An immunological approach to raising alarms in video surveillance

Inspired by the human immune system, and in particular the negative selection algorithm, we propose a learning mechanism that enables the detection of abnormal activities. Three detectors for detecting abnormal activity are generated using negative selection. Tracks gathered by people’s movements in a room are used for experimentation and results have shown that the classifier is able to discriminate abnormal from normal activities in terms of both trajectory and time spent at a location.

An immunological approach to raising alarms in video surveillance

Inspired by the human immune system, and in particular the negative selection algorithm, we propose a learning mechanism that enables the detection of abnormal activities. Three types of detectors for detecting abnormal activity are developed using negative selection. Tracks gathered by people's movements in a room are used for experimentation and results have shown that the classifier is able to discriminate abnormal from normal activities in terms of both trajectory and time spent at a location.

System of systems approach to threat detection and integration of heterogeneous independently operable systems

This paper presents a system of systems approach to threat detection through integration of heterogeneous independently operable systems. The approach is presented on a realistic situation where a human-controlled base robot, swarm robot(s), and sensors work together to obtain a decision about a possible threat in the environment. The base robot is remotely operated by a human using a haptic control system. The swarm robot(s) are autonomous and can accept directives from the base robot. Finally, sensors directly communicate with (report to) the base robot. In this scenario, heterogeneous systems and human interact in a system of systems architecture. With the inclusion of human expert and sensor verification of swarm robots, the system can successfully perform the threat detection and reduce the false alarms. Finally, a system of systems simulation framework including a base robot, a swarm robot, and two sensors is presented in addition to an experimental evaluation of the proposed SoS architecture

DDoS attack detection at local area networks using information theoretical metrics

DDoS attacks are one of the major threats to Internet services. Sophisticated hackers are mimicking the features of legitimate network events, such as flash crowds, to fly under the radar. This poses great challenges to detect DDoS attacks. In this paper, we propose an attack feature independent DDoS flooding attack detection method at local area networks. We employ flow entropy on local area network routers to supervise the network traffic and raise potential DDoS flooding attack alarms when the flow entropy drops significantly in a short period of time. Furthermore, information distance is employed to differentiate DDoS attacks from flash crowds. In general, the attack traffic of one DDoS flooding attack session is generated by many bots from one botnet, and all of these bots are executing the same attack program. As a result, the similarity among attack traffic should higher than that among flash crowds, which are generated by many random users. Mathematical models have been established for the proposed detection strategies. Analysis based on the models indicates that the proposed methods can raise the alarm for potential DDoS flooding attacks and can differentiate DDoS flooding attacks from flash crowds with conditions. The extensive experiments and simulations confirmed the effectiveness of our proposed detection strategies.

Evaluating OSHA's ethylene oxide standard: employer exposure-monitoring activities in Massachusetts hospitals from 1985 through 1993

This study characterized exposure-monitoring activities and findings under the Occupational Safety and Health Administration's (OSHA's) 1984 ethylene oxide (EtO) standard. In-depth mail and telephone surveys were followed by on-site interviews at all EtO-using hospitals in Massachusetts (n = 92, 96% participation rate). By 1993, most hospitals had performed personal exposure monitoring for OSHA's 8-hour action level (95%) and the excursion limit (87%), although most did not meet the 1985 implementation deadline. In 1993, 66% of hospitals reported the installation of EtO alarms to fulfill the standard's "alert" requirement. Alarm installation also lagged behind the 1985 deadline and peaked following a series of EtO citations by OSHA. From 1990 through 1992, 23% of hospitals reported having exceeded the action level once or more; 24% reported having exceeded the excursion limit; and 33% reported that workers were accidentally exposed to EtO in the absence of personal monitoring. Almost a decade after passage of the EtO standard, exposure-monitoring requirements were widely, but not completely, implemented. Work-shift exposures had markedly decreased since the mid-1980s, but overexposures continued to occur widely. OSHA enforcement appears to have stimulated implementation.

Detection of dynamic background due to swaying movements from motion features

Dynamically changing background (dynamic background) still presents a great challenge to many motion-based video surveillance systems. In the context of event detection, it is a major source of false alarms. There is a strong need from the security industry either to detect and suppress these false alarms, or dampen the effects of background changes, so as to increase the sensitivity to meaningful events of interest. In this paper, we restrict our focus to one of the most common causes of dynamic background changes: 1) that of swaying tree branches and 2) their shadows under windy conditions. Considering the ultimate goal in a video analytics pipeline, we formulate a new dynamic background detection problem as a signal processing alternative to the previously described but unreliable computer vision-based approaches. Within this new framework, we directly reduce the number of false alarms by testing if the detected events are due to characteristic background motions. In addition, we introduce a new data set suitable for the evaluation of dynamic background detection. It consists of real-world events detected by a commercial surveillance system from two static surveillance cameras. The research question we address is whether dynamic background can be detected reliably and efficiently using simple motion features and in the presence of similar but meaningful events, such as loitering. Inspired by the tree aerodynamics theory, we propose a novel method named local variation persistence (LVP), that captures the key characteristics of swaying motions. The method is posed as a convex optimization problem, whose variable is the local variation. We derive a computationally efficient algorithm for solving the optimization problem, the solution of which is then used to form a powerful detection statistic. On our newly collected data set, we demonstrate that the proposed LVP achieves excellent detection results and outperforms the best alternative adapted from existing art in the dynamic background literature.

The acute physiological stress response to an emergency alarm and mobilization during the day and at night

The purpose of this study was to investigate the acute physiological stress response to an emergency alarm and mobilization during the day and at night. Sixteen healthy males aged 25 ± 4 years (mean ± SD) spent four consecutive days and nights in a sleep laboratory. This research used a within-participants design with repeated measures for time, alarm condition (alarm or control), and trial (day or night). When an alarm sounded, participants were required to mobilize immediately. Saliva samples for cortisol analysis were collected 0 min, 15 min, 30 min, 45 min, 60 min, 90 min, and 120 min after mobilization, and at corresponding times in control conditions. Heart rate was measured continuously throughout the study. Heart rate was higher in the day (F20,442 = 9.140, P < 0.001) and night (F23,459 = 8.356, P < 0.001) alarm conditions compared to the respective control conditions. There was no difference in saliva cortisol between day alarm and day control conditions. Cortisol was higher (F6,183 = 2.450, P < 0.001) following the night alarm and mobilization compared to the night control condition. The magnitude of difference in cortisol between night control and night alarm conditions was greater (F6,174 = 4.071, P < 0.001) than the magnitude of difference between the day control and day alarm conditions. The augmented heart rate response to the day and night alarms supports previous observations in field settings. Variations in the cortisol responses between conditions across the day and night may relate to differences in participants' ability to interpret the alarm when sleeping versus when awake.

A state machine for detecting c/c++ memory faults

Memory faults are major forms of software bugs that severely threaten system availability and security in c/c++ program. Many tools and techniques are available to check memory faults, but few provide systematic full-scale research and quantitative analysis. Furthermore, most of them produce high noise ratio of warning messages that require many human hours to review and eliminate false-positive alarms. And thus, they cannot locate the root causes of memory faults precisely. This paper provides an innovative state machine to check memory faults, which has three main contributions. Firstly, five concise formulas describing memory faults are given to make the mechanism of the state machine simple and flexible. Secondly, the state machine has the ability to locate the cause roots of the memory faults. Finally, a case study applying to an embedded software, which is written in 50 thousand lines of c codes, shows it can provide useful data to evaluate the reliability and quality of software.

Online mining abnormal period patterns from multiple medical sensor data streams

With the advanced technology of medical devices and sensors, an abundance of medical data streams are available. However, data analysis techniques are very limited, especially for processing massive multiple physiological streams that may only be understood by medical experts. The state-of-the-art techniques only allow multiple medical devices to independently monitor different physiological parameters for the patient's status, thus they signal too many false alarms, creating unnecessary noise, especially in the Intensive Care Unit (ICU). An effective solution which has been recently studied is to integrate information from multiple physiologic parameters to reduce alarms. But it is a challenge to detect abnormalities from high frequently changed physiological streams data, since abnormalities occur gradually due to the complex situation of patients. An analysis of ICU physiological data streams shows that many vital physiological parameters are changed periodically (such as heart rate, arterial pressure, and respiratory impedance) and thus abnormalities are generally abnormal period patterns. In this paper, we develop a Mining Abnormal Period Patterns from Multiple Physiological Streams (MAPPMPS) method to detect and rank abnormalities in medical sensor streams. The efficiency and effectiveness of the MAPPMPS method is demonstrated by a real-world massive database of multiple physiological streams sampled in ICU, comprising 250 patients' streams (each stream involving over 1.3 million data points) with a total size of 28 GB data.

A real-time abnormality detection system for intensive care management

Detecting abnormalities from multiple correlated time series is valuable to those applications where a credible realtime event prediction system will minimize economic losses (e.g. stock market crash) and save lives (e.g. medical surveillance in the operating theatre). For example, in an intensive care scenario, anesthetists perform a vital role in monitoring the patient and adjusting the flow and type of anesthetics to the patient during an operation. An early awareness of possible complications is vital for an anesthetist to correctly react to a given situation. In this demonstration, we provide a comprehensive medical surveillance system to effectively detect abnormalities from multiple physiological data streams for assisting online intensive care management. Particularly, a novel online support vector regression (OSVR) algorithm is developed to approach the problem of discovering the abnormalities from multiple correlated time series for accuracy and real-time efficiency. We also utilize historical data streams to optimize the precision of the OSVR algorithm. Moreover, this system comprises a friendly user interface by integrating multiple physiological data streams and visualizing alarms of abnormalities. © 2013 IEEE.

Experience report: anomaly detection of cloud application operations using log and cloud metric correlation analysis

Failure of application operations is one of the maincauses of system-wide outages in cloud environments. Thisparticularly applies to DevOps operations, such as backup,redeployment, upgrade, customized scaling, and migration that areexposed to frequent interference from other concurrent operations,configuration changes, and resources failure. However, currentpractices fail to provide a reliable assurance of correct execution ofthese kinds of operations. In this paper, we present an approach toaddress this problem that adopts a regression-based analysistechnique to find the correlation between an operation’s activity logsand the operation activity’s effect on cloud resources. Thecorrelation model is then used to derive assertion specifications,which can be used for runtime verification of running operations andtheir impact on resources. We evaluated our proposed approach onAmazon EC2 with 22 rounds of rolling upgrade operations whileother types of operations were running and random faults wereinjected. Our experiment shows that our approach successfullymanaged to raise alarms for 115 random injected faults, with aprecision of 92.3%.