Machine Learning Algorithms for Surveillance and Event Detection

1
Machine Learning Algorithms for Surveillance
and Event Detection
Workshops
CMU July 29, 2006 Pittsburgh, PA, USA

• Denver Dash Intel, Corp.
• Terran Lane University of New Mexico
• Dragos Margineantu The Boeing Company
• Weng-Keen Wong Oregon State Univ.

2
Workshop Sponsors

• The Boeing Company
• Intel

3
Event Detection

• Biosurveillance Example
• Detect if there is a disease outbreak in a
  city as early as possible
• Approach
• Monitor the total number of Emergency Department
  visit in the city each day.

4
Event Detection

• Obtain Emergency Department data from the past
  year
• Fit a Gaussian to this data
• Raise an alert when the daily number of ED visits
  exceeds a threshold

x
0
50
35
5
Event Detection

• An interesting event occurs when the of ED
  visits per day exceeds the threshold.
• If it corresponds to a real disease outbreak, it
  is a true positive. Otherwise, it is a false
  positive.

6
Interesting Events and their Detection
Data
Problem/ Environment
Problem/ Environment
Event Detection Process
Decisions
Knowledge
Our World
7
Interesting Events With Respect To
x101 48.2
x102 51.3
x103 48.2
x104 51.3
x105 48.2
x106 51.3
x107 48.2
x108 51.3
x109 48.2
x110 51.3

Model learned from x1 x100, and on
expert/prior knowledge
P(x)
x
0
100
50
8
Interesting Events with Respect To

• Events of Interest are observations with
  likelihood ? (very small?) of occurrence with
  respect to
• The model M that is believed to have generated
  the observations
• The other observations X that are available
• P( xi M, X ) p

9
Complex Forms of Data
JAKARTA, Indonesia (AP) -- Researchers scouring
swamps in the heart of Borneo island have
discovered a venomous species of snake that can
change its skin color, the conservation group WWF
announced Tuesday. The ability to change skin
color is known in some reptiles, such as the
chameleon, but scientists have seen it rarely
with snakes and have not yet understood this
phenomenon, the group said in a statement.. . .
Primary Key Date Time Prodrome Sex Age Home Location Many more
100 6/1/03 912 Fever M 20s NE
101 6/1/03 1045 Diarrhea F 40s NE
102 6/1/03 1103 Respiratory F 60s NE
103 6/1/03 1107 Diarrhea M 60s E

10
Event Detection Tasks

• Intrusion detection / network security
• Security monitoring
• Fraud detection
• Biosurveillance
• Traffic incident detection
• Detection of interesting differences between
  images
• Detection of potential causes for instability in
  dynamic systems or control loops
• Quality control in manufacturing
• Topic detection
• Sensor network monitoring
• Aircraft / train / vehicle maintenance monitoring
• Fault detection
• Activity monitoring
• Supernova detection
• Weather modeling
• Data cleaning
• Detection of regions of increased brain activity
  from fMRI data
• And many more

11
Features Shared by MostEvent Detection Tasks

• Event detection is difficult or time consuming
  for human experts
• Interesting events are usually rare
• Detecting an interesting event can have a
  significant impact
• Difficult to capture all the conditions that make
  an event interesting
• Evaluation of algorithms is difficult

12
Not Typical Machine Learning

• Standard supervised learning approaches are
  unsatisfactory
• few or no positive examples, plenty of negatives
• new forms of interesting events appear
• Standard unsupervised learning approaches are
  unsatisfactory
• skewed distributions
• in many cases, not just looking for outliers

13
Standard MLEvent Detection Approaches

• One-class classification of normal
  observations every other instance considered a
  potential important event
• Unsupervised clustering post processing
• Multi-Stage Event Detection a standard ML
  approach filtering of false positives
• Incorporation of background knowledge

14
Research Questions

• Event Detection approaches for complex data
  (video, text, spatio-temporal, relational)
• Sensor fusion
• Incorporating domain knowledge into the detection
  models
• Validation and testing of Event Detection
  Algorithms Tools
• Statistical tests
• Testbeds for anomaly detection systems
• Online Event Detection
• Defining the interestingness of an event
  (active learning?)
• Explaining why an event is interesting
• Effective visualization techniques
• Event Detection in adversarial environments

15
Schedule
Session 1 (920-1050) 920-1000 Interactive
Event Detection in Audio and Video Rahul
Sukthankar 1000 - 1025 Framework for Anomalous
Change Detection James Theiler, Simon
Perkins 1025-1050 Shape Outlier Detection Using
Pose Preserving Dynamic Shape Models Chan-Su
Lee, Ahmed Elgammal Coffee Break
(1050-1120) Session 2 (1120-1240)
1120-1200 Detection of Stepping-Stones
Algorithms and Confidence Bounds Shobha
Venkataraman 1200-1220 Distributed
Probabilistic Inference for Detection of Weak
Network Anomalies Denver Dash 1200-1220
Learning Sequential Models for Detecting
Anomalous Protocol Usage Lloyd
Greenwald Lunch (1240-1405)
16
Schedule
Session 3 (1405-1545) 1405-1445 Forecast,
Detect, Intervene Anomaly Detection for Time
Series Deepak Agarwal 1445-1525 Bayesian
Biosurveillance Greg Cooper 1525-1545 A
Wavelet-based Anomaly Detector for Early
Detection of Disease Outbreaks Thomas Lotze,
Galit Shmueli, Sean Murphy, Howard Burkom Coffee
Break (1545-1615) Session 4 (1615-1735) 1615
-1645 Towards a Learning Traffic Incident
Detection System Tomas Singliar, Milos
Hauskrecht 1645-1705 Bayesian Anomaly
Detection (BAD v1.0) Tim Menzies, David
Allen 1705-1735 Discussion Panel