Multi-Scale Analysis of Long Range Dependent Traffic for Anomaly Detection in Wireless Sensor Networks

Transcription

1 20 50th IEEE Conference on Decision and Contro and European Contro Conference (CDC-ECC) Orando FL USA December Muti-Scae Anaysis of Long Range Dependent Traffic for Anomay Detection in Wireess Sensor Networs Shanshan Zheng and John S. Baras Abstract Anomay detection is important for the correct functioning of wireess sensor networs. Recent studies have shown that node mobiity aong with spatia correation of the monitored phenomenon in sensor networs can ead to observation data that have ong range dependency which coud significanty increase the difficuty of anomay detection. In this paper we deveop an anomay detection scheme based on mutiscae anaysis of the ong range dependent traffic to address this chaenge. In this proposed detection scheme discrete waveet transform is used to approximatey de-correate the traffic data and capture data characteristics in different time scaes. The remaining dependencies are then captured by a muti-eve hidden Marov mode in the waveet domain. To estimate the mode parameters we propose an onine discounting Expectation Maximization (EM) agorithm which aso tracs variations of the estimated modes over time. Networ anomaies are detected as abrupt changes in the traced mode variation scores. We evauate our detection scheme numericay using typica ong range dependent time series. I. INTRODUCTION A wireess sensor networ consists of a set of spatiay scattered sensors that can be used to monitor and protect critica infrastructure assets such as power grids automated rairoad contro water and gas distribution etc. However due to the unattended operating environment of sensor networs it coud be easy for attacers to compromise sensors and conduct maicious behaviors. Anomay detection is thus critica to ensure the effective functioning of sensor networs. An anomay detection procedure usuay consists of two steps: first coect networ measurements and mode the norma traffic as a reference; second appy a decision rue to detect whether current networ traffic deviates from the reference.traditiona anomay detection methods usuay assume that the networ measurements are either independent or short range dependent. However recent studies have shown that node mobiity aong with spatia correation of the monitored phenomenon in sensor networs can ead to Long Range Dependent (LRD) traffic [] which coud ead to high fase aarms using traditiona methods. In this paper we deveop an anomay detection scheme based on muti-scae anaysis of the ong range dependent traffic. Discrete Waveet Transform (DWT) is used to approximatey de-correate autocorreated stochastic processes. Most of the iterature wor on using DWT for anomay detection use the first order or second order statistics (mean or variance) of the waveet coefficients for anomay detection e.g. detect changes in the mean or variance of the waveet coefficients over a moving window [2] [3]. In contrast we buid a probabiistic mode for the waveet coefficients through a muti-eve hidden Marov mode (HMM) in the expect to capture the remaining dependency This wor was supported by the Defense Advanced Research Projects Agency (DARPA) under award number for the Muti-Scae Systems Center (MuSyC) through the FRCP of SRC and DARPA US Air Force Office of Scientific Research MURI award FA and Army Research Office MURI award W9-NF Shanshan Zheng and John S. Baras are with the Institute for Systems Research and the Department of Eectrica and Computer Engineering University of Maryand Coege Par {sszheng baras}@umd.edu among the transformed data thus better mode the networ traffic and improve detection accuracy. We design a forwardbacward decomposition scheme and an onine discounting Expectation Maximization (EM) agorithm to estimate mode parameters. The onine EM agorithm can aso trac the structure changes of the estimated HMMs by evauating a mode variation score using the symmetric reative entropy between the current estimated mode and a previous estimated mode. Networ anomaies are then detected as abrupt changes in the traced mode variation scores. II. RELATED WORK Networ anomay detection is an important probem and has received numerous research efforts. It invoves modeing of the norma traffic as a reference and computing the statistica distance between the anayzed traffic and the reference. The modeing of the norma traffic can be based on various statistica characteristics of the data. For exampe Lahina et a. [4] proposed to use Principa Component Anaysis to identify an orthogona basis aong which the networ measurements exhibit the highest variance. The principa components with high variance mode the norma behavior of a networ whereas the remaining components of sma variance are used to identify and cassify anomaies. Spectra density [5] and covariance [6] have aso been used for modeing norma networ traffic. Besides these methods waveet transform is another popuar technique used for modeing networ traffic especiay for the LRD traffic. Abry et a. [7] proposed a waveetbased too for anayzing LRD time series and a reated semi-parametric estimator for estimating LRD parameters. Barford et a. [2] assume that the ow frequency band signa of a waveet transform represents the norma traffic pattern. They then normaize both medium and high frequency band signas to compute a weighted sum. An aarm is raised if the variance of the combined signa exceeds a pre-seected threshod. The ey feature of these waveet-based methods ies in the fact that waveet transform can turn the ong range dependency among the data sampes into a short memory structure among the waveet coefficients [7]. In our wor we buid a waveet-domain muti-eve hidden Marov mode for the LRD networ traffic. The merit of our method is the mode s mathematica tractabiity and its capabiity of capturing data dependency. To measure the deviation of the anayzed traffic from the reference mode various statistica distances can be used incuding simpe threshod mean quadratic distances [8] and entropy[9]. Entropy is a measure of the uncertainty of a probabiity distribution. It can be used to compare certain quaitative differences of probabiity distributions. In our detection scheme we appy the symmetric reative entropy as a distance measure. The onine EM agorithm can efficienty compute the symmetric reative entropy between the current estimated HMM mode and a previous estimated one. An anomay is then detected as abrupt changes in the symmetric reative entropy measurements //$ IEEE 4060

2 III. LONG RANGE DEPENDENT TRAFFIC IN WIRELESS SENSOR NETWORKS A time series {x(t)} N t is considered to be ong range dependent if its autocorreation function ρ() decays at a rate sower than an exponentia decay. Typicay ρ() asymptoticay behaves as c 2H 2 for 0.5 < H < where c > 0 is a constant and H is the Hurst parameter. The intensity of LRD is expressed as the speed of the decay for the autocorreation function and is measured by the Hurst parameter i.e. as H the dependence among data becomes stronger. It can be shown that ρ(). Intuitivey LRD impies that the process has infinite memory i.e. individuay sma highag correations have an important cumuative effect. This is contrast to the conventiona Short Range Dependent (SRD) process which are characterized by an exponentia decay of the autocorreations resuting in a summabe autocorreation function. LRD is an important property for traffic modeing as it is iey to be responsibe for the decrease in both the networ performance and the quaity of service [8]. A wireess sensor networ operates on the IEEE standard. It has been shown recenty [] that the traffic generated from a singe mobie node in the wireess sensor networ can be represented by an ON/OFF process X(t) where the probabiity density function of the ON period τ a can be approximated by a truncated Pareto distribution [] f τa (x) γ ax (γa+) t γa min t γa max with t min (t max ) denoting the minimum (maximum) ON time and γ a denoting the tai index. The vaue of γ a depends on the variabiity of node mobiity pattern and the spatia correation of the monitored phenomena by the networ. Using this traffic mode for wireess sensor networs we anayze the dynamic behaviors of networ traffic measurements such as the pacet round trip time the number of received pacets per second etc. by conducting experiments using Networ simuator 2 (NS-2). It is found that the LRD property do exit in the simuated data traces with typica Hurst parameters between 0.8 and 0.9. Incorporating LRD precisey in the design of anomay detection schemes for wireess sensor networs is critica. IV. WAVELET DOMAIN HIDDEN MARKOV MODEL FOR LONG RANGE DEPENDENT TRAFFIC Waveet transforms have been popuar for anayzing autocorreated measurements due to their capabiity to compress muti-scae features and approximatey de-correate the autocorreated stochastic processes. We buid a Hidden Marov Mode (HMM) for the waveet transform coefficients of the networ traffic. The basic idea for transform domain mode is that a inear invertibe transform can often restructure an signa generating transform coefficients whose structure is simper to mode. A. Waveet domain hidden Marov mode In waveet transform the measurements x(t) t... N are decomposed into mutipe scaes by a weighted sum of a certain orthonorma basis functions N L x(t) a L φ L (t) + d m ψ m (t) m where φ j ψ j are the orthonorma basis a L d m are the approximation and detai coefficients. The approximation coefficients a L provide the genera shape of the signa whie the detai coefficients d m from different scaes provide different eves of detais for the signa content with d providing the finest detais and d L providing the coarsest detais. In our wor we appy the Discrete Waveet Transform (DWT) to the networ traffic. A discrete waveet transform is a waveet transform for which the basis functions are discretey samped. DWT can be expained using a pair of quadrature mirror fiters which incudes a high pass fiter h[n] and a ow pass fiter g[n]. Efficient methods have been deveoped for decomposing a signa using a famiy of waveet basis functions based on convoution with the corresponding quadrature mirror fiters. A 2-eve discrete waveet transform using the corresponding quadrature mirror fiters is iustrated in Fig.. Fig. : 2-eve discrete waveet transform However the waveet transform cannot competey decorreate rea-word signas i.e. a residua dependency structure aways remains among the waveet coefficients. We use a hidden Marov mode to capture the remaining dependency. It is based on two properties of the waveet transform observed in iterature [0] []: first is the Custering property which means that if a particuar waveet coefficient is arge/sma the adjacent coefficients are very iey to aso be arge/sma; second is the Persistence property which means that arge/sma vaues of waveet coefficients tend to propagate across scaes. For a signa x(t) that is decomposed into L scaes with waveet coefficients d j... n j and j... L we assume that each waveet coefficient is associated with a hidden state s j. We then use a hidden Marov mode to characterize the waveet coefficients through the factorization P ({d i s i } n i... {d Li s Li } n L i ) p(s L ) L n i i j2 n L j2 p(s Lj s Lj ) L i p(s ij s ij s i+ j/2 ) p(s i s i+ ) L n i p(d ij s ij ). () i j This factorization invoves three main conditiona independence assumptions: first conditioned on the states at the previous coarser scae i + the states at the scae i form a first order Marov chain; second conditioned on the corresponding state at the previous coarser scae i + i.e. s i+ j/2 and the previous state at the same scae i.e. s ij the state s ij is independent of a states in coarser scaes; third the waveet coefficients are independent of everything ese given their hidden states. The three independence assumptions are critica for deriving the inference agorithms for this waveet domain HMM. Fig. 2 iustrate a hidden Marov mode for a 3-eve waveet decomposition. B. Estimating mode parameters using an Expectation- Maximization (EM) agorithm Denote the set of the waveet coefficients and their hidden states by D {{d Li } n L i... {d i} n i } and S {{s Li } n L i... {s i} n i } respectivey where n i is the number of waveet coefficients in the i th scae. The parameters of the HMM incude the foowing three probabiities: first is the initia probabiity for the state s L i.e. π 406

3 O(N K L+ ) where L is the waveet decomposition eve and much smaer than N. Fig. 2: HMM for 3-eve waveet decomposition P (s L ); second is the two types of state transition probabiities i.e. π i 2 P (s i s i+ 2 ) for i < L π i 2 3 P (s ij s ij 2 s i+ j/2 3 ); and third is the conditiona probabiity of the waveet coefficients given their hidden states at the i th scae i.e. P (d ij s ij ) which can be modeed by a mixture Gaussian distribution. For simpicity and presentation cearity we use a singe Gaussian distribution to catpure P (d ij s ij ) i.e P (d ij s ij ) N (µ i σi ) where µi and σi are the mean and the standard deviation for the state in the i th scae. The extension to mixture Gaussian distribution is straightforward. These mode parameters denoted by θ {π π i 2 π i 2 3 µ i σi } can be estimated from the rea data using the maximum ieihood criterion. Due to the intractabiity of direct maximization of the ieihood function we appy an Expectation Maximization (EM) agorithm to estimate the parameters. The EM agorithm provides an maximum ieihood estimation of mode parameters by iterativey appying an E-step and a M-step. In the E-step the expected vaue of the og ieihood function Q(θ θ (t) ) E S Dθ (t)[og P θ (S D)] is computed. Then in the M-step the parameter that maximizes Q(θ θ (t) ) is computed i.e. θ (t+) arg max θ Q(θ θ (t) ). To impement the two steps we define the foowing posterior probabiities γ ij P (s ij D) γ i 2 P (s i s i+ 2 D) for i < L γ ij 2 3 P (s ij s ij 2 s i j/2 3 D). According to equation () maximizing Q(θ θ (t) ) using Lagrange method eads to the foowing estimation of θ π γ L π i 2 γi 2 K γi ni µ i j γij d ij ni j γij ni π i 2 3 ni 2 K (σ i ) 2 ni j γij j2 γij 2 3 j2 γij 2 3 (d ij µ i )2 ni j γij where K represents the domain of the hidden states. The computation of the posterior probabiities is a itte more invoved. Using a brute force computation by direct marginaization wi tae O(N K N ) operations where N is the ength of the input signa. However by expoiting the sparse factorization in equation () and manipuating the distributive property of + and we are abe to design an forward-bacward decomposition agorithm to compute these posterior probabiities with computationa compexity C. Forward-bacward decomposition Our agorithm extends the cassica forward-bacward decomposition agorithm for a one-eve hidden Marov mode to our muti-eve case. The ey point is to ony maintain L appropriate hidden states in both the forward and bacward variabes for computationa efficiency. ) Forward decomposition: Let S ij {s L 2 i L j... s i+ 2 j s ij s i 2(j )... s 2 i (j )} and D ij {d L 2 i L j... d i+ 2 j d i j d i 2(j )... d 2 i (j )} we define the forward variabe to be α ij P (S ij D ij ). Denote [α 2 h j] f(h α hj ) for h j Z + to be a dynamic programming agorithm with input parameters (h α hj ) and output parameter α 2 h j. The pseudo-code for computing the forward variabes using dynamic programming is shown in Tabe I. Its correctness can be proved using the three conditiona independence assumptions in our HMM. For simpicity and presentation carity in Tabe I we assume that the input data ength N is an order of 2 and denote the conditiona probabiity P (d ij s ij ) by g (d ij ) and P (s ij s ij s i+ j/2 ) by g 2 (s ij ). TABLE I: Computing forward variabes Initiaization: α L P (s L d L ) For L to 2 L N α 2 L L f(l α LL ) α LL + g (d LL +) s LL [g 2 (s LL +) α 2 L L ] end function [α 2 j] f(h α h hj ) If h 2 α 2j g (d 2j ) s 2j 2 [g 2 (s 2j ) α 2j ] α 2j g (d 2j s 2j ) s 2j [g 2 (s 2j ) α 2j ] ese α h 2j g (d h 2j ) [g 2 (s h 2j ) α hj ] s h 2j 2 α 2 h 2 (2j ) f(h α h 2j ) α h 2j g (d h 2j ) [g 2 (s h 2j ) α 2 h 2 (2j )] s h 2j α 2 h 2 (2j) f(h α h 2j ) End There is one impementation issue for the agorithm in Tabe I namey the numerica under- or over-fow of α ij as P (S ij D ij ) becomes smaer and smaer with the increasing number of observations. Therefore it is necessary to scae the forward variabes by positive rea numbers to eep the numeric vaues within reasonabe bounds. One soution is to use a scaed version ᾱ ij αij c ij where c ij S ij α ij. In this way ᾱ ij represents the probabiity P (S ij D ij ) and c ij represents the probabiity P (d ij D ij \d ij ). It is straightforward to prove that both c ij and ᾱ ij do not depend on the number of observations. The agorithm for computing (ᾱ ij c ij ) can be obtained by adding a normaization step after each update of α ij for the agorithm in Tabe I. 4062

4 2) Bacward decomposition: Let D c ij D D ij we define the bacward variabe to be β ij P (D c ij S ij) which can be computed using a simiar dynamic programming agorithm as the one in Tabe I. To avoid the numerica underor over-fow probem instead of computing β ij we compute a scaed version β ij as is shown in Tabe II. The scaed bacward variabe represents the probabiity P (Dc ij Sij) P (D c ij Dij). The correctness of the agorithm in Tabe II can be verified using the three conditiona independence assumptions in our HMM. Due to space imit we omit the proof here. TABLE II: Computing scaed bacward variabes Initiaization: β N/2 For L 2 L N to β LL f(l β 2 L L ) end β 2 L ( L ) s LL g (d LL )g 2(s LL ) β LL c LL function [ β hj ] f(h β 2 h j) If h 2 β 2j s 2j g (d 2j)g 2(s 2j) β 2j c 2j g (d 2j )g 2(s 2j ) β 2j c 2j β 2j s 2j ese β h 2j f(h β 2 h 2 2j) β 2 h 2 (2j ) s h 2j β h 2j f(h β 2 h 2 (2j )) End β hj s h 2j g (d h 2j )g 2(s h 2j ) β h 2j c h 2j g (d h 2j )g 2(s h 2j ) β h 2j c h 2j 3) Computing posterior probabiities: Since ᾱ ij P (S ij D ij ) and β ij P (Dc ij Sij) P (D c ij Dij) we have ᾱ ij β ij P (S ij D) according to the Marovian property of our HMM. Then the posterior probabiity γ( ) can be computed as γ ij ᾱ ij β ij γ i 2 ᾱ i β i γ Lj 2 ᾱ 2 L (j ) β Lj g(d Lj )g 2 (s Lj ) c Lj { β γ ij ᾱ2 i (j ) ij g(dij) g2(sij) c 2 3 ij if j is even ᾱi+ j/2 βij g(dij) g2(sij) c ij if j is odd. Without confusion we omit the variabes under for the above equations. The correctness of these equations can be derived according to the three conditiona independence assumptions in our HMM. V. ANOMALY DETECTION BY TRACKING HMM MODEL VARIATIONS A first thought on the anomay detection probem is to treat the anomaies as abrupt changes in the HMM modeed data and then appy change-point detection methods to detect these abrupt changes. However it is found that directy appying change-point detection methods to the HMM modeed data is computationay expensive. We designed here a ightweight anomay detection scheme based on detecting the structure changes of the estimated HMM. An important requirement for anomay detection is to mae the decision maing process onine. Therefore we first deveop an onine EM agorithm for HMM mode estimation. A. An onine discounting EM agorithm Before we present the onine EM agorithm we first introduce the so caed imiting EM agorithm [2]. Let x denote the hidden states and y denote the observations. If the joint probabiity distribution p θ (x y) beongs to an exponentia famiy such that p θ (x y) h(x y) exp( φ(θ) ss(x y) A(θ)) where denotes the scaar product ss(x y) is the sufficient statistics and A(θ) is some og-partition function. If the equation θ φ(θ) ss θ A(θ) 0 has a unique soution denoted by θ θ(ss) then the imiting EM agorithm obeys the simpe recursion ss + E θ [E θ(ss )[ss(x y) y]] where θ represents the true mode parameter. Since E θ [E θ [ss(x y) y]] may be estimated consistenty from the observations by n n t E θ[ss(x t y t ) y t ] an onine EM agorithm can be obtained by using the conventiona stochastic approximation procedure ŝs + γ + E θ(ŝs )[ss(x + y + ) y + ]+( γ + )ŝs where γ is a time discounting factor. The estimation of mode parameters can then be derived from the sufficient statistics ŝs. It is proved [2] that under suitabe assumptions this onine EM agorithm is an asymptoticay efficient estimator of the mode parameter θ. It is not difficut to see that the joint probabiity distribution P (S D) for our HMM mode satisfies the above mentioned conditions for appying the imiting EM agorithm. For each waveet coefficient d ij we have the foowing sufficient statistics for computing the HMM mode parameters n ij m P (s m S ij D ij ) ˆ n ij m P (s m S ij D ij ) d m n ij m P (s m S ij D ij ) d 2 m 2 3 n ij m2 P (s m s m 2 s + m/2 3 S ij D ij ) where {... L} is the scae index K is the hidden state index and n ij represents the number of observed waveet coefficients in scae after d ij arrives i.e. { n ij 2 i j if i 2 i j if < i. It is straightforward to prove that the HMM mode parameters {π 2 3 µ σ } can be updated using { ij ij ˆτ τ 2 3 } as foows π 2 3 µ (σ ) 2 S ij 2 3 S ij S ij ˆ S ij S ij S ij 2 3 (2) (3) ( S ij ˆ S ij ) 2. (4) Note that the HMM parameter π and π i 2 can be updated using the sufficient statistics L P (s L S ij D ij ) and P (s s + 2 S ij D ij ). But we omit 4063

5 the reated discussions here as the computations are simiar. The next step is to design recursive (onine) updates of the sufficient statistics ij ij ij ˆτ τ and τ 2 3. According to the Marovian property of our HMM the onine updates of the sufficient statistics can be achieved by foowing a simiar dynamic programming procedure as the one for computing the scaed forward variabes ᾱ ij. Reca that ᾱ ij is computed by adding a normaization step after α ij is computed in the agorithm in Tabe I. The sufficient statistics are updated once ᾱ ij is updated. For iustration purpose we ony show here how to update the sufficient statistics when α h2j in Tabe I is computed. Updates for the other cases are simiar. For {... L} et γ h 2j be a time discounting factor and δh be the Dirac Deta function such that { δh if h 0 if h. Define rh 2j δ h γ h 2j ᾱ h 2j t h 2j ( δ h γ h 2j )g (d h 2j )/c hj q h 2j δ h γ h 2j g(d h 2j )g 2(s h 2j )ᾱ hj c h 2j. We then have the foowing equations for updating the sufficient statistics τ h 2j ˆτ h 2j τ h 2j τ h 2j 2 3 r h 2j + t h 2j s h 2j 2 g 2 (s h 2j )τ hj (5) rh 2j d h 2j + t h 2j g 2 (s h 2j )ˆτ hj (6) s h 2j 2 rh 2j d 2 h 2j + t h 2j g 2 (s h 2j ) τ hj (7) s h 2j 2 qh 2j + t h 2j s h 2j 2 g 2 (s h 2j ) τ hj 2 3.(8) The correctness of these updates can be proved using the three conditiona independence assumptions in our HMM. Due to space imit we omit the proof here. B. Change-point detection on mode variations To measure the structure changes of the estimated HMM modes over time we use the concept of the symmetric reative entropy to define a mode variation score. Denote the mode at time t and t by P t and P t respectivey then the mode variation score is defined to be v t im n n D(P t P t ) + im n n D(P t P t ) where D(p q) represents the reative entropy of distribution p to q and n represents the ength of the input data. It is natura to et n as we can then compare the two modes under the stationary states in the imit of n. It can be proved that im n n D(P t P t ) + i L i 2 i D((πi 2 3 ) t (π i 2 3 ) t ) L 2 i (π) i t D(N ((µ i ) t (σ) i t ) N ((µ i ) t (σ) i t )) where π i P (s ij ). Therefore besides the probabiity distributions π i 2 3 and N (µ i σi ) provided by the onine EM agorithm the computation of im n n D(P t P t ) aso invoves the computation of the probabiity distributions π i 2 3 P (s ij s ij 2 s i+ j/2 3 ) and π i. The estimation of πi and πi 2 3 can be obtained from the sufficient statistics τ m m i and τi 2 3 as foows π i τ m i πi 2 3 τ m i 2 3. S m S m The other reative entropy im n n D(P t P t ) can be computed simiary. We can see that the symmetric mode variation score actuay captures two types of changes. The first is the changes in the transition probabiities of the hidden states whie the second is the changes in the generation pattern of the observed data from a fixed state. By using the symmetric reative entropy as a distance measure between two HMM modes it is expected that not ony the changes of the data generation pattern wi be detected but aso the changes in the hidden states can aso be detected. VI. EVALUATIONS We evauate the performance of our anomay detection agorithm numericay. The agorithm performances are evauated using the detection atency and the Receiver Operating Characteristic (ROC) curve which is a pot of the detection rate versus the fase aarm rate at different threshod vaues. The seection of the waveet basis used in our anomay detection scheme is based on a baance between its time ocaization and frequency ocaization characteristics [2]. In our experiments we found that for the Daubechies famiy waveets the D2 (Haar waveets) and D4 waveets can give us reasonaby good performance. Hence we use the Haar waveets for a the experiments in this paper. In the numerica experiments two we nown LRD time series incuding the Fractiona Gaussian Noise (FGN) and the Autoregressive Fractionay Integrated Moving Average (ARFIMA) mode are used for generating data. We then inject two types of mode variations into the time series as anomaies. First is the mean eve shift i.e. a step function with a constant ampitude wi be imposed on the origina signa. Second is to vary mode parameters for the data generation process incuding the standard deviation and the Hurst parameter for FGN and ARFIMA. The duration for the norma state and the anomay state is generated from exponentia distribution with different mean vaues. We first discuss the detection performance on mean eve shifts in the synthetic LRD time series. Fig. 3 shows one representative exampe. The top figure iustrates the time series which is generated from an ARFIMA mode with Hurst parameter 0.9 and ength 2 5. The standard deviation for the generated data sequence is set to be. The mean eve shift occurs at the first quarter of the time series and ends at the midde with intensity 0.75 which is ess than the standard deviation. The bottom two figures show the corresponding mode variation scores computed by our onine EM agorithm with 5-eve and 4-eve waveet decomposition respectivey. The x axis represents the scaed time due to waveet transform and the y axis represents the mode variation score. From Fig. 3 we can see that the visua inspection of the injected mean eve shift from the time series directy can be difficut. However in the traced mode variation scores there are abrupt changes at the two time ocations where the mean eve shift starts and ends. These two abrupt changes suggest where the injection starts and ends. Especiay when 4064

6 data Time series data with mean eve shift origina time x 0 4 Decomposition eve 5 detection. It is observed that our method can aways beat this baseine method. For exampe Fig. 5 shows the ROC curves and detection atency for our method and the baseine methods on the detection of Hurst parameter changing from 0.9 to 0.7. score score scaed time Decomposition eve scaed time Fig. 3: Effects of different decomposition eves the waveet decomposition eve is 5 these are the ony 2 abrupt changes that exist. When the waveet decomposition eve is 4 there are some fase aarms therefore the decomposition eve of the waveet transform is an important parameter for the anomay detection scheme. A higher eve decomposition can give higher detection rate and smaer fase aarm rate. However since an L-eve decomposition has a 2 L time aggregation scae i.e. it transforms the data sampes within a 2 L time window to the waveet domain so the waveet coefficients within this window is timeindistinguishabe a higher eve decomposition woud often give onger detection atency than that of a ower eve decomposition. In our experiments we found that a 5-eve waveet decomposition can give a reasonabe good baance between detection accuracy and atency. The intensity of the injected mean eve shift aso affects the detection performance. Fig. 4 shows the ROC curve and detection atency for the injected mean shift with different intensities. Each curve is obtained over 000 simuation traces with the 5-eve waveet decomposition. As is expected for higher injected mean eve shifts the detection becomes much easier in terms of ower fase aarms higher detection rates and smaer detection atency. Detection rate Detection atency ROC curve mean shift0.75 mean shift mean shift Fase aarm rate FAR vs. Latency mean shift0.75 mean shift mean shift Fase aarm rate Fig. 4: Effects of different injected intensities For the second type of anomaies i.e. the one that varies mode parameters for the data generation process simiar good performances are observed for our detection method. When the variation becomes arger the detection becomes easier. Due to space imit we omit the resuts here. For performance comparison we impement a baseine method adapted from [2] in which ony the mean and variance of the waveet coefficients is used for anomay Detection rate Detection atency ROC our method baseine method Fase aarm rate FAR vs. Detection atency our method baseine method Fase aarm rate Fig. 5: Comparison of our method and the baseine method VII. CONCLUSIONS In this paper we studied the anomay detection probem for LRD traffic in wireess sensor networs. We proposed a waveet-domain hidden Marov mode for capturing the properties of networ traffic. The waveet transform is abe to turn the ong range dependency that exists among the sampe data into a short memory structure among its waveet coefficients. The HMM in the waveet-domain is used to further capture the remaining dependency among the waveet coefficients thus mode the traffic variabiity more accuratey. Networ anomaies are then detected as abrupt changes in the traced HMM mode structures. We evauate the performance of our agorithm numericay using typica LRD time series. In the future wor we pan to study the optimization of mode parameters for the waveet domain HMM mode in order to achieve better performance. REFERENCES [] P. Wang and I. F. Ayidiz Spatia correation and mobiity aware traffic modeing for wireess sensor networs in Proceedings of Gobecom [2] P. Barford J. Kine D. Pona and A. Ron A signa anaysis of networ traffic anomaies in ACM SIGCOMM Internet Measurement Worshop [3] P. Zuraniewsi and D. Rincon Waveet transforms and chengepoint detection agorithms for tracing networ traffic fractaity in Proceedings of 2nd Conference on Next Generation Internet Design and Engineering [4] A. Lahina M. Crovea and C. Diot Mining anomaies using trafc feature distributions in Proceedings of ACM SIGCOMM [5] A. Hussain03 J. Heidemann and C. Papadopouos A framewor for cassifying denia of service attacs in Proceedings of ACM SIGCOMM [6] S. Jin and D. Yeung A covariance anaysis mode for DDoS attac detection in Proceedings of IEEE ICC [7] P. Abry and D. Veitch Waveet anaysis of ong range dependent traffic IEEE Transactions of Information Theory 998. [8] L. Rabiner Non-Gaussian and ong memory statistica characterisations for Internet traffic with anomaies IEEE Transactions on Dependabe and Secure Computing [9] Y. Gu A. McCaum and D. Towsey Detecting anomaies in networ traffic using maximum entropy estimation in Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement [0] M. Crouse R. Nowa and R. Baraniu Waveet-based statistica signa processing using hidden Marov modes IEEE Transactions on signa processing 998. [] S. Maat and S. Zhong Characterization of signas from mutiscae edges IEEE Transactions on Pattern Anaysis and Machine Inteigence 992. [2] O. Cappe Onine EM agorithm for hidden Marov modes