HMM and Rule-Based Hybrid Intruder Detection Approach by Synthesizing Decisions of Sensors

Combining individual sensor decisions can be an effective way for the enhancement of the final decision on sensor fields for intruder detection. This paper proposes a novel methodology to unify the decisions from individual sensors on a sensor field through the (hidden Markov model) HMM and rules. The HMM especially provides a stochastic decision out of the individual sensor decisions on the sensor field; then it is filtered through rule inferences reflecting the knowledge of movement patterns on the level of the sensor field, such as spatial-temporal information and factual information on the movement of objects. This use of contextual knowledge remarkably improves the final decision for the detection. Also, this paper proposes the discretization method to express the state space of sensor field, and the performance evaluation is given by simulations.


Introduction
Good quality intruder detection is a critical issue in many applications such as surveillance in military zones and security and protection of mission-critical facilities. The human surveillance has many limitations in the quality of detection because of physical limitations of human beings such as the hardness of a consistent concentration on surveillance and the lack of reliability due to the capriciousness in human emotion. To overcome such limitations, the automated surveillance using sensors can be introduced because sensors do not get exhausted and keep alarmed stably without interruptions by changes like those in human emotion. A weakness in using sensors, however, is the lack of intelligence in detection which drops the detection quality. This implies that how intelligence equips sensor networks is critical for the automated surveillance and detection. On the other hand, the sensitivity of individual sensors of different types is varied depending on their deployed environment, and their detection performances are wide in their valuesespecially in case of outdoor sensor networks [1,2]. This makes it a challenge in practice how to deploy sensors in a sensor network so that it may fully reflect their environment states in spite of their variegated changes. For instance, the true and false alarm rates in an intruder detection sensor network change over time according to the states of the given environment, that is, sunny, snowing, raining, and so forth. This fact commands the robustness of outdoor sensor networks from the changeable environment [3].
The unification of individual sensor decisions on a sensor field, a deployed sensor network, could be a viable option to construct a robust sensor network under the uncertain environment. The decision-making step after collecting the knowledge of detections out of individual sensors may provide a chance to determine the extent of utilization of these individual decisions towards the final decision in the sensor network. This unification of small individual decisions has several advantages. First, the final decision in the sensor network mediates the individual sensor decisions, rather than leaving them isolated, that it could provide one conclusive decision. This decision synthesizing out of individual sensor 2 International Journal of Distributed Sensor Networks decisions may definitely help to avoid misjudgments or confusions caused by those individual sensor decisions solely, though this mediation is varied and not easy in complexity [4]. Second, during the process of unifying individual sensor decisions, it is possible to combine and exploit knowledge beyond those of the individual sensors in order to enhance the final decision.
This addition of knowledge should undoubtedly heighten the intelligence of the detection system, because it considers extensive knowledge systematically towards the final decision. In usual practical sensor networks, however, since decisions are made mainly based on the information collected from individual sensors that is mostly scalar sensing data [5,6], most of holistic knowledge sensor networks can use tends to be ignored in general; this may lead to misunderstandings in their decision makings. For example, usual sensor networks care about signal data, such as frequency, amplitude, and intensity, rather than the whole contextual knowledge on sensor fields: the spatial information (e.g., the relative location with respect to the whole network where a sensor reacts), the temporal information (e.g., the sensing pattern over time), and the factual information (e.g., the sensor type that makes a sensor node alarmed). These kinds of information are indeed precious in that they could contribute to the final decision for intruder detection. Hence, this paper purports to propose a methodology of decision making using the contextual knowledge by unifying individual sensor decisions on a sensor field. Although the proposed methodology in this paper is designed for intruder detection on sensor fields, it could be extended to other purposes on sensor networks.
This study focuses on knowledge obtained from the three kinds of information mentioned above, called patterns on a sensor field. Table 1 shows the considerable patterns needed in the decision making of intruder detection.
Proper movement patterns of an object on a sensor field could be investigated by the HMM with the Viterbi algorithm as shown in Figure 1. In a given observation, an explicit tracking of an object is available under the consideration of a stochastic movement pattern. The movement pattern retrieved by the HMM could be used for the intruder detection on the sensor field. For example, when the expected type of the target object is "Person, " the contiguity of the locations of the chased movement becomes a measurement to decide whether the moving object is "Person" or not; that is, when the retrieved trace of the moving object is improper, it could be filtered out by the consideration of the proper trace of the expected type of the target object. This is very helpful for the identification of the intruder. The trace of the detected object is also used for estimating its average speed so that the comparison of the estimated speed with the reported standard average speed of the expected type of the object can give useful information for the intruder identification. Furthermore, the movement pattern of the object can be restricted by the state and shape of the sensor field in many ways. If the corresponding movement patterns are explicitly definable by reflecting the restrictions, that knowledge could be useful for the intruder detection. For example, if the sensor field contains mine fields or cliff edges in a military zone, (e.g., adjacency between alarmed sensors, proper track of moving object, etc.).
(2) Detected average speed of an object on a sensor field.
(3) Specific movement patterns of an object on a sensor field.
(4) The types of sensor reacting with an object on a sensor field.

Most likely estimated trace of intruder
Observations (alarms) the movement of the target type "Person" can be hindered by the obstacles, and hence the movement of the intruder is predictable. The estimation of the trace of the moving object thus could be beneficial from such a state of the sensor field to increase the performance of the detection and the identification of the intruder. The knowledge about the types of sensors that respond to the types of the moving object is very useful for the intruder detection. Figure 2 shows the responding sensor types for the type of each object. According to the figure, it is recognized that the moving object cannot be an animal if a magnetic sensor reports detection because magnetic sensors do not react to animals. These pieces of knowledge are contained in inference rules, by which any detection in a sensor can be inferred to a conclusion about the type of an object.
Different from sensor network systems in signal processing, the main purpose of this paper is to construct an enhanced intruder detection model as a decision model unifying individual sensor decisions in a sensor network by using the HMM and inference rules. This paper also proposes a dynamic discretization method to express the state space for a sensor field. The remainder of the paper is organized as follows. In the next section, this paper continues with the description of the state space representation for the sensor field to which the HMM is applied. The structure of the HMM for intruder detection comes next and suggests the unifying decision-making approach that this paper uses. This part mainly consists of two subparts with an example, the stochastic decision, and the rule based decision. The conclusion follows lastly.

The State Space Representation of a Sensor Field for HMM
In order to deal with extended observation space + above, one of the options this paper adopts HMM [7][8][9] because of its strengths in finding out what the class sequence was. For the state space representation of a sensor field using HMM, let this paper introduce HMM with the formula of object function which is defined as arg max 1 ,..., where ∈ N; denote the given observation of 1 , . . . , by 1 : and the state space of 1 , . . . , by 1 , . . . , . The underlying HMM model is the triple ( , , Π) where Π = { } = ( 1 = 1 ), = = ( = | −1 = ), = = ( = | = ), , , ∈ N, , , > 0, and > . Denote the initial state probability by Π, the transition probability by , and the emission probability by . With consideration of the formula (1) and , the state space representation should be affordable for the calculation of conditional probability (i.e., emission probability), involve state and observation parts, and be capable of describing time-series state and observation lists.

State Formulation on HMM for a Sensor Field.
Consider the following state space in discrete form: where = { | ∃ ∈ N, ∈ }; denote by all possible state space, by the subset of , and by the element state of . Note that the state space points out all possible state space for a given sensor field which are categorized into the space in the detection of a sensor field and the space out of the detection of a sensor field; the categorized state space can be separated into several subcategories as described in Figure 3.
Then, (2) is rewritten as follows: Assumption 1. Let this paper make assumption for a sensor field as follows: (1) the sensor field consist of sensor nodes, a sensor nodes is the set of sensors; (2) there is no duplicated detection area of sensor node but a sensor does; (3) the sensors on sensor node are aligned to the same direction; (4) there is at least one omnisensor having maximum detection distance among sensors in a sensor node.
Based on the above assumption, this paper suggests discretization method for the state space of dynamic sensor field; obviously, the sensor field of MSN (mobile sensor network) cannot but be dynamic [10,11]. Through Figure 3, with Assumption 1, we notice that the range of sensor detection is the criteria for the distinction of 1 ∪ 2 and 3 ∪ 4 . More specifically, 1 and 2 are discriminated by the detection distance of sensor; 3 and 4 are distinct by geometrical features derived from triangulation and rectangulation. The discretization process follows Figure 4. Basically, the state space of "the area in the range of sensor detection ( 1 ∪ 2 )" corresponds to the ability of sensor detection; the state space of "out of the range of sensor detection area ( 3 ∪ 4 )" depends on the deploy locations of sensors. The internal space of a sensor field not including sensor detection area ( 3 ) especially, is obtained by Delaunay triangulation [12] as subtracting from triangle areas to 1 ∪ 2 ; the border of Unduplicated area of sensor detection: R 2 Internal area of sensor field: R 3 The border of sensor field: R 4 Out of the detection area of sensor field: R 5    a sensor field ( 4 ) is obtained by rectangulation from deployed location of sensors with subtracting from rectangle areas to 1 ∪ 2 ∪ 3 ; the remaining area is 5 . Based on Figures 3 and 4, this paper points out as follows: where = − ⋃ ∈{ | ⊂ } and denotes the detection area of jth sensor.
As for the areas of 1 and 2 , these are determined by the properties of sensor detection such as the radius of detection and the angle of detection. This paper introduces an example of that in the following section (Section 2.1.1 is an example for state formulation). The possible state space for undetectable area is defined as follows: Denote the set of center coordinations of sensor nodes by and the set of triangles derived from 1 , . . . , by 1 , . . . , . Note that is the numbers of sensor nodes and is the numbers of triangles which satisfy the objectives of Delanuary Triangulation for given 1 , . . . , . There are three cases of undetectable areas of sensor field which are 3 , 4 , and 5 . 3 ∪ 4 points out the undetectable areas of in sensor field, while 5 indicates the area of out of sensor field.
Note that the state space representation ensures that it presents all the possible state space. For the 1 and 2 , those are described precisely by the given parameters-which means that the range of detection area of the sensor is given explicitly. However, it has ambiguity to define "The area out of the range of sensor detection" ( 3 ∪ 4 ) because the shape of that area is flexible in concordance with the deployment information such as the number, the location, and the type of sensor. Hence, we need to make sure that 3 ∪ 4 covers all the areas of "The area out of the range of sensor detection" in any case. For this purpose, this paper defines those areas separately by triangle and rectangular. From the Delaunay triangulation, we guarantee that the obtained area "Internal area of a sensor field" is convex set and completely covers internal area of a sensor field; after that, by adding circumscribed quadrilateral ( 4 ), this paper guarantees that the obtained area of 1 ∪ 2 ∪ 3 ∪ 4 addresses all the space of a sensor field consequently and obtained set is convex.

An Example for State Formulation.
Let this paper explain our discretization method in the previous section with an example.
As seen in Figure 5, there are two types of sensor node. The first one consists of pressure, acoustic, and magnetic sensor, and the other consists of pressure, PIR, and UWB sensor. Consider 1 and 2 as the branch of "The area in the range of sensor detection. " Then detection distances of sensors in sensor node are only factors to distinct 1 "Duplicated area of sensor detection" and 2 ("Unduplicated area of sensor detection") so that we define 1 as the detectable area of sensors which have less detection distance than the one that has a maximum detection distance of a sensor node. In order to allocate 1 and 2 on sensor field, Let us define (the detection area of sensor ): where − ≥ 0 and − ≥ 0 where − <0 and − > 0 where − >0 and − > 0 where − > 0 and − < 0.
Then, we define as Denote -coordinate and -coordinate on a sensor field by and . , , and indicate the center coordinates and the detection distance of sensor , respectively, where is one of the sensors of sensor node and < max ( max is the maximum detection distance on sensor node). In addition points out that minAngle ≤ the detection angle of ≤ maxAngle . Notice that there are two types of sensor node, sector type and circle type. Basically, (7) is derived from the sector type of a sensor node. However, the circle type of sensor node has 0 ∘ ≤ ≤ 360 ∘ such that (7) is held in case of circle type of sensor node as well. As for the detection area of 1 and 2 , numbers of sensors, − 1 duplicated areas are there. 1 and 2 are described as where < , > and , ∈ .
where = , > and , ∈ . Denote the detection radius of a sensor and a sensor node by and repectively. Note that If has the same detection radius of its sensor node, then the obtained binds to 2 , otherwise 1 .
As mentioned in Section 2.1, on account of the flexibility of undetectable area in a sensor field, this paper describes that area as triangles and circumscribed quadrilateral to ensure that our approach represents all the possible state space on a sensor field in any shape. The way to achieve the goal is fairly simple in principle. From the Delaunay triangulation, we obtain guaranteed convex set for the internal space of undetectable area on a sensor field; after that as using line segments of triangles for circumscribed quadrilateral, facilely we generate optimal state space, and the meaning of optimal state space here is that all the area is evenly separated as possible as a given parameter. The acquisition of the internal space of undetectable area is achieved by International Journal of Distributed Sensor Networks Pressure Acoustic Magnetic UWB PIR x 58 x 46 x 36 x 37 x 38 Figure 5: State space representation-an example a sensor field.
Denote the apexes of the triangle by . The function ( , ) ( , ) evaluates whether or not the points and are located in the same region (i.e., ( , ) ( , ) ≥ 0) for a given linear equation 1 , 2 , and 3 , respectively. Note that by (10)∼ (13) indicates the interior area of the given triangle. Hence, the undetectable area inside a sensor field 3 is described as Related to the given parameters of (18), this paper adopts Delaunay triangulation to generate undetectable areas shaped in triangles. Being the apexes of triangle, the center coordinates of sensors are applied for the triangulation. The procedure of Delaunay triangulation is as follows: (1)  the legal edge condition as shown in Figure 6(b). (7) Remove arbitrary generated points left and right .
For the border of a sensor field, consider the following equation: Note that the equation to calculate the area of rectangular is similar as (10) in principle by using linear equation. Hence, we skip explaining the specific function ( , , , ). Denote by , , , and the coordinate of rectangular by , , and the area involved in 1 , 2 , and 3 . Note that is line segment of circumscribed quadrilateral and of triangle as well; is acquired by triangulation which means that , are the center coordinates of sensor. Basically, and are easily derived from given , by Pythagorean theorem. From the reason of that , are the center coordinates of circle or sector, the derived rectangles are always circumscribed quadrilateral such that International Journal of Distributed Sensor Networks 7 in any case pythagorean theorem is valid in the calculation to obtain , . Let us explain the calculation for , with the definition of which ( ) is the function retrieving the radius of the sensor having the center coordinate . In the 2-D coordination, Euclidian distance is From (17), is √ ( , ) 2 + ( ) 2 , hence and is given; after that We have two variables ( , ) and (18) such that is calculated. Through the same procedures of (17) and (18), the circumscribed quadrilaterals based on line segments of triangles are generated. As a consequence, from (16) we generate "the border of a sensor field" state. 5 is simply defined as 0 = {0} because of "out of the area on a sensor field. "

The Representation of Observations of the Example.
According to the sensing factors, different types of sensors determine its decision through signals that react with thresholds [13]. In this point, the decisions from these sensors are regarded as the decisions reflecting the features of each type of sensors. In our point of view, this is meaningful in terms of sensor network. Hence, this paper exploits the decisions of each sensor in a sensor field as the observation of HMM.
The observation in HMM can either be discrete or continuous [14,15]. This paper applies discrete observation which represents "Detect" (Active) and "No respond. " The possible discrete observation space in our case is 2 ( is the number of sensors in a sensor field). In order to deal with all possible observation space, this paper represents the observation as " 1 , . . . , 2 " with the interpretation of digits code. For example, if there are four sensors in a sensor field, we interpret the observation as "0 | 1, 0 | 1, 0 | 1, 0 | 1" (0: No respond, 1: Detect). In addition, for the calculation of conditional probability, the state representation of HMM is interpreted by digit code in the same way as well. The emission probabilities are calculated by means of those representations, and the transition probabilities are obtained with first order Markov assumptions [9]. Figure 7 depicts an example of the representation of states and observations for Figure 5. There are 36 sensors on a sensor field. The whole possible numbers of observations are 2 36 = 68719476136. We define the symbol 0 to indicate that no alarm is reported and 3 for what sensor 1 and sensor 3 make an alarm. The indexes of symbol for an observation are obtained by transforming the binary to the decimal notation. In case of the representation of states for a sensor field, we adopt the suggested discretization approach at Section 2.1. According to the deploy information of sensors and its detection ranges, the symbol indicating a state is assigned with the proper range of a region. And the proper range assigned for that is interpreted by the detection ranges of sensors. For example, 1 could be depicted by the ranges of sensor 1, sensor 1, and sensor 3. The one advantage of describing states by the detectable ranges in the manner of sensor is that it enables the calculation of emission probability through the given observations and states.

The Structure of HMM for Intruder Detection
The structure of HMM could be represented by ( , , Π). , and = ( | ). However, in order to obtain initial and transition probability of HMM, the actual movement of an object is required. Hence, this paper applies Gaussian mobility model [15] to gain proper movements of objects. Gaussian mobility model is a well-known model to generate reliable movement of object by manipulating the parameters. The following indicates movement equations of the model.

The equation for speed and direction calculation
The equation for coordinate generation (2 Dimention) Denote the speed and direction at time by and , respectively, the tuning parameter for adjustment of randomness where 0 ≤ ≤ 1 by , the mean values of speed and direction of object by and , and the standard of deviation of speed and direction by and . Note that according to the tune of with , , , and , the movement of a desired object is modeled.
The movement model of "Person, " "Animal (Deer), " and "Tracked Vehicle" has been approximated with given parameters as follows: Person:  0 · · · 0 0 · · · 0 0 · · · 0 0 · · · 0 0 · · · 0 0 · · · 0 0 · · · 0 1 · · · 1 · · · · · · ob 0 ob 1 ob 2 each movement (Person, Animal, and Tracked Vehicle) and then by calculating the frequencies of state changes, the state matrix of HMM is conducted with the following equations. Inital probability: where , , ∈ N, and is the total numbers of states. Transition probability: Basically, the model requires transition matrix, initial probability, and emission matrix. The way of obtaining those factors of HMM is that for the case of transition matrix, random sampling is used as we mentioned above. Secondly, initial probability is obtained by the state change from 0 to which means the entering probability to a sensor field. It is reasonable because we define 0 ∈ 5 (out of the sensor field) at Section 2. Thirdly, emission matrix is dynamically calculated with the interpretation of Section 2.1.2. Assume that there are sensors having the same performance = 0.8, = 0.1, = 0.1, and = 0.5 for an example of emission probability calculation. The calculation for that is depicted in Figure 9. The representation shown in Figure 9 is derived from the sensor field having 1 sensor node comprised of three sensors. From this, obtained emission probability for ( 2 | 2 ) is "0.8 × 0.1 × 0.1 = 0.008. " In the details, 2 points out the state detectable by sensor 3 and sensor 2; in the mean time 2 indicates the observation of alarmed by sensor 3 and sensor 1. Hence, the emission probability is calculated with the false alarm rate of sensor 1, the rate of detection failure of sensor 2, and the rate of detection success of sensor 3.

Decision-Making Methodology Using HMM with Rules
As a first phase of our methodology for combining decisions, this paper provides the decision-making methodology based on stochastic model by adopting the suggested discretization method to HMM. The motivation of our methodology is quite naïve. Simply, there are distinct advantages between stochastic and cause-and-effect deterministic model. With an assumption of which all the events have probabilities to be happened, stochastic model is more explainable than cause-and-effect model for a given phenomenon. However, at some points, the cause-and-effect model could complement stochastic model for the enhanced decision. For example, the knowledge which has a difficulty in the representation of stochastic model can be easily extended to the rules for better decisions (experienced knowledge, statistical values, common sense, and others). Figure 10 indicates the architecture for our approach to combine stochastic (HMM) and rulebased decision within complexity of ( 2 ) and ( ), respectively. Denote evaluated costs by ( ), numbers of states of HMM by , numbers of rules by , the number of assertions , and the approximate number of conditions per rule by .
As an approach for unifying decisions of sensors on a sensor field, this paper adopts HMM and rules. The first part of synthesizing decisions is achieved by HMM and then as a second part, this paper adopts rule-based decision. As shown in Figure 10, sensors in the sensor field have made sensor decisions by the input signals such as frequencies, amplitudes, decibels, and others. Then the decisions ( | ) become the input parameters to HMM as the observation of a moving object. In our methodology, the unified decision by HMM is achieved by means of judging the acceptability of model 1: (i.e., HMM 1 , HMM 2 , . . . , HMM ) by thresholds   Denote by the number of HMM model and bŷthe probability of the most likely state sequence for given observations on th model (e.g., Person, Animal, or Tracked Vehicle). Note that (23) selects one model whatever it is, according to the probability of the most likely state sequence. Then the identification of moving object is performed by the selected model. Hence, it is necessary to measure the acceptability of HMM model and filter the stochastic decision, the decision which has been made by HMM. The acceptability of HMM model is judged with thresholds 1 , 2 , and 3 and then the stochastic decision is filtered by rules.

Stochastic Decision-Making Model with HMM on a Sensor
Field. The procedure of stochastic decision is depicted by Figure 11. The procedure of stochastic decision making starts with calculating likelihood probability for the sequences of observations and obtaining maximum likelihood probability for the estimated movement patterns by Viterbi algorithm. Likelihood probability indicates how given observations are explainable by the established model (HMM), whilep oints out how estimated patterns occur by given observations on the model. Both of them would be criteria for choosing a model for stochastic decision. However, this paper mainly focuses on the movement of an object. We adopt arg max =1,..., (̂) as a measure of HMM decision.
The in Figure 11 is calculated by the observations in time 1: as follows: where ∈ in time 1 , . . . , . Denote by observations, by states, and by initial probability. Note that the function ( ) indicates the emission probability of observation for the state and This paper applies Viterbi algorithm [16] to find the most likely underlying explanation of the sequence of observation and the probability of estimated state sequencêwith the following object functions:   | 1: , )) , | 1: , )) .

Rule-Based Filtering to Enhance the Stochastic Decision.
The simplest idea of rule-based filtering is that a tactic and implicit knowledge could be conducted as hypothesizes for the decision making. For example, the knowledge such as "the average speed of a moving object, " "stop pattern (specific pattern of an object), " and "corresponding types of sensors to an object" could be utilized as hypothesizes for intruder detection. This paper intends to represent those hypothesizes as rules for filtering HMM decision to enhance intruder detection. Hence, as shown in Figure 13, the final decision of our approach is defined as Final Decision̂: has inTheRangeOfAverageSpeed ∧́has regular-Path ∧́is the ProperType for Sensor Responding → intuderType is.
The rule for final decision̂could be depicted by the rule tree ( Figure 14).̂considers at first the specific patterns of given objects. In our case, we conduct the rules for "Person, "   has three criteria which are ℎ, V , and ProperIntruderTypes. ℎ represents the specific pattern of an object. For example, assume that there are mine area or cliff edge on a sensor field; in this case we suppose that the allowed area to the a sensor field are restricted for "Person" which means if nonallowed areas are traced by HMM, then we can decide explicitly that the type of intruder is not "Person" as follows: # The restrict condition of an intruder movement (=Person) (ℎ (? 2 , 9 ), ) → ℎ(? , " ").
The rule of V is referred to by the parameters of Gaussian mobility model for each objects. The purpose of adopting rules is filtering the misjudgment of a stochastic decision. In this point, we establish the deviation of the average speed to cover the wide range of speed, because of two reasons. The first one is that our approach applies discrete variable to represent the state space of HMM and that makes it hard to measure precise estimated speed. In the second one, basically we assume that stochastic decision has an admissible performance for detecting intruder. Hence, we intend to filter ridiculous estimated speed only by rules. In other word, we expect that the observations from earthquake, airplane, and any other unclassified objects are filtered during the sarcastic decision procedure. However, if it is not filtered by HMM, then rule-based filtering would be operated. The following rule is conducted for the case in which moving object is person with reflecting above argument: Knowing the type of the corresponding sensor to object is beneficial to determine the type of intruder. For example, Table 2 points out the sensors being available for the detection in given objects. From Table 2, this paper conducts rules shown in Table 3.

The Sensor Field
Applied for the Simulation. This paper produces simulated results through the sensor field comprised of different types of 36 sensors having 90 percent of detecting rate and 1 percent of false alarm rate. Figure 15 indicates the utilized sensor field for the simulation. We assumed that a sensor field is deployed along the road. We conduct three kinds of HMM model which are "Person, " "Animal, " and "Tracked Vehicle" with parameters of Gaussian mobility model. Among those models, this paper defines the possible types of intruders (target objects) on the sensor field as "Person" and "Tracked Vehicle. " The other incoming objects are classified as nontarget objects of a sensor field (animal, airplane, and other clutters). Assume that the expected initial points of intruders are " 3 , " " 42 , " and " 6 , " while non-target objects have the random initial points.

The Performance of Our Approach Using HMM with
Rules for Intruder Detection. The performance of Table 4 is measured by three kinds of a sensor field. Each sensor field has (80%, 1%), (90%, 3%) and (99%, 5%) of detection rate and false alarm rate, respectively. Define the measurements for the performance test as follows: Detection rate of sensor: ( | ), False alarm rate of sensor: Intruder detection rate of a sensor field = ( | ) False detection rate of a sensor field = ( | ¬ ) Detection fail of a sensor field = ( | ) No response of a sensor field = ( | ¬ ).
Note that = {Person, Animal, Tracked Vehicle}, = {Person, Tracked Vehicle}, and = ¬ (any other objects or clutters except "Person" and "Tracked Vehicle"). The listed results in Table 4 are obtained by 100 times simulation for each object. The movements of "Person, " "Animal, " and "Tracked Vehicle" are generated through Gaussian mobility model, and random noise is acquired by random observations. The average performance of our approach using HMM with rules represents 98.3% of intruder detection rate ( ) and 0% of false detection rate ( ). From the results, in overall, this paper insists that our approach successfully makes a decision for intruder detection. The simulation for intruder detection is designed to investigate the sensitivity of a sensor field. Hence, each movement of objects has been generated to a different sensor field (SF = {(80, 1), (90, 3), (99, 5)}). The obtained results point out that the performance of intruder detection is more sensitive to "False alarm rate" than "Detection rate" of sensors. In the same manner, we assume that "False detection rate" is one of the key measures to evaluate the performance of a sensor field.

The Effectiveness Analysis of Our Approach.
Our approach is mainly designed to focus on reducing as using threshold-based filter and rule-based filtering. Table 5 demonstrates the effectiveness in reducing "False detection rate" of our approach. In Table 5, "Misclassification rate" is obtained from stochastic decision using HMM only, while "False detection rate" is calculated with our approach. The fed observations to each model as follows: (i) Random noise: random observations (ii) Airplane: simultaneously, pressure and acoustic sensors only react (iii) Animal * : force magnetic sensor to react with animal movement; make every movements pass by an magnetic sensor at least once.
From the thresholds for stochastic decision, "Random Noise" and "Airplane" are filtered as "Nonintruder. " In case of "Animal * , " the sequences of observations are classified into 91% of Person and 9% of Animal. Hence, "Misclassification rate" is measured as 1 because by definition of "Animal * " the x 37 x 9 x 38 x 39 x 21 x 40 x 41 x 33 x 1 x 2 x 3 x 7 x 8 x 13 x 14 x 15 x 19 x 20 x 25 x 26 x 27 x 31 x 32 x 43 x 45 x 47 x 49 x 51 x 53 x 4 x 0 2 x 44 x 54 x 46 x 55 x 48 x 56 x 50 x 57 x 52 x 58 x 5 x 6 x 4 x 10 x 11 x 12 x 17 x 16 x 18 x 22 x 23 x 24 x 29 x 28 x 30 x 34 x 36 x 35 Figure 15: The sensor field simulated.  Table 5 is that nine movement patterns of "Animal * " are classified as animal. Basically, magnetic sensors do not react with animal movements. As a result, in principal, the emission probability of HMM for "Animal" ( ( | )) is always 0, when magnetic sensors are responded. That means that magnetic sensors make alarms, whenever the movement is not an animal. For this issues, there are two exceptional cases determining an animal for given observations of "Animal * . " The first is that the false alarm rate of the sensors could contribute to emission probability when calculating its probability. In this case, we have disabled the probability of detection and of false alarm as well in the establishment of HMM model for "Animal. " The second one is that the rate of detection failure for "Animal * " could make the observations which magnetic sensor does not react to. This situation causes the movement of "Animal * " to be classified into an animal (misclassification) and in general, practically it makes the measurements of and considerable when establishing detection model. From this point of view, keeping least rates of detection fail and false detection, not to mention detection rate, is a main objective for intruder detection model. Table 6 and Figure 16 reveal the outstanding performance of our approach.
We conduct SDR (simple decision rule) to compare with our approach. SDR makes a decision when the consecutive alarms are reported at least times. In terms of detection rate, SDR (1) is the most effective model than any other models but it also has the worst performance on false detection rate. Basically, the numbers of consecutive alarms are in inverse proportion to detection fail and in direct proportion to detection and false detection. Hence, the optimal numbers of SDR could be obtained by the analyzing sensitivity of measurements (detection, detection fail, and false detection). According to the sensitivity of those measurements in some    specific problems, an optimal SDR sometimes could be more effective than our approach. However, in general we insist that our approach is more distinguish than SDR because of holding the admissible detection rate with low level of false detection and detection fail ( Figure 16).
As the final simulation, we investigate the possibility finding out the initial point for decision-making process. We recognized that once enough observations are accumulated, then the movement decoding using Viterbi algorithm is properly operated. From this point, we assume that finding out the number of consecutive sensor alarms would be  beneficial to the movement estimation of objects by delaying the initial activation time of HMM. As an example, we investigate person's movement with 100 times random samples. Figure 17 represents the tendency of conditional probability that intruder exists on a sensor field and consecutive sensor alarms at the time . The probability that an intruder exists on a sensor field is calculated with = 1 − ( 0 | ) and consecutive sensor alarms are measured by CSA = / Max( 1 : ). Note that points out the consecutive sensor alarms having the same observation at the time .
In Figure 17, we recognize if CSA has a first peak with predefined threshold 0.2 for person movement, and in the mean time closes to 1 which means some object is on a sensor field. From the result, we expect that the initial activation time of HMM could be determined as using CSA . This brings to us valuable points. First, by determining the initial activation time for HMM, we could increase the performance of tracing movement. Second, with the policy of sensor activation using CSA , we could extend the operating time of a sensor field by delaying activation of the decision process for unnecessary observations.

Conclusion
In this paper, we consider a decision-making methodology for intruder detection by synthesizing the decisions on sensor network. This paper especially adopts the HMM to combine individual sensor decisions in stochastic manner and applies rules for the enhancement of the final decision. Firstly, using the HMM, this paper collects decisions of individual sensors on a sensor field and retrieves an estimated movement of a moving object. The obtained movement pattern is employed to identify the type of an object on the sensor field by taking advantage of spatial-temporal information. In this way, retrieved movement patterns on a sensor field contribute to the judgment of intruder detection beyond the simple use of signal values from individual sensors with some thresholds in their decisions. Secondly, this paper uses rules to enhance the stochastic decision obtained from the HMM. In principle, the HMM makes a decision by a given transition and emission probabilities under the assumption that all events have probabilities to occur. However, there are worth axioms and knowledge for a decision making on a sensor field that contradicts the assumption of probabilistic model (HMM). This paper adopts these knowledge and axioms as rules to enhance the decision of sensor field. As an example, this paper conducts several rules representing specific movement patterns of objects, the average speeds of the movements, and the sensor types which respond to specific objects. Since any kind of knowledge can be expressed by the rules, this proposed methodology could be easily extended for other purposes.
The contribution of this paper can be summarized as follows. First, this paper proposes the dynamic discretization method for the construction of the state space in a sensor field. Any shape of a sensor field is dynamically represented as a state space for the HMM through the proposed discretization method. Second, this paper provides a decisionmaking methodology for intruder detection on a sensor field by using HMM and rules, and its performance is evaluated with simulations.