Anomaly Detection in Wireless Sensor Networks using Self-Organizing Map and Wavelets

Transcription

1 Anomaly Detetion in Wireless Sensor Networks using Self-Organizing Map and Wavelets SUPAKIT SIRIPANADORN 1, WIPAWEE HATTAGAM, NEUNG TEAUMROONG 3 1, Shool of Teleommuniation Engineering, Institute of Engineering 3 Shool of Biotehnology, Institute of Agriulture Suranaree University of Tehnology 111 University Avenue, Muang, Nakhon Rathasima THAILAND 1 arhitet_ton@hotmail.om wusaha@ieee.org 3 neung@sut.a.th Abstrat: - Wireless Sensor Networks (WSNs) have been applied in agriulture monitoring to monitor and ollet various physial attributes within a speifi area. It is important to detet data anomalies to determine a suitable ourse of ation. The underlying aim of this paper is therefore to propose an anomaly detetion sheme whih is able to detet anomalies aurately by means of exploiting both time and frequeny harateristis of the data signals. The ontribution of this paper enters on anomaly detetion by using Disrete Wavelet Transform () ombined with a ompetitive learning neural network alled self-organizing map (SOM) in order to aurately detet abnormal data readings. Experiment results from syntheti and real data olleted from a WSN show that the proposed algorithm outperforms the SOM algorithm by up to 18% and algorithm by up to 35% in presene of bursty faults with marginal inrease of false alarm rate. Key-Words: - Anomaly Detetion, Wavelets, Disrete Wavelet Transform, Self-Organizing Map, Wireless Sensor Networks, Agriulture Monitoring 1 Introdution Wireless sensor networks (WSNs) have been reently deployed in many areas of agriulture to inrease yield and prevent outbreaks suh as in hydroponis and paddy fields, fertilizer omposting proess, and livestok monitoring. However, these appliations rely mainly on manually measuring and ontrolling the parameters suh as moisture, temperature, ph, oxygen, soil nutrients, et., whih is both time onsuming and laborious. Autonomous monitoring devies suh as WSNs therefore warrant potential use in agriulture monitoring. A WSN is a wireless network that onsists of distributed autonomous devies using sensors to ooperatively monitor or ollet environmental onditions at different loations. Several measurements an be olleted from the WSN. The olleted measurements from the WSN may be affeted by anomalies in the sensor network suh as faulty sensors, faulty ommuniation between sensors or atual abnormal physial measurements. With the huge amount of data ontinually olleted from the WSN, it beomes inreasingly diffiult to detet anomalies in the data measurements. Therefore, anomaly detetion tehniques are neessary to automatially detet faults and alert the system ontroller to take suitable ation. Researh emphasizing on anomaly detetion in ommuniation networks has progressed in reent years, e.g. in IP networks [1], in ellular mobile networks []. There are also works on fault and anomaly detetion in wireless sensor networks (WSNs). Ref.[3] lassified anomalies in WSNs into groups, i.e. 1) intrusion or seurity attaks, and ) faults from unusual hanges in a monitored environment. This paper fouses on the latter sine suh anomaly detetion is more ritial to agriultural use. To detet the latter type of anomalies, a dynami model of WSNs based on reurrent neural networks (RNNs) was presented in [4], whereas a distributed kernel density estimator was proposed in [5] to approximate the density distribution of the data. Another mehanism ommonly used for anomaly detetion is a ompetitive learning method alled selforganizing map (SOM) [6], [7]. SOM has several benefiial features whih make it a useful tool in data mining. It follows the probability density funtion of the data and is, thus, an effiient lustering and quantization algorithm. The most important feature of the SOM is the visualization property. However, SOM has some weaknesses where it extrats relevant features of the data only in the time domain. In many senarios, features of the data extrated from both time and frequeny domain an be used to further enhane anomaly detetion [8]. This an be ahieved by the Disrete Wavelet Transform (). Wavelets have been extensively employed for anomaly ISSN: ISBN:

2 and fault detetion in many appliations [9]. has also been integrated with SOM to detet faults [10], [11]. In partiular, feature vetors of the faults have been onstruted using, sliding window and a statistial analysis. Classifiation of the feature vetors was obtained by using SOM. To the best of our knowledge, and SOM have not yet been applied to anomaly detetion in WSNs. Therefore, the underlying aim of this paper is to propose an anomaly detetion algorithm whih determines the wavelet transform, and detets the abnormality of the sensor readings by training the SOM using the wavelet oeffiients. Anomaly Detetion The first step of anomaly detetion involves seleting the data parameters to be monitored and grouping them together in a pattern vetor x R, = 1, K, N, x 1 KPI 1 x KPI, (1) x = = M M x n KPI n where is the observation index, n is the number of parameter types or key performane indies (KPIs) hosen to monitor the environmental ondition..1 Self-Organizing Map Competitive neural models suh as the self-organizing map (SOM) [6], are able to extrat statistial regularities from the input data vetors and enode them in the weights without supervision. It maps a high-dimensional data manifold onto a low-dimensional, usually twodimensional, grid or display. The basi SOM onsists of a regular grid of map units or neurons as shown in Fig 1(a). Eah neuron, denoted by i (depited by the blak dot), has a set of layered neighboring neurons (depited by the white dots) as shown in Fig 1(a). Neuron i maintains a weight vetor m i. In order to follow the properties of the input data, suh vetor is updated during the training proess. For example, Fig.1(b) shows a SOM represented by a -dimensional grid of 4 4 neurons. The dimension of eah vetor is equal to the dimension of the input data. In the figure, a vetor of input data (marked by x) is used to train the SOM weight vetors (the blak dots). The winning neuron (marked by BMU) as well as its 1-neighborhood neurons, adust their orresponding vetors to the values (marked by the gray dots). The SOM is trained iteratively. In eah training step, one sample vetor x from the input data set is hosen. (a) (b) Fig. 1 An illustration of the SOM (a) with retangular lattie neighbors belonging to the innermost neuron (blak dot) orresponding to 1, and 3- neighborhoods, (b) SOM updates the BMU with 1-neighborhood. The distanes between the sample data and all of weight vetors in the SOM are alulated using some distane measure. Suppose that at iteration t, neuron i whose m t is the losest to the input vetor weight vetor i ( ) x ( t). We denote suh weight vetor by ( t) m and refer to it as the Best-Mathing Unit (BMU), that is x ( t ) m ( t ) = arg min x ( t ) m ( t ) () i where is the Eulidian distane. Suppose neuron i is to be updated, the SOM updating rule for the weight vetor of neuron i is given by mi( t+ 1) = mi( t) + ηth( i, t)[ x( t) m i( t)] (3) where t is the iteration index, x(t) is an input vetor, η t is the learning rate, h ( i, t) is the neighborhood funtion of the algorithm. The Gaussian neighborhood funtion may be used, that is r ( t ) ri ( t ) h ( i, t ) = exp (4) σ ( t ) where r i (t) and r (t) are the positions of neurons i and the BMU respetively, and σ (t) is the radius of the neighborhood funtion at time t. Note that ( i, t) defines the width of the neighborhood. It is neessary that lim h ( i, t) = 0 and limη = 0 for the algorithm to t onverge [6]. t. Disrete Wavelet Transform is a mathematial transform that separates the data signal into fine-sale information known as detail oeffiients, and rough-sale information known as approximate oeffiients. Its maor advantage is the multi-resolution representation and time-frequeny loalization property for signals. Usually, the sketh of the original time series an be reovered using only the low-pass-ut off deomposition oeffiients; the details an be modeled from the middle-level deomposition t i h ISSN: ISBN:

3 oeffiients; the rest is usually regarded as noises or irregularities. The following equations desribe the omputation of the deomposition proess: a + ( k) = h ( n k) a ( k) (5) 1 0 n d + ( k) = g ( n k) a ( k), (6) 1 0 n where the rough-sale (or approximation) oeffiients a are onvolved separately with h 0 and g 0, the wavelet funtion and saling funtion, respetively, n is the time saling index, k is the frequeny translation index for wavelet level. The resulting oeffiient is down-sampled by. This proess splits a roughly in half, partitioning it into a set of fine-sale (or detail) oeffiients d + 1 and a oarser set of approximation oeffiients a + 1 [1]. has the apability to enode the finer resolution of the original time series with its hierarhial oeffiients. Furthermore, an be omputed effiiently in linear time, whih is important while dealing with large datasets..3 Integration of SOM and In the integration of SOM and algorithm, the algorithm is used as an input data preproessor of the SOM algorithm in order to redue the size of data without losing any signifiant feature of the data. This enables the implementation of in-network proessing whih helps to redue the radio ommuniation energy and eventually prolong the lifetime of the WSN [3]. The input data will be padded with zero if its length is odd data. After obtaining the wavelet oeffiients, these oeffiients will be fed to the SOM algorithm whih an be divided into sets. Eah set ontains both approximate and detail oeffiients. The first set whih is obtained from noiseless data, will be used to train the SOM algorithm. The seond set whih is obtained from the faulty data will be used to test the SOM algorithm. Then to redue the false alarms the deteted results will be double heked by using the univariate method [6], [7]..4 Anomaly Detetion A observation data set an be onsidered abnormal if the distane between the weight vetor of the winning neuron and the state vetor, given by Input data N 0 Selet Mother Wavelet Apply Disrete Wavelet Transform Approximate Coeffiient Fig. The integration of the SOM and algorithm diagram. e = x m (7) is greater than a ertain perentage p = 1 α of the distanes in the distane distribution profile. That is, + IF e e, e, THEN p Detail Coeffiient Apply Self-Organizing Map Double heking with Univariate method Deision p x is NORMAL Padded ELSE x is ABNORMAL. (8) Equation (8) is referred to as the global deision. In [6], an addition of loal deisions of eah KPIs is presented. Suppose that a data vetor x is onsidered abnormal by the global deision. Then in the loal anomaly detetion, the absolute value of error in eah omponent of the error vetor is then omputed by x 1 m,1 x m,. (9) E = M x n m, n The error in eah KPI is then ompared to the interval of normality omponent-by-omponent, and the anomaly deision is arried out as in (8). ISSN: ISBN:

4 3 Experiment Results In this setion, we evaluated the performane of the proposed integration of SOM and algorithm by deteting anomalies in series of syntheti data and atual data olleted from a wireless sensor network. In the experiment, we generated the syntheti input data from a normal distribution N(0,1) and syntheti faults by additive white Gaussian noise (AWGN) with power 5 dbw generated from MATLAB. We used suh fault beause its statistial similarity to the syntheti input data thus, it is more diffiult to be deteted. Therefore, we an evaluate the performane of the algorithms under ambiguous faults. The amount of faults an be represented by the notation n/s, where n is the amount of faults per series and s is the amount of series of faults, resulting in the total amount of n s faults. The generated faults added to the input data ranged from bursty (0/10) to sparse (1/10). The exat positions of the faults inurred in the input data were predetermined and was later used to detet true and false alarms. In the experiment using real data, we have hosen parameters, namely temperature and moisture, as KPIs olleted from samples of ompost in a bioorgani fertilizer plant. In this paper, the data of the KPIs at the WSNs were olleted every 5 minutes for 3 days. We ompared 3 anomaly detetion methods: 1. SOM algorithm. algorithm 3. Integration of SOM and algorithm We measured performane metris: 1) the true alarm rate whih is defined by the number of deteted true anomalies over the total number of true anomalies in the data set; and ) the false alarm rate whih is defined by the number of deteted false alarms over the total number of deteted anomalies. In the algorithm, we used the threshold in (11) in order to deide whether the data is normal or abnormal. σ w = median( d1 d1) (10) T = σ log ( N), (11) w w e where N is the size of data and d 1 is the sample mean of the level 1 detail oeffiients [1]. This threshold was alulated from the low pass and high pass oeffiients from the assumed normal data by using Haar and Daubehies4 mother wavelets. The Haar and Daubehies4 wavelets were used beause they are relatively easy to ross-hek by hand with omputed oeffiients from MATLAB program. Hene, we an ompare the position of eah oeffiient with the atual fault position. After the threshold alulation, the set of oeffiients whih are obtained from the of the noisy data will be ompared with the threshold, oeffiient by oeffiient. For the real data senario, the data was normalized by equation (1) before being proessed by the to eliminate potential outliers. (Data) - mean(data) Norm(Data) = variane(data) (1) If the absolute value of the oeffiient is greater than the omputed threshold, an anomaly is said to be deteted. In the SOM algorithm and the proposed integration of SOM and algorithm, the initial value for learning rate in the SOM part was set to η 0 = 0.9, and gradually redued to η T = 10-5, in order to guarantee onvergene [6]. The number of training epohs was set to 50 beause longer training epohs tend to over train the SOM [6]. The onfidene interval was set to 99% (K=.57). We used a Gaussian neighborhood funtion beause the distribution of the olleted data after the normalization fits well to the Gaussian distribution. The size of neurons was used. Figures 3 and 4 show that the anomaly detetion in SOM algorithm and the integrated SOM and algorithms improve as the number of neurons is inreased. This suggests that the more neurons used, the finer SOM s lassifiation beomes resulting in enhaned detetion performane. However, at neuron size 50 50, the SOM requires muh longer training time with a marginal improvement in the detetion performane. Therefore, The size of neurons was seleted to train and test the SOM. We also improved the SOM algorithm by double heking with the univariate method in order to redue the false alarm rate [6], [7]. To obtain aurate results, eah algorithm was repeated for 70 runs whih gave the best auray as shown in Table 1. Table 1. Auray results obtained by feeding syntheti input data to the neuron SOM algorithm. Runs True Alarm rate Deviation from previous iteration ISSN: ISBN:

5 Fig. 3 True alarm rates with different size of neurons in the sparse faults ase. Fig. 4 True alarm rates with different size of neurons in the bursty faults ase. Fig. 5 True alarm rates with syntheti data. Fig. 6 True alarm rates with real data. Fig. 7 False alarm rates with syntheti data. Fig. 8 False alarm rates with real data. Fig. 9 True alarm rate with 10 dbw AWGN faults. Fig. 10 False alarm rate with 10 dbw AWGN faults. ISSN: ISBN:

6 To evaluate the performane of all algorithms, the results of eah algorithm were ompared to the (known) fault positions whih were added into the input data. In partiular, when an anomaly was deteted then its position was ompared with the (known) fault position. If this position existed, then the anomaly deteted was a true alarm; otherwise, it was a miss. On the other hand, if an anomaly was deteted but the (known) fault position did not exist, then the anomaly was a false alarm. Fig. 5 and Fig. 6 show the perentage of true alarm rate averaged over 70 runs, as the funtion of the amount of faults added into the input data. Note that the proposed integrated SOM and algorithm whih used Haar as a mother wavelet gives the best performane over other algorithms. This is beause the with Haar wavelet an detet hanging points. In partiular, the Haar wavelet uses adaent input data to ompute a oeffiient whereas the Daubehies4 uses 4 adaent input data to ompute a oeffiient. However, Daubehies4 gave a lower performane than Haar beause eah oeffiient was omputed from an average over 4 input data. If a fault ourred in 1 of these 4 data, suh fault will be averaged with the remaining 3 normal data resulting in a oeffiient with an absolute value possibly lower than the deision threshold. Consequently, the true alarm rate is redued. On the other hand, the Haar wavelet only uses adaent data to ompute 1 oeffiient. Thus, the true alarm rate is signifiantly higher than that of Daubehies4. The integrated SOM and algorithm using Haar also outperforms the SOM algorithm. This is beause in the Haar ase, the oeffiients obtained were transformed from two adaent data. Therefore, if some data was faulty or differed greatly from the data nearby, this oeffiient an detet suh anomaly. On the other hand, the SOM algorithm diretly heked the data one by one to detet an anomaly. If the data was faulty but had a small magnitude, then this fault may not be deteted, and onsequently the true alarm rate was redued. Note that the algorithm has the lowest performane beause the deision threshold in (11) is rather onservative. Furthermore, the threshold is fixed throughout the detetion and the algorithm does not have any double heking method. Fig.7 and Fig. 8 show the false alarm rate results in the syntheti and real data experiments, respetively. Note that most results have low false alarm rates, i.e., less than 1 % exept in the ase of sparse faults due to the inreased detetion diffiulty. The integration of SOM and Daubehies4 also gave a weak performane due to the reasons previously explained. All these results show that the integration of SOM and with Haar as a mother wavelet outperforms the SOM algorithm and method. Fig.5 and 6 show that the proposed algorithm an ahieve up to 65% and 67% of true alarm rates in ase of bursty faults for syntheti and real data, respetively. The proposed algorithm ahieved a true alarm rate of up to 18% higher than the SOM algorithm alone in presene of bursty faults. Compared to the alone, the proposed algorithm an attain a true alarm rate of up to 35% more in the bursty faults ase. As for sparse faults, the proposed algorithm an ahieve up to 69% and 80% true alarm rates for syntheti and real data, respetively. The integrated SOM and also gave true alarm rates of up to 10% higher than the SOM algorithm alone whereas performed the weakest, in presene of sparse faults. Fig. 7 and 8 show that the false alarm rate of the proposed algorithm is 0.11% and 0.13% in presene of bursty faults and 0.91% and 1% in presene of sparse faults with syntheti and real data, respetively. Note that the false alarm rate of the propose algorithm is slightly higher than the other two algorithms. Sine the gain in the true alarm rate is more signifiant, suh tradeoff is therefore onsidered aeptable. to redue transmitted data: The proposed integration of SOM and algorithm with Haar wavelet outperformed the SOM algorithm and the algorithm alone. Our results suggest that the proposed integrated SOM and anomaly detetion sheme an be deployed in a resoure-onstrained network suh as a WSN. In partiular, the using Haar wavelet an be implemented at the sensor nodes as a data preproessor to redue the amount of data to be transmitted by at least half (for one-level ). Sine energy onsumption is ritial in WSNs, suh distributed in-network proessing an redue transmission energy and eventually help prolong the overall network lifetime of the WSN [3] while still maintaining aeptable anomaly detetion auray. Fig. 9 and Fig. 10 show the effet of the dereasing of AWGN noise power from 5dBW to 10 dbw in both syntheti and real data senarios. Though the anomaly detetion is more diffiult, the proposed integrated SOM and still onsistently outperforms the other two methods in terms of true alarm rate but with marginal inrease in the false alarm rate as tradeoff. 4 Conlusion This paper proposed an integration of a ompetitive learning method alled the self-organizing map (SOM) and the disrete wavelet transform (), to detet anomalies in syntheti and atual data olleted from a WSN. ISSN: ISBN:

7 The results show that the integration of SOM and with Haar as a mother wavelet an attain 65% and 67% of true alarm rates in the ase of bursty faults, and 69% and 80% of true alarm rates in ase of sparse faults for syntheti and real data, respetively. In terms of the true alarm rate, the proposed algorithm outperforms the SOM algorithm by up to 18% and algorithm by up to 35% in presene of bursty faults. With sparse faults, the proposed algorithm an gain a true alarm rate up to 10% above the SOM algorithm alone and entirely outperforms the algorithm alone. Suh gain in true alarm rates ome with a marginal inrease of false alarm rate. These results show that the proposed algorithm an maintain aeptable anomaly detetion auray while using ust half of the input data (using level 1 ). Our results suggest that the integration of SOM and with Haar wavelet an lead to a more effetive anomaly detetion whih redues human operator s troubleshooting efforts. In the future, we plan to extend our work to investigate anomaly detetion with atual faults obtained from the bioorgani fertilizer plant environment, and study its performane by inreasing the level and onsidering other different types of wavelets. Furthermore, we also plan to investigate ways to identify and eliminate erroneous sensor readings at the sensor nodes, whih ould help redue wasted energy from transmitting unwanted erroneous measurements to the base station. 5 Aknowledgment The authors would like to thank Asso. Prof. Dr. Boon Hee Soong and Mr. Edwin Chan of Intelligent Systems Laboratory, Nanyang Tehnologial University, Singapore for their assistane and suggestions on the sensor development and implementation. Trans. on Instrumentation and Measurement, Vol. 57, No. 5, 008, pp [5] S. Subramaniam et al., Online outlier detetion in sensor data using nonparametri model, Proeeding of VLDB, 006, pp [6] G.A. Barreto, J.C.M. Mota, L.G.M. Souza, R.A. Frota, and L. Aguayo, Condition monitoring of 3G ellular network through, IEEE Trans. Neural Networks, Vol. 16, No. 5, 006, pp [7] P. Sukkhawathani and W. Usaha., Performane Evaluation of Anomaly Detetion in Cellular Core Networks using Self-Organizing Map, Proeeding of ECTI-CON 008, Vol.1, 008, pp [8] V.A. Aquino and J.A. Barria, Anomaly detetion in ommuniation Networks using wavelets, IEEE Pro.-Commun, Vol.148, No.6, 001, pp [9] N. Yadaiah, and Nagireddy Ravi, Fault detetion tehniques for power transformers, Industrial & Commerial Power Systems Tehnial Conferene, 007, pp [10] Z. Xu and Q. Zhao, A novel approah to fault detetion and isolation based on wavelet analysis and neural network, Eletrial and Computer Engineering, Vol. 1, 00, pp [11] S. Postalıoglu, K. Erkan, and E.D. Bolat, Implementation of Intelligent Ative Fault Tolerant Control System, Springer-Verlag Berlin Heidelberg 007, pp [1] R. J. Bryhta, et al, Wavelet Methods for Spike Detetion in Mouse Renal Synpatheti Nerve Ativity, IEEE Transations on Biomedial Engineering, Vol.54, No.1, 007, pp Referenes: [1] M. Thottan and J. Chuanyi, Anomaly detetion in IP network, IEEE Trans. on signal proessing, Vol.51, No.8, 003. [] J. Laiho, K. Raivio, P. Lehtimaki, K. Hatonen, and O. Simula, Advaned Analysis Methods for 3G Cellular Networks, IEEE Trans. Neural Networks, Vol.4, No.3, 005, pp [3] S. Raasegarar, C. Lekie, M. Palaniswami, Anomaly Detetion in Wireless Sensor Networks, IEEE Wireless Communiations, Vol.15, No.4, 008, pp [4] A.I. Moustapha, and R.R. Selmi, Wireless sensor network modeling using modified reurrent neural networks: Appliation to fault detetion, IEEE ISSN: ISBN: