Incremental Anomaly Detection Approach for Characterizing Unusual Profiles
Incremental Anomaly Detection Approach for Characterizing Unusual Profiles
复制标题
DOI：
10.1007/978-3-642-12519-5_11
复制
发表时间：
2008-08
期刊：
影响因子：
--
通讯作者：
Yi Fang;O. Omitaomu;A. Ganguly
中科院分区：
文献类型：
--
作者：
Yi Fang;O. Omitaomu;A. Ganguly
在安全应用中，从传感器数据中检测异常配置文件或异常行为特征尤其复杂，因为威胁指标可能事先已知，也可能未知。对大量历史数据进行预测建模可以产生对常见或基线配置文件的见解，进而可以在实时观察新数据时用于隔离异常配置文件。 因此，提出了一种增量异常检测方法。这是一种两阶段方法，其中第一阶段处理可用的历史数据并开发统计数据，第二阶段依次使用这些统计数据来表征新传入数据以进行实时决策。第一阶段采用概率主成分分析器的混合模型，通过概率测量来量化每个历史观察结果。第二阶段是基于卡方的异常检测方法，该方法利用第一阶段中获得的概率测量来确定输入数据是否异常。所提出的异常检测方法在模拟和基准数据集上表现令人满意。该方法还以检测可能带来安全风险的商用卡车为背景进行了说明。它能够在所调查的场景中一致地识别出具有异常特征的卡车。
The detection of unusual profiles or anomalous behavioral characteristics from sensor data is especially complicated in security applications where the threat indicators may or may not be known in advance. Predictive modeling of massive volumes of historical data can yield insights on usual or baseline profiles, which in turn can be utilized to isolate unusual profiles when new data are observed in real-time. Thus, an incremental anomaly detection approach is proposed. This is a two-stage approach in which the first stage processes the available historical data and develops statistics that are in turn used by the second stage in characterizing the new incoming data for real-time decisions. The first stage adopts a mixture model of probabilistic principal component analyzers to quantify each historical observation by probabilistic measures. The second stage is a chi-square based anomaly detection approach that utilizes the probabilistic measures obtained in the first stage to determine if the incoming data is an anomaly. The proposed anomaly detection approach performs satisfactorily on simulated and benchmark datasets. The approach is also illustrated in the context of detecting commercial trucks that may pose safety and security risk. It is able to consistently identified trucks with anomalous features in the scenarios investigated.