Ensemble based sensing anomaly detection in wireless sensor networks

https://doi.org/10.1016/j.eswa.2012.02.036Get rights and content

Abstract

Wireless sensor networks are often used to monitor and measure physical characteristics from remote and sometimes hostile environments. In these circumstances the sensing data accuracy is a crucial attribute for the way these applications complete their objectives, requiring efficient solutions to discover sensor anomalies. Such solutions are hard to be found mainly because the intricate defining of the correct sensor behavior in a complex and dynamic environment. This paper tackles the sensing anomaly detection from a new perspective by modeling the correct operation of sensors not by one, but by five different dynamical models, acting synergically to provide a reliable solution. Our methodology relies on an ensemble based system composed of a set of diverse binary classifiers, adequately selected, to implement a complex decisional system on network base station. Moreover, every time a sensing anomaly is discovered, our ensemble offers a reliable estimation to replace the erroneous measurement provided by sensor.

Highlights

► We developed an efficient ensemble of five classifiers to detect sensor anomalies. ► We model the correct sensor behavior in complex/dynamic environments using five models. ► We solve the problems related to training, testing and evaluation of the ensemble. ► Our ensemble offers reliable estimations to replace the erroneous measurements. ► We present a case study to show the preciseness of our method.

Introduction

A wireless sensor network (WSN) is a collection of tiny, inexpensive and low-power devices that can be deployed throughout a geographical space for fine-grained monitoring and event detection. Besides its computing and communication potential, a WSN is, first of all, an advanced distributed measurement system which is often prone to sensing anomalies that can cause erroneous data, compromising the objectives of the entire network.

There are three major sources of sensor anomalies within WSN: (i) software or/and hardware failures – breakdowns in any subsystem of a sensor node or even battery discharging can produce wrong sensing data; (ii) security attacks – when a malicious entity compels the sensors to report erroneous measurements or to drop measurement data packages (Walters, Liang, Shi, & Chaudhary, 2006); (iii) environment related sources – when sensor nodes cannot measure the physical value correctly due to unfavorable phenomena that can arise in the harsh environments in which they are often deployed.

Generally speaking, sensing anomaly detection refers to the problem of discovering patterns in measurement data that do not match with expected behavior (Chandola et al., 2009, Rajasegarar et al., 2008, An et al., 2011). This is not a simple task mainly because an estimated model of “correct behavior” is always hard to find. In the case of a WSN there is an inherent feature on which we can rely – sensing redundancy (Curiac, Volosencu, Pescaru, Jurca, & Doboli, 2009), which takes two basic forms: physical redundancy that implies the use of more than one sensor node for measuring the same localized value; and analytical redundancy that implies a mathematical model for evaluating the value provided by one sensor by taking into consideration the past and present values of neighboring sensors (spatial redundancy), the past values of the sensor itself (temporal redundancy) or both (spatiotemporal redundancy).

In the last decade a series of relevant approaches based on assortments employing different types of analytical redundancies and intelligent detection algorithms have been proposed for solving the issue of sensing anomaly discovery.

In (Siripanadorn, Hattagam, & Teaumroong, 2010) a mixture between a competitive learning method called the self-organizing map (SOM) and the discrete wavelet transform (DWT) is used to detect anomalies from synthetic and real-world datasets.

A two-step temporal modeling procedure, developed to analyze and extract semantic symbols from a sequence of observations, is presented in Li, Thomason, and Parker (2010) where an intelligent system detects time-related changes online by using a likelihood-ratio detection scheme. The algorithm is distributed, and supports a hierarchical learning structure that can scale to large number of sensors.

The use of Bayesian networks as means for unsupervised learning and anomaly detection in gas monitoring sensor networks for underground coal mines is described in Wang, Lizier, Obst, Prokopenko, and Wang (2008). The authors showed that the Bayesian network model can learn cyclical baselines for gas concentrations, thus reducing false alarms usually caused by flatline thresholds. Their solution was proved to be efficient in both distributed and centralized approach.

An efficient method applying principal component analysis (PCA) simultaneously on multiple metrics received from various sensors is depicted in Chatzigiannakis and Papavassiliou (2007). One of the key features of this approach is that it provides an integrated methodology of taking into consideration and combining effectively correlated sensor data, in a distributed fashion. Furthermore, it allows the integration of results from neighboring network areas to detect correlated anomalies that involve multiple groups of nodes.

Our paper tackles the sensing anomaly discovery from a new perspective: the modeling of the correct behavior for sensors is done not by one, but by five different models, acting synergically to provide a reliable solution. For this, we developed an ensemble based system (EBS) containing five different binary classifiers, each categorizing every network node as being accurate or erroneous, the final decision being taken by the entire ensemble using a voting procedure. It is broadly accepted that the overall efficiency of such committees of classifiers can occur only if there is diversity among its components (Polikar, 2006). In our proposal, the heterogeneity of classifiers is achieved by using various and carefully selected classifier architectures and different sets of input data. In order to completely solve the problem, our ensemble not only discovers sensing errors, but offers reliable estimations to replace the measurements affected by these anomalies.

The remainder of the paper is organized as follows. In Section 2, we introduce the philosophy of our ensemble based sensing anomaly detection. Section 3 describes the architecture of each individual classifier, pointing out the way in which the correct sensing behavior is modeled and predicted, while Section 4 depicts the decisional block of the ensemble based on weighted voting algorithm. In Section 5, we present the methodology used for training and testing of the ensemble. Section 6 covers a test case illustrating the entire methodology and, finally, conclusions are offered in Section 7.

Section snippets

Ensemble based sensing anomaly detection

Discovering sensing anomalies in the context of WSN is a challenging issue due to the complexity of the environment in which sensor nodes are deployed. Often, this subject is tackled using dedicated decisional systems. For acquiring node behavior related decisions, it makes sense to ask more than one decision making entity, because this practice assures indubitably a better, more informed, and trustable final decision. We label these decisional instances as classifiers or experts and their

Designing the classifiers

The design of individual classifiers to fulfill the EBS requirements is not a simple task. This process has to be governed by one magic word: diversity. As a result, any stratagem for generating the ensemble members must be focused on the ensemble’s heterogeneity improvement.

The diversity of classifiers may originate from three basic sources:

  • a.

    classifier structure: the use of diverse classifier algorithms (Hsu and Srivastava, 2009, Tsoumakas et al., 2004) can assure the required heterogeneity

Decision block

The ensemble decision block is in charge of two tasks: (a) to provide a confident decision of “reliable” or “unreliable” regarding each and every sensor measurement; and, (b) to offer a trustworthy estimation of the measurement value when a value provided by the sensor is considered to be affected by an anomaly.

Taking the ensemble final decision can be efficiently implemented using the weighted majority voting algorithm (Littlestone & Warmuth, 1994). The five classifiers provide a set of

Training and testing the ensemble

After setting the structure for each individual classifier and for the decision block, a complex training and testing process must be carried out to assure optimal sets of parameters (Fig. 7). This is done using a variety of automated/nonautomated procedures individualized for each ensemble component and relies on training datasets obtained from two sources: computer simulation and experimental deployments of the same type of WSNs.

The training process is undoubtedly one of the most challenging

Implementation and case study

For validating the above concept and related methodologies we performed a series of studies using a WSN designed for measuring the temperature in an indoor environment. Our experimental sensor network is composed of nine Crossbow-Iris nodes equipped with MTS310 sensors boards which report the measured values through a gateway (MIB520CB) to a laptop-class device where our software modules can efficiently operate.

All the programs were developed in Matlab/Simulink mainly because of its strong

Conclusions

It is in the human nature to ask for two, three or maybe more different authorized opinions before taking a significant decision. This human characteristic was transferred to the domain of artificial intelligence through the concept of ensemble based system, producing relevant results in a large variety of domains. Being exposed to numerous risks, WSN often use complex decisional systems for controlling their lifecycle, for processing measurement data or even for dealing with malicious security

Acknowledgment

This work was developed in the frame of PNII-IDEI-PCE-ID923-2009 CNCSIS – UEFISCSU.

References (31)

  • D. Curiac et al.

    Redundancy and its applications in wireless sensor networks: A survey

    WSEAS Transaction on Computer

    (2009)
  • T.G. Dietterich

    An experimental comparison of three methods for constructing ensembles of decision trees: Bagging, boosting, and randomization

    Machine Learning

    (2000)
  • T.K. Ho et al.

    Decision combination in multiple classifier systems

    IEEE Transactions on Pattern Analysis and Machine Intelligence

    (1994)
  • Hsu, K.-W., & Srivastava, J. (2009). Diversity in combinations of heterogeneous classifiers. In Proceedings of the 13th...
  • D. Huttenlocher et al.

    Comparing images using the hausdorff distance

    IEEE Transactions on Pattern Analysis and Machine Intelligence

    (1993)
  • Cited by (0)

    View full text