A hierarchical PCA-based anomaly detection model

A hierarchical intrusion detection model is proposed to detect both anomaly and misuse attacks. In order to further speed up the training and testing, PCA-based feature extraction algorithm is used to reduce the dimensionality of the data. A PCA-based algorithm is used to filter normal data out in the upper level. The experiment results show that PCA can reduce noise in the original data set and the PCA-based algorithm can reach the desirable performance.

First-priority relation graph-based malicious users detection in mobile social networks

Mobile social networks (MSNs) consist of many mobile users (individuals) with social characteristics, that provide a variety of data delivery services involving the social relationship among mobile individuals. Because mobile users move around based on their common interests and contact with each other more frequently if they have more social features in common in MSNs. In this paper, we first propose the first-priority relation graph, say FPRG, of MSNs. However, some users in MSNs may be malicious. Malicious users can break the data delivery through terminating the data delivery or tampering with the data. Therefore, malicious users will be detected in the process of looking for the data delivery routing to obtain efficient and reliable data delivery routing along the first-priority relation graph. Secondly, we propose one hamiltonian cycle decomposition of FPRG-based adaptive detection algorithm based on in MSNs under the PMC detection model (the system-level detection model).

An adaptive elliptical anomaly detection model for wireless sensor networks

Wireless Sensor Networks (WSNs) provide a low cost option for monitoring different environments such as farms, forests and water and electricity networks. However, the restricted energy resources of the network impede the collection of raw monitoring data from all the nodes to a single location for analysis. This has stimulated research into efficient anomaly detection techniques to extract information about unusual events such as malicious attacks or faulty sensors at each node. Many previous anomaly detection methods have relied on centralized processing of measurement data, which is highly communication intensive. In this paper, we present an efficient algorithm to detect anomalies in a decentralized manner. In particular, we propose a novel adaptive model for anomaly detection, as well as a robust method for modeling normal behavior. Our evaluation results on both real-life and simulated data sets demonstrate the accuracy of our approach compared to existing methods.

Detection of respiratory arousals using photoplethysmography (PPG) signal in sleep apnea patients

Respiratory events during sleep induce cortical arousals and manifest changes in autonomic markers in sleep disorder breathing (SDB). Finger photoplethysmography (PPG) has been shown to be a reliable method of determining sympathetic activation. We hypothesize that changes in PPG signals are sufficient to predict the occurrence of respiratory-event-related cortical arousal. In this study, we develop a respiratory arousal detection model in SDB subjects by using PPG features. PPG signals from 10 SDB subjects (9 male, 1 female) with age range 43-75 years were used in this study. Time domain features of PPG signals, such as 1) PWA--pulse wave amplitude, 2) PPI--peak-to-peak interval, and 3) Area--area under peak, were used to detect arousal events. In this study, PWA and Area have shown better performance (higher accuracy and lower false rate) compared to PPI features. After investigating possible groupings of these features, combination of PWA and Area (PWA + Area) was shown to provide better accuracy with a lower false detection rate in arousal detection. PPG-based arousal indexes agreed well across a wide range of decision thresholds, resulting in a receiver operating characteristic with an area under the curve of 0.91. For the decision threshold (PC(thresh) = 25%) chosen for the final analyses, a sensitivity of 68.1% and a specificity of 95.2% were obtained. The results showed an accuracy of 84.68%, 85.15%, 86.93%, and 50.79% with a false rate of 21.80%, 55.41%, 64.78%, and 50.79% at PC(thresh) = 25% or PPI, PWA, Area , and PWA + Area features, respectively. This indicates that combining PWA and Area features reduced the false positive rate without much affecting the sensitivity of the arousal detection system. In conclusion, the PPG-based respiratory arousal detection model is a simple and promising alternative to the conventional electroencephalogram (EEG)-based respiratory arousal detection system.

Saliency detection using hierarchical manifold learning

Saliency detection is critical to many applications in computer vision by eliminating redundant backgrounds. The saliency detection approaches can be divided into two categories, i.e., top-down and bottom-up. Among them, bottom-up models have attracted more attention due to their simple mechanisms. However, many existing bottom-up models are not robust to crowded backgrounds because of missing salient regions within feedforward frameworks which is often not effective for complex scenes. We tackle these problems by modifying and extending a bottom-up saliency detection model through three phases, (1) constructing a hierarchical sequence of images from the perspective of entropy, (2) estimated mid-level cues are used as feedback information, (3) subsequently generating saliency maps by global context and local uniqueness in a graph-based framework. We also compare the proposed bottom-up model with state-of-the-art approaches on two benchmark datasets to evaluate its saliency detection performance. The experimental results demonstrate that the proposed bottom-up saliency detection approach is not only robust to both cluttered and clean scenes, but also able to obtain objects with different scales.

High-dimensional and large-scale anomaly detection using a linear one-class SVM with deep learning

High-dimensional problem domains pose significant challenges for anomaly detection. The presence of irrelevant features can conceal the presence of anomalies. This problem, known as the '. curse of dimensionality', is an obstacle for many anomaly detection techniques. Building a robust anomaly detection model for use in high-dimensional spaces requires the combination of an unsupervised feature extractor and an anomaly detector. While one-class support vector machines are effective at producing decision surfaces from well-behaved feature vectors, they can be inefficient at modelling the variation in large, high-dimensional datasets. Architectures such as deep belief networks (DBNs) are a promising technique for learning robust features. We present a hybrid model where an unsupervised DBN is trained to extract generic underlying features, and a one-class SVM is trained from the features learned by the DBN. Since a linear kernel can be substituted for nonlinear ones in our hybrid model without loss of accuracy, our model is scalable and computationally efficient. The experimental results show that our proposed model yields comparable anomaly detection performance with a deep autoencoder, while reducing its training and testing time by a factor of 3 and 1000, respectively.

Detection and classification of anomaly intrusion using hierarchy clustering and SVM

Anomaly detection as a kind of intrusion detection is good at detecting the unknown attacks or new attacks, and it has attracted much attention during recent years. In this paper, a new hierarchy anomaly intrusion detection model that combines the fuzzy c-means (FCM) based on genetic algorithm and SVM is proposed. During the process of detecting intrusion, the membership function and the fuzzy interval are applied to it, and the process is extended to soft classification from the previous hard classification. Then a fuzzy error correction sub interval is introduced, so when the detection result of a data instance belongs to this range, the data will be re-detected in order to improve the effectiveness of intrusion detection. Experimental results show that the proposed model can effectively detect the vast majority of network attack types, which provides a feasible solution for solving the problems of false alarm rate and detection rate in anomaly intrusion detection model.

Event extraction using behaviors of sentiment signals and burst structure in social media

Significant world events often cause the behavioral convergence of the expression of shared sentiment. This paper examines the use of the blogosphere as a framework to study user psychological behaviors, using their sentiment responses as a form of ‘sensor’ to infer real-world events of importance automatically. We formulate a novel temporal sentiment index function using quantitative measure of the valence value of bearing words in blog posts in which the set of affective bearing words is inspired from psychological research in emotion structure. The annual local minimum and maximum of the proposed sentiment signal function are utilized to extract significant events of the year and corresponding blog posts are further analyzed using topic modeling tools to understand their content. The paper then examines the correlation of topics discovered in relation to world news events reported by the mainstream news service provider, Cable News Network, and by using the Google search engine. Next, aiming at understanding sentiment at a finer granularity over time, we propose a stochastic burst detection model, extended from the work of Kleinberg, to work incrementally with stream data. The proposed model is then used to extract sentimental bursts occurring within a specific mood label (for example, a burst of observing ‘shocked’). The blog posts at those time indices are analyzed to extract topics, and these are compared to real-world news events. Our comprehensive set of experiments conducted on a large-scale set of 12 million posts from Livejournal shows that the proposed sentiment index function coincides well with significant world events while bursts in sentiment allow us to locate finer-grain external world events.

Following targets for mobile tracking in wireless sensor networks

Traditional tracking solutions in wireless sensor networks based on fixed sensors have several critical problems. First, due to the mobility of targets, a lot of sensors have to keep being active to track targets in all potential directions, which causes excessive energy consumption. Second, when there are holes in the deployment area, targets may fail to be detected when moving into holes. Third, when targets stay at certain positions for a long time, sensors surrounding them have to suffer heavier work pressure than do others, which leads to a bottleneck for the entire network. To solve these problems, a few mobile sensors are introduced to follow targets directly for tracking because the energy capacity of mobile sensors is less constrained and they can detect targets closely with high tracking quality. Based on a realistic detection model, a solution of scheduling mobile sensors and fixed sensors for target tracking is proposed. Moreover, the movement path of mobile sensors has a provable performance bound compared to the optimal solution. Results of extensive simulations show that mobile sensors can improve tracking quality even if holes exist in the area and can reduce energy consumption of sensors effectively.

Activity recognition and abnormality detection with the switching hidden semi-Markov model

This paper addresses the problem of learning and recognizing human activities of daily living (ADL), which is an important research issue in building a pervasive and smart environment. In dealing with ADL, we argue that it is beneficial to exploit both the inherent hierarchical organization of the activities and their typical duration. To this end, we introduce the Switching Hidden Semi-Markov Model (S-HSMM), a two-layered extension of the hidden semi-Markov model (HSMM) for the modeling task. Activities are modeled in the S-HSMM in two ways: the bottom layer represents atomic activities and their duration using HSMMs; the top layer represents a sequence of high-level activities where each high-level activity is made of a sequence of atomic activities. We consider two methods for modeling duration: the classic explicit duration model using multinomial distribution, and the novel use of the discrete Coxian distribution. In addition, we propose an effective scheme to detect abnormality without the need for training on abnormal data. Experimental results show that the S-HSMM performs better than existing models including the flat HSMM and the hierarchical hidden Markov model in both classification and abnormality detection tasks, alleviating the need for presegmented training data. Furthermore, our discrete Coxian duration model yields better computation time and generalization error than the classic explicit duration model.

Polymorphic malware detection using Hierarchical Hidden Markov Model

Binary signatures have been widely used to detect malicious software on the current Internet. However, this approach is unable to achieve the accurate identification of polymorphic malware variants, which can be easily generated by the malware authors using code generation engines. Code generation engines randomly produce varying code sequences but perform the same desired malicious functions. Previous research used flow graph and signature tree to identify polymorphic malware families. The key difficulty of previous research is the generation of precisely defined state machine models from polymorphic variants. This paper proposes a novel approach, using Hierarchical Hidden Markov Model (HHMM), to provide accurate inductive inference of the malware family. This model can capture the features of self-similar and hierarchical structure of polymorphic malware family signature sequences. To demonstrate the effectiveness and efficiency of this approach, we evaluate it with real malware samples. Using more than 15,000 real malware, we find our approach can achieve high true positives, low false positives, and low computational cost.

Fault detection and diagnosis of induction motors using motor current signature analysis and a hybrid FMM-CART model

In this paper, a novel approach to detect and classify comprehensive fault conditions of induction motors using a hybrid fuzzy min-max (FMM) neural network and classification and regression tree (CART) is proposed. The hybrid model, known as FMM-CART, exploits the advantages of both FMM and CART for undertaking data classification and rule extraction problems. A series of real experiments is conducted, whereby the motor current signature analysis method is applied to form a database comprising stator current signatures under different motor conditions. The signal harmonics from the power spectral density are extracted as discriminative input features for fault detection and classification with FMM-CART. A comprehensive list of induction motor fault conditions, viz., broken rotor bars, unbalanced voltages, stator winding faults, and eccentricity problems, has been successfully classified using FMM-CART with good accuracy rates. The results are comparable, if not better, than those reported in the literature. Useful explanatory rules in the form of a decision tree are also elicited from FMM-CART to analyze and understand different fault conditions of induction motors.