Control Program

• More commands
• Microphone sensitivity
• Time interval at which nodes run the FuzzyArt
  algorithm and send output
• Pause and restart algorithm
• Clear FuzzyArts memory of categories
• Setup multi-hop routing paths

13
Integration of Mobile Robots
Higher level clusterhead
14
Integration of Mobile Robots

• We assume the robot knows the location of each
  cluster in advance.
• If the higher level clusterhead detects an
  anomaly (category change after stabilization),
  the robot goes to the location of the cluster
  that caused the change.
• Once there, the robot can use its camera to track
  an intruder.

15
Intruder Detection
Sensor
Sensor
Sensor
Sensor
Clusterhead
16
Intruder Detection
17
Reference Slides
18
FuzzyART Architecture
Attentional subsystem
Category choice
F2
Category layer
reset
. . .
Orienting subsystem
-
F1
?
Comparison layer

. . .
F0
Input layer
Sensor input
Kulakov and Davcev, 2005
19
Hierarchical FuzzyART
F2
Dimensionality reduction
?
F1
F0
F2
F2
. . .
?
?
F1
F1
F0
F0
. . .