Lightweight Anomaly Detection for Wireless Sensor Networks

Abstract

Anomaly detection in wireless sensor networks (WSNs) is critical to ensure the quality of senor data, secure monitoring, and reliable detection of interesting and critical events. The main challenge of anomaly detection algorithm in WSNs is identifying anomalies with high accuracy while consuming minimal resource of the network. In this paper two lightweight anomaly detection algorithms LADS and LADQA are proposed for WSNs. Both algorithms utilize the one-class quarter-sphere support vector machine (QSSVM) and convert the linear optimization problem of QSSVM to a sort problem for the reduced computational complexity. Experimental results show that the proposed algorithms can keep the lower computational complexity without reducing the accuracy for anomaly detection, compared to QSSVM.

1. Introduction

Wireless sensor networks (WSNs) have been widely used in various applications including civil and military domains [1]. However, the harsh deployment environment and the constrained capabilities of sensors (energy, CPU, memory, etc.) make WSNs more vulnerable to different types of misbehaviors or anomalies. In WSNs, an anomaly or outlier (these terms are used interchangeably in this paper) is defined as the measurement that significantly deviates from the normal pattern of the sensed data [2]. Sensor data are affected by these anomalies that always correspond to node software or hardware failure, reading errors, unusual events, and malicious attacks. Therefore, it is critical to efficiently and accurately identify anomalies in the sensor data to ensure data quality, secure monitoring, and reliable detection of interesting and critical events.

The context of sensor networks and nature of sensor data make design of an appropriate anomaly detection technique challenging [3]. The constrained environment of a WSN impacts on anomaly detection algorithms. Node constraints on computational power and memory mean that algorithms for anomaly detection should have low computational complexity and occupy little memory space. Moreover, prelabelled data are expensive or difficult to obtain in WSNs. Anomaly detection for WSNs should be able to operate on unlabelled data. In general, the key challenge of anomaly detection algorithm in WSNs is identifying anomalies with high accuracy while consuming minimal resource of the network.

Recently, support vector machines (SVM) in the form of the one-class quarter-sphere (QSSVM) have been used for anomaly detection in WSNs due to their reduced computational complexity and ability to operate on unlabelled data [4, 5]. QSSVM can convert the quadratic optimization problem of one-class SVM to a linear optimization problem. A family of algorithms based on QSSVM are proposed for anomaly detection in WSNs and have shown the potential for anomaly detection. However, the main disadvantage of those algorithms derived from QSSVM is the high computational cost for the solution of a linear programme.

In this paper, we convert the linear optimization problem of QSSVM to a sort problem and propose two lightweight anomaly detection algorithms for WSNs to identify anomalies. Simulations show that our proposed algorithms are able to reduce the computational complexity without reducing the accuracy for anomaly detection.

Our paper makes the following contributions: (1)

We present a mathematic method to prove that the linear optimization problem of QSSVM can be converted to a sort problem.

(2)

Based on the presented method, we propose two lightweight anomaly detection algorithms for WSNs, namely, lightweight anomaly detection algorithm using sort (LADS) and lightweight anomaly detection algorithm using quick select (LADQS). It is shown that our algorithms are equivalent to QSSVM but have lower computational complexity.

(3)

The experimental evaluation of the effectiveness and efficiency of the proposed algorithms on real world WSN dataset is presented.

The remainder of this paper is structured as follows. Related works on QSSVM-based anomaly detection models are presented in Section 2. In Section 3, first the principle of QSSVM is described, and then a method to convert the linear optimization problem of QSSVM to a sort problem is discussed. Furthermore, our proposed lightweight anomaly detection algorithms are also explained. Experimental results and performance evaluation are reported in Section 4. Section 5 concludes the paper and suggests some directions for future research.

2. Related Work

Anomaly detection typically makes use of data mining and machine learning techniques to detect abnormal activities in the systems [2]. Anomaly detection techniques for WSNs can be categorized into statistical-based, nearest neighbor-based, clustering-based, classification-based, and spectral decomposition-based approaches [6]. Classification models are important models of data mining and machine learning community in which a classification model is learned using the known training data and used after that to classify the unseen testing data into different types of classes. SVM-based techniques are one of the popular classification-based approaches and have been widely used to detect anomalies due to the advantages of no requirement of an explicit statistical model and prevention from the curse of dimensionality.

In WSNs, prelabelled data are expensive or difficult to obtain. Several one-class SVM-based anomaly detection techniques have been proposed to process the unlabeled data. Their main idea is to use a nonlinear function to map the data vectors collected from the original input space to a higher dimensional space called feature space. Then a decision boundary of normal data is found, which encompasses the majority of data vectors in the feature space. Those data vectors falling outside the normal boundary are classified as anomalous. To this end, Schölkopf et al. have presented a hyperplane-based one-class SVM by fitting a hyperplane from the origin. Those data vectors near the origin are considered as anomalous [7]. Tax and Duin have proposed a hypersphere-based one-class SVM by fitting a hypersphere with a minimum radius [8]. Those data vectors falling outside the hypersphere are considered as anomalous. However, these one-class SVM-based techniques still require solving a quadratic optimization, and that is extremely costly.

In order to reduce expensive computational complexity of the quadratic optimization, Campbell and Bennett have formulated a linear programming approach for the hyperplane-based SVM proposed in [9], which is based on attracting the hyperplane towards the average of the distribution of mapped data vectors. Laskov et al. have extended work in Tax and Duin by proposing a quarter-sphere one-class SVM, which converts the quadratic optimization problem to a linear optimization problem by fitting a hypersphere centered at the origin and consequently reduces computational complexity of learning the normal boundary of data vectors [5, 8]. Based on QSSVM, several distributed outlier detection techniques for WSNs are proposed by Rajasegarar et al. and Zhang et al. [10, 11]. After that, Rajasegarar et al. have further extended work in [12] by proposing a hyperellipsoidal one-class SVM using a linear optimization. However, the solution of a linear optimization, rather than a quadratic, still requires expensive computational complexity due to the fact that the solution of the linear programme is $O (n^{3})$ where n is the number of data vectors in the training set.

In this paper, we propose two lightweight anomaly detection techniques which convert the linear optimization problem of QSSVM to a sort problem and consequently reduce computational complexity of learning the normal boundary of data vectors.

3. Lightweight Anomaly Detection Algorithm for WSNs

In this section, we first introduce the principles of modeling the one-class quarter-sphere support vector machine (QSSVM) proposed in [5]. After that, we use a mathematical method to prove that the linear optimization problem of QSSVM can be converted to a sort problem and further propose two lightweight anomaly detection algorithms for WSNs.

3.1. Principles of the One-Class Quarter-Sphere SVM

In this section we discuss the principles of QSSVM proposed by Laskov et al. in [5]. They have converted the quadratic optimization problem of the one-class SVM to a linear optimization problem by fixing the center of the quarter-sphere at the origin. The geometry of hypersphere SVM is shown in Figure 1.

Figure 1

Geometry of QSSVM formulation in the feature space.

Assume that n data vectors ${x_{i} \in R^{d}, i = 1, \dots, n}$ of d variables in the input space are mapped into the feature space using a certain nonlinear mapping function $ϕ (g)$ . The constrained optimization problem of QSSVM can be formalized as follows:

\begin{matrix} \underset{R \in R, ξ \in R^{n}}{m i n} R^{2} + \frac{1}{v n} \sum_{i = 1}^{n} ξ_{i} \\ subject  to: {‖ϕ (x_{i})‖}^{2} \leq R^{2} + ξ_{i}, \\ ξ_{i} \geq 0, i = 1, \dots, n, \end{matrix}

(1)

where

{ξ_{i} : i = 1,2, \dots, n}

are the slack variables that allow some of the data vectors to fall outside the quarter-sphere. The regularization parameter v is a representation of the number of data vectors that are expected to be anomalies, where

v \in (0,1)

Obtaining the dual form of the optimization problem allows its formulation in terms of dot products of the data vectors in the training set. Using the kernel trick, the dot products ${‖ϕ (x_{i})‖}^{2}$ are replaced by the kernels $k (x_{i}, x_{i})$ . The dual formulation of (1) will become

\begin{matrix} \underset{α \in R^{n}}{m i n} - \sum_{i = 1}^{n} α_{i} k (x_{i}, x_{i}) \\ subject  to: \sum_{i = 1}^{n} α_{i} = 1, \\ 0 \leq α_{i} \leq \frac{1}{v n}, i = 1, \dots, n . \end{matrix}

(2)

It can be seen from (2) that optimization problem is stated in terms of a dot product of an image vector with itself; this causes an issue with distance-based kernels, such as the RBF kernel, as the diagonal term $k (x_{i}, x_{i})$ becomes equal for all the vectors. This can be solved by centering the kernel matrix in feature space where the mean of the image vectors is subtracted from each image vector as follows:

\begin{matrix} ϕ {(x_{i})}_{c} = ϕ (x_{i}) - \frac{1}{n} \sum_{i = 1}^{n} ϕ (x_{i}) . \end{matrix}

(3)

There is no explicit vector in feature space that represents the mean; however the dot product $K_{c} = (ϕ (x_{i})_{c}, ϕ (x_{j})_{c})$ of the centred image vectors can be obtained in terms of the kernel matrix $K = k (x_{i}, x_{j}) = (ϕ (x_{i}) \cdot ϕ (x_{j}))$ using $K_{c} = K - 1_{n} K - K 1_{n} + 1_{n} K 1_{n}$ , where $1_{n}$ is an $n \times n$ matrix with all values equal to $1 / n$ [13]. When the kernel matrix is centred in feature space the norms of the kernels are no longer equal and the terms $k (x_{i}, x_{i})$ of (2) are replaced by the diagonal elements $k_{c} (x_{i}, x_{i})$ of the centered kernel matrix $K_{c}$ . $\sqrt{k_{c} (x_{i}, x_{i})}$ can be considered as the distances between data vectors $x_{i}$ and the origin of its centered quarter-sphere in the feature space. Consequently, the dual problem (2) can be solved.

After solving (2) for ${α_{i}}$ , the data vectors can be classified as follows. Data vectors with $α_{i} = 0$ , which lie inside the hypersphere, are considered as normal and their distances from the origin are smaller than the radius of the quarter-sphere. Data vectors with $α_{i} = 1 / v n$ are considered as anomalies, which lie outside the hypersphere. Data vectors with $0 < α_{i} < 1 / v n$ , which lie on the surface of the hypersphere, are called the border support vectors. Moreover, the minimal radius R of the hypersphere can be obtained using $R^{2} = k_{c} (x_{i}, x_{i})$ for any border support vector $x_{i}$ .

3.2. Lightweight Anomaly Detection Algorithm Using Sort

In the previous section, we introduced the principle of QSSVM which convert the quadratic optimization problem to a linear optimization problem. We are aware that the learning process of QSSVM is to find the minimal radius R of one-class quarter-sphere for the training set, which can be obtained by the distances between border support vectors $x_{i}$ and its origin in the feature space using $R^{2} = k_{c} (x_{i}, x_{i})$ . This process has high computational and memory complexity due to the fact that it requires solving the linear programme and finding data vectors $x_{i}$ with $0 < α_{i} < 1 / v n$ , that is, the border support vectors. To reduce the cost of modeling QSSVM, we propose a lightweight anomaly detection algorithm using sort to identify anomalies. Our algorithm can obtain the minimal radius R of QSSVM, that is, the distance $\sqrt{k_{c} (x_{i}, x_{i})}$ between data vector $x_{i}$ with $0 < α_{i} < 1 / v n$ and the origin, by a descending sorted sequence instead of the solution of a linear optimization problem. That is to say, our algorithm will be equivalent to QSSVM but converts the linear optimization problem to a sort problem. For doing so, we first fix the data vectors at the origin in the feature space through generation of kernel matrix and the transformation of central kernel matrix like QSSVM [5] and obtain the formulation of (2). Note that the terms $k (x_{i}, x_{i})$ of (2) have been actually replaced by the diagonal elements $k_{c} (x_{i}, x_{i})$ of the centered kernel matrix $K_{c}$ as we discussed in the previous subsection. Next we require finding the minimal radius R from (2). Obviously, the process for calculation of R only needs to find a distance $\sqrt{k_{c} (x_{i}, x_{i})}$ corresponding to $α_{i}$ satisfying the formulation of (2) and $0 < α_{i} < 1 / v n$ , instead of solving the linear programme for (2).

In order to find the minimal radius R, the sequence ${k_{c} (x_{i}, x_{i})}$ is sorted in descending order and becomes ${k_{c} (x_{1^{'}}, x_{1^{'}}), k_{c} (x_{2^{'}}, x_{2^{'}}), \dots, k_{c} (x_{n^{'}}, x_{n^{'}})}$ , where $k_{c} (x_{1^{'}}, x_{1^{'}}) \geq k_{c} (x_{2^{'}}, x_{2^{'}}) \geq \dots \geq k_{c} (x_{n^{'}}, x_{n^{'}})$ . For convenience, we replace $k_{c} (x_{i}, x_{i})$ with $d_{i}$ . Consequently, the dual formulation of (2) will be simplified to

\begin{matrix} \underset{α \in R^{n}}{m a x} \sum_{i = 1}^{n} α_{i^{'}} d_{i^{'}} \\ subject  to: \sum_{i = 1}^{n} α_{i^{'}} = 1, \\ 0 \leq α_{i^{'}} \leq \frac{1}{v n}, i = 1, \dots, n, \end{matrix}

(4)

where

d_{1^{'}} \geq d_{2^{'}} \geq \dots \geq d_{n^{'}}

v \in (0,1)

is the regularization parameter that represents the fraction of outliers, and n is the number of the data vectors in the training set.

Actually, there exists an implied constraint that $α_{i^{'}} = α_{j^{'}}$ if and only if $d_{i^{'}} = d_{j^{'}}$ . This implies that the data vectors which have the same distances to origin in the feature space either are normal or not.

Now we prove that the minimal radius R can be computed directly from the descending sequence ${d_{1^{'}}, d_{2^{'}}, \dots, d_{n^{'}}}$ through the parameters v and n.

Theorem 1.

If the values of $α_{1^{'}}, α_{2^{'}}, \dots, α_{n^{'}}$ are the solution of (4), one has $α_{1^{'}} \geq α_{2^{'}} \geq \dots \geq α_{n^{'}}$ .

Proof.

Since $α_{1^{'}}, α_{2^{'}}, \dots, α_{n^{'}}$ is the solution of (4), the value of the objective function attains maximum under the constrained condition and can be denoted as $f_{1} = α_{1^{'}} d_{1^{'}} + α_{2^{'}} d_{2^{'}} + \dots + α_{n^{'}} d_{n^{'}}$ .

Firstly, we prove that $α_{1^{'}}$ is the maximum of ${α_{1^{'}}, α_{2^{'}}, \dots, α_{n^{'}}}$ if $d_{1^{'}}$ is the maximum of ${d_{1^{'}}, d_{2^{'}}, \dots, d_{n^{'}}}$ . Assume the contrary that the value of $α_{1^{'}}$ is not maximal if the value of $d_{1^{'}}$ is maximal. This assumption indicates that there exists $α_{j^{'}}$ such that value of $α_{j^{'}}$ is the maximal of ${α_{i^{'}}}$ . We exchange the value of $α_{j^{'}}$ with $α_{1^{'}}$ , so the value of the objective function becomes

\begin{array}{l} f_{2} & = α_{j^{'}} d_{1^{'}} + α_{2^{'}} d_{2^{'}} + \dots + α_{{(j - 1)}^{'}} d_{{(j - 1)}^{'}} + α_{1^{'}} d_{j^{'}} \\ + α_{{(j + 1)}^{'}} d_{{(j + 1)}^{'}} + \dots + α_{n^{'}} d_{n^{'}} . \end{array}

(5)

Subtract $f_{1}$ from $f_{2}$ and we have

\begin{array}{l} f_{2} - f_{1} & = (α_{j^{'}} d_{1^{'}} + α_{1^{'}} d_{j^{'}}) - (α_{1^{'}} d_{1^{'}} + α_{j^{'}} d_{j^{'}}) \\ = (d_{1^{'}} - d_{j^{'}}) (α_{j^{'}} - α_{1^{'}}) . \end{array}

(6)

From the contradictions, we have $d_{1^{'}} \geq d_{j^{'}}$ and $α_{j^{'}} \geq α_{1^{'}}$ . So we get $f_{2} - f_{1} \geq 0$ . This contradicts the fact that $f_{1}$ is not the maximum of the objective function. Thus we have derived that $α_{1^{'}}$ is the maximum of ${α_{i^{'}} | i^{'} = 1,2, \dots, n}$ .

In a similar way, we can prove that $α_{2^{'}}$ is the second maximum of ${α_{1^{'}}, α_{2^{'}}, \dots, α_{n^{'}}}$ , if $d_{2^{'}}$ is the second maximum of ${d_{1^{'}}, d_{2^{'}}, \dots, d_{n^{'}}}$ . And so, we can prove that $α_{i^{'}}$ is the ith maximum of ${α_{1^{'}}, α_{2^{'}}, \dots, α_{n^{'}}}$ if $d_{i^{'}}$ is the ith maximum of ${d_{1^{'}}, d_{2^{'}}, \dots, d_{n^{'}}}$ .

As proved above, it is evident that $α_{1^{'}} \geq α_{2^{'}} \geq \dots \geq α_{n^{'}}$ if the values of $α_{1^{'}}, α_{2^{'}}, \dots, α_{n^{'}}$ are the solution of (4). This completes the proof.

According to Theorem 1, we can infer Theorems 2 and 3 as follows.

Theorem 2.

If the values of ${α_{1^{'}}, α_{2^{'}}, \dots, α_{n^{'}}}$ are the solution of (4), one has $0 < α_{{(j + 1)}^{'}} < 1 / v n$ when $j = ⌊v n⌋$ and $j \neq v n$ .

Proof.

Since one of the constraint conditions is $0 \leq α_{i^{'}} \leq 1 / v n$ , Theorem 3 will be proved if we can show that $α_{{(j + 1)}^{'}} \neq 0$ and $α_{{(j + 1)}^{'}} \neq 1 / v n$ when $j = ⌊v n⌋$ and $j \neq v n$ . If the assertion were not true, then we would have $α_{{(j + 1)}^{'}} = 0$ or $α_{{(j + 1)}^{'}} = 1 / v n$ when $j = ⌊v n⌋$ and $j \neq v n$ .

Recalling Theorem 1, we have $1 / v n \geq α_{1^{'}} \geq \dots \geq α_{j^{'}} \geq α_{{(j + 1)}^{'}} \geq \dots \geq α_{n^{'}} \geq 0$ . By the assumption of $α_{{(j + 1)}^{'}} = 0$ , it is easy to see that $α_{{(j + 1)}^{'}} = α_{{(j + 2)}^{'}} = \dots = α_{n^{'}} = 0$ . And we have $\sum_{i = 1}^{n} α_{i} = \sum_{i = 1}^{j} α_{i} \leq j / v n$ . When $j = ⌊v n⌋$ and $j \neq v n$ , the above inequation will become $\sum_{i = 1}^{n} α_{i} \leq j / v n < 1$ . This contradicts the fact of $\sum_{i = 1}^{n} α_{i} = 1$ . By the assumption of $α_{{(j + 1)}^{'}} = 1 / v n$ , it is clear that $α_{1^{'}} = α_{2^{'}} = \dots = α_{j^{'}} = α_{{(j + 1)}^{'}} = 1 / v n$ . And we get $\sum_{i = 1}^{n} α_{i} \geq (j + 1) / v n$ . When $j = ⌊v n⌋$ and $j \neq v n$ , the inequation will become $\sum_{i = 1}^{n} α_{i} \geq (j + 1) / v n > 1$ . This is contrary to the constraint condition of $\sum_{i = 1}^{n} α_{i} = 1$ . This completes the proof.

Theorem 3.

Given that the values of ${α_{1^{'}}, α_{2^{'}}, \dots, α_{n^{'}}}$ are the solution of (4), if $j = v n$ and $j = ⌊v n⌋$ , one has

\begin{matrix} d_{1^{'}} = d_{2^{'}} = \dots = d_{n^{'}}, \\ α_{1^{'}} = α_{2^{'}} = \dots = α_{n^{'}}; \end{matrix}

(7)

otherwise,

\begin{matrix} α_{1^{'}} = \dots = α_{j^{'}} = \frac{1}{v n}, \\ α_{{(j + 1)}^{'}} = \dots = α_{n^{'}} = 0 . \end{matrix}

(8)

Proof.

In the case when $d_{1^{'}} = d_{2^{'}} = \dots = d_{n^{'}}$ , obviously, we have $α_{1^{'}} = α_{2^{'}} = \dots = α_{n^{'}}$ by the implied constraint that there exists $α_{i^{'}} = α_{j^{'}}$ if and only if $d_{i^{'}} = d_{j^{'}}$ . In the other cases, let the value $β_{i^{'}}$ of $α_{i^{'}}$ be the solution of (4). If the assertion were not true, we would have the value $β_{i^{'}}$ of $α_{i^{'}}$ such that $β_{k^{'}} \neq 1 / v n$ or $β_{l^{'}} \neq 0$ , where $k \in {1, \dots, j}$ and $l \in {j + 1, \dots, n}$ . Consequently, the value of objective function becomes $f_{1} = \sum_{i = 1}^{n} β_{i^{'}} d_{i^{'}}$ . When $α_{1^{'}} = α_{2^{'}} = \dots = α_{j^{'}} = 1 / v n$ and $α_{{(j + 1)}^{'}} = \dots = α_{n^{'}} = 0$ , where $j = v n$ and $j = ⌊v n⌋$ , let the value of objective function be $f_{2} = \sum_{i = 1}^{n} α_{i^{'}} d_{i^{'}} = (1 / v n) \sum_{i = 1}^{j} d_{i^{'}}$ . Since the value $β_{i^{'}}$ of $α_{i^{'}}$ is the solution of (4), $f_{1}$ is the maximal of the objective function and $f_{1} \geq f_{2}$ . Subtract $f_{1}$ from $f_{2}$ and we have $f_{2} - f_{1} = (1 / v n - β_{1^{'}}) d_{1^{'}} + \dots + (1 / v n - β_{j^{'}}) d_{j^{'}} - β_{{(j + 1)}^{'}} d_{{(j + 1)}^{'}} - \dots - β_{n^{'}} d_{n^{'}}$ . Recalling Theorem 1 and the constraints, we have $1 / v n \geq α_{1^{'}} \geq \dots \geq α_{j^{'}} \geq α_{{(j + 1)}^{'}} \geq \dots \geq α_{n^{'}} \geq 0$ and $d_{1^{'}} \geq \dots \geq d_{j^{'}} \geq d_{{(j + 1)}^{'}} \geq \dots \geq d_{n^{'}} \geq 0$ . So we get $f_{2} - f_{1} \geq (1 / v n - β_{1^{'}}) d_{1^{'}} + \dots + (1 / v n - β_{j^{'}}) d_{j^{'}} - β_{{(j + 1)}^{'}} d_{j^{'}} - \dots - β_{n^{'}} d_{j^{'}}$ . According to the implied constraint, the equality sign holds if and only if $d_{j^{'}} = d_{{(j + 1)}^{'}} = \dots = d_{n^{'}}$ or $β_{{(j + 1)}^{'}} = \dots = β_{n^{'}} = 0$ . And we also have $f_{2} - f_{1} \geq (1 / v n - β_{1^{'}}) d_{j^{'}} + \dots + (1 / v n - β_{j^{'}}) d_{j^{'}} - β_{{(j + 1)}^{'}} d_{j^{'}} - \dots - β_{n^{'}} d_{j^{'}}$ , where the equality sign holds if and only if ( $d_{1^{'}} = \dots = d_{j^{'}}$ and $d_{j^{'}} = d_{{(j + 1)}^{'}} = \dots = d_{n^{'}}$ ) or ( $β_{1^{'}} = \dots = β_{j^{'}} = 1 / v n$ and $β_{{(j + 1)}^{'}} = \dots = β_{n^{'}} = 0$ ). However, this is not the case when $d_{1^{'}} = d_{2^{'}} = \dots = d_{n^{'}}$ and the definition and condition of $β_{i^{'}}$ show that $β_{k^{'}} \neq 1 / v n$ or $β_{l^{'}} \neq 0$ , where $k \in {1, \dots, j}$ and $l \in {j + 1, \dots, n}$ . So the equality sign does not hold and we have $f_{2} - f_{1} > (1 / v n - β_{1^{'}}) d_{j^{'}} + \dots + (1 / v n - β_{j^{'}}) d_{j^{'}} - β_{{(j + 1)}^{'}} d_{j^{'}} - \dots - β_{n^{'}} d_{j^{'}}$ . And we get $f_{2} - f_{1} > (j / v n - β_{1^{'}} - \dots - β_{n^{'}}) d_{j^{'}}$ . From $j = v n$ and $j = ⌊v n⌋$ and the constraint of $\sum_{i = 1}^{n} β_{i^{'}} = 1$ , we obtain $f_{2} - f_{1} > 0$ . This is contrary to $f_{1} > f_{2}$ . That is, it completes the proof.

Theorem 4.

The minimal radius R of the quarter-sphere in QSSVM can be obtained by

\begin{matrix} R^{2} = d_{{(j + 1)}^{'}}, \end{matrix}

(9)

where

d_{{(j + 1)}^{'}}

is the

(j + 1)

th largest squared distances

k_{c} (x_{i}, x_{i})

between

x_{i}

and the origin of its centered quarter-sphere in the feature space.

Proof.

As we know, the constrained optimization problem of QSSVM can be formulated as (2). Note that the terms $k (x_{i}, x_{i})$ of (2) are replaced by $k_{c} (x_{i}, x_{i})$ . After calculating the values of ${α_{1}, α_{2}, \dots, α_{n}}$ in (2), the minimal radius R of the quarter-sphere in QSSVM can be computed using $R^{2} = k_{c} (x_{i}, x_{i})$ for any data vector $x_{i}$ with $0 < α_{i} < 1 / v n$ . Given $d_{i} = k_{c} (x_{i}, x_{i})$ , when ${k_{c} (x_{i}, x_{i})}$ in (2) is sorted in descending order, the optimization problem of (2) becomes the formulation of (4). According to Theorems 2 and 3, the minimal radius R can be obtained in two cases. In the first case when $j = ⌊v n⌋$ and $j \neq v n$ ,we have $0 < α_{{(j + 1)}^{'}} < 1 / v n$ from Theorem 3 and $R^{2} = d_{{(j + 1)}^{'}}$ . In the second case when $j = ⌊v n⌋$ and $j = v n$ , we have $α_{1^{'}} = α_{2^{'}} = \dots = α_{n^{'}}$ or $α_{1^{'}} = α_{2^{'}} = \dots = α_{j^{'}} = 1 / v n$ , $α_{{(j + 1)}^{'}} = \dots = α_{n^{'}} = 0$ from Theorem 2. The fact of $α_{1^{'}} = α_{2^{'}} = \dots = α_{n^{'}}$ means that we get $0 < α_{1^{'}} = \dots = α_{j^{'}} = 1 / n < 1 / v n$ by the constraints of $\sum_{i = 1}^{n} α_{i} = 1$ and $v \in (0,1)$ and $R^{2} = d_{{(j + 1)}^{'}}$ . The fact of $α_{1^{'}} = α_{2^{'}} = \dots = α_{j^{'}} = 1 / v n$ and $α_{{(j + 1)}^{'}} = \dots = α_{n^{'}} = 0$ means that there are no border support vectors $x_{i^{'}}$ , which are the vectors with $0 < α_{i^{'}} < 1 / v n$ . By the decision rule of QSSVM, the vectors with $α_{i^{'}} = 0$ or the vectors with $α_{i^{'}} = 1 / v n$ are considered as normal or anomalies, respectively. And their squared distances to origin are, respectively, not larger or larger than $d_{{(j + 1)}^{'}}$ , which means the largest squared distance between the normal vectors and the origin. Therefore the minimal radius R can be treated as $\sqrt{d_{{(j + 1)}^{'}}}$ . Moreover, we have $R^{2} = d_{{(j + 1)}^{'}}$ in both cases. This completes the proof.

From Theorem 4, the minimal radius R of the quarter-sphere in QSSVM can be obtained by a descending sorted sequence using (9). So the linear optimization problem of QSSVM is converted to a sort problem of ${k_{c} (x_{i}, x_{i})}$ . Now, we propose a lightweight anomaly detection algorithm using sorting (LADS), which is equivalent to the QSSVM. The detail of LADS is described as follows.

After the generation of kernel matrix and the transformation of central kernel matrix, the data vectors $x_{i}$ are centered at the origin in the feature space the same as QSSVM. These squared distances to the origin are sorted in descending order and form a descending sequence ${k_{c} (x_{i^{'}}, x_{i^{'}})}$ , where $k_{c} (x_{1^{'}}, x_{1^{'}}) \geq \dots \geq k_{c} (x_{n^{'}}, x_{n^{'}})$ . The $(j + 1)$ th largest squared distance $k_{c} (x_{j^{'}}, x_{j^{'}})$ ( $j = ⌊v n⌋$ ) is chosen from the descending sequence as the minimal radius R by (9). The data vectors can be classified depending on R. The data vectors whose distances to origin are not larger than R are considered as normal. Otherwise, the data vectors whose distances to origin are larger than R are considered as outliers.

Now, our algorithm can be described in Algorithm 1.

Algorithm 1

Step 1. Calculate $k_{c} (x_{i}, x_{i})$ .

Step 2. Sort $k_{c} (x_{i}, x_{i})$ in descending order and have $\{k_{c} (x_{i^{'}}, x_{i^{'}})\}$ .

Step 3. Calculate $R = \sqrt{d_{{(j + 1)}^{'}}}$ using (9).

Step 4. If $k_{c} (x_{i}, x_{i}) > R^{2}$

$x_{i}$ is outlier

Else

$x_{i}$ is normal

End If

3.3. Lightweight Anomaly Detection Algorithm Using Quick Select

As discussed in the previous section, the minimal radius R of the quarter-sphere in QSSVM can be obtained from the descending sequence ${k_{c} (x_{i^{'}}, x_{i^{'}})}$ . The computational complexity for obtaining the descending sequence is $O (n \log_{2} n)$ . In fact, the process for the descending sequence is unnecessary, because R can be determined by (9) if the $(⌊v n⌋ + 1) t h$ largest element of the original sequence ${k_{c} (x_{i}, x_{i})}$ can be found. So we propose an anomaly detection method LADQS based on Quickselect algorithm [14] to find the ( $⌊v n⌋ + 1$ )th largest distance to the origin, that is, minimal radius R. In computer science, Quickselect is a selection algorithm to find the kth largest element in an unordered list. Quickselect uses the same overall approach as quicksort [14], choosing one element as a pivot and partitioning the data in two based on the pivot, accordingly as less than or greater than the pivot. However, instead of recursing into both sides, as in quicksort, Quickselect only recurses into one side—the side with the element it is searching for. This reduces the average computational complexity from $O (n \log_{2} n)$ to $O (n)$ . The pseudocode of LADQS algorithm is shown in Algorithm 2.

Algorithm 2: The pseudocode of LADQS algorithm.

function LADQS()

let ${x_{i} \in R^{d}, i = 1, \dots, n}$ be the data vectors in the training set;

calculate the distance $k (x_{i}, x_{i})$ to origin for each data vector $x_{i}$ ;

obtain $A = {k (x_{i}, x_{i}), i = 1, \dots, n}$ ;

return R = QuickSelect( $A, 1, n, ⌊v n⌋ + 1$ )

// Returns the nth largest element of list.

function QuickSelect(list, $l, r, n$ )

if $l = r$ // If the list contains only one element

return list $[l]$ // Return that element

pivotIndex = l + floor(rand() ∗ ( $r - l + 1$ ))

// randomly select a pivotIndex between l and r

pivotIndex = QuickPartition(list, l, r, pivotIndex)

if n = pivotIndex

return list $[n]$

else if n < pivotIndex

return QuickSelect(list, l, pivotIndex − 1, n)

else

return QuickSelect(list, pivotIndex + 1, r, n)

4. Experimental Results and Evaluation

This section specifies the performance evaluation of our two techniques compared to QSSVM. In our experiments, we have used real data gathered at the Grand-Saint-Bernard [15], which is similar to the one used in [16]. For simulation, we use Matlab to implement our algorithms and QSSVM on a single node in a WSN. For fairness, we use the average of the tests operated on 7 different nodes, respectively, as the experimental results.

4.1. Experimental Datasets

The real data are collected from a closed neighborhood from a WSN deployed in Grand-Saint-Bernard as shown in Figure 2. The closed neighborhood consists of node 2 and its 6 spatially neighboring nodes, namely, nodes 3, 4, 8, 12, 20, and 14. In our simulations, we test the real data collected during the period of 6 am–6 pm on September 20, 2007, with two attributes: ambient temperature and relative humidity for each sensor measurement. The data is preprocessed and normalized to the range $[0,1]$ . The number of anomalous data is about 10% of normal data. Measurements are labeled depending on the degree of dissimilarity between one another.

Figure 2

The relative positions of the nodes in Grand-Saint-Bernard.

4.2. Experimental Results and Evaluation

We choose radial basis function (RBF) kernel function to generate kernel matrices. RBF kernel function $k_{R B F} = e x p (- {‖x_{1} - x_{2}‖}^{2} / σ^{2})$ , where σ is the width parameter of the kernel function. And the kernel width parameter σ is set to 0.25 in our experiments.

We have examined the effect of the regularisation parameter v for our two anomaly detection algorithms and QSSVM. v represents the fraction of anomalies in training set and we have varied it in the range from 0.01 to 0.25 in intervals of 0.03. And we also have examined the training time for the three algorithms.

Figures 3 and 4 show that the detection rate and the false alarm rate obtained for our algorithm LADS use RBF kernel function for real data, respectively. As we discussed in the previous section, LADS, LADQS, and QSSVM have the same principle of data classification but have difference in the way of finding the minimal radius R. This means the LADS behaves in a similar manner to LADQS. Therefore, results of LADQS and QSSVM have been omitted.

Figure 3

Detection rate of LADS in terms of parameter v selection.

Figure 4

False alarm rate of LADS in terms of parameter v selection.

Figure 5 shows the training time elapsing for the three algorithms. We can see that the training time of our algorithms LADS and LADQS is significantly less than that of QSSVM. It indicates that our two algorithms have less time and lower computational complexity, compared to QSSVM.

Figure 5

Training time in terms of parameter v selection.

Simulation results show that our two algorithms LADS and LADQS have the lower computational complexity without reducing the accuracy for anomaly detection, compared to QSSVM.

Computational complexity of our techniques is presented in Table 1, where n denotes the number of data in the training sets, d represents the dimensionality of the measurement, v represents the fraction of anomalies in the training set, and $O (L)$ represents the computational complexity of solving a linear optimization problem.

Table 1

Computational complexity of our techniques.

Techniques	Computational complexity
QSSVM	$O (L)$
LADS	$O (n \log n)$
LADQS	$O (n)$

5. Conclusion

In this paper we propose two lightweight anomaly detection algorithms for WSNs, LADS and LADQS. Both algorithms are based on QSSVM but convert the linear optimization problem of QSSVM to a sort problem. Simulation results show that our algorithms reduce the computational complexity while achieving the same accuracy for anomaly detection. Our future research includes selecting the optimal parameters for v and implementing our algorithms on multiple sensor nodes in real-life.

Footnotes

Conflict of Interests

The authors declare no conflict of interests.

Acknowledgment

The work is supported in part by National Science and Technology Major Project under Grant no. 2011ZX03005-002.

References

Akyildiz

I. F.

Sankarasubramaniam

Cayirci

Wireless sensor networks: a survey

Computer Networks 2002 38 4 393 422

10.1016/s1389-1286(01)00302-4

2-s2.0-0037086890

Chandola

Banerjee

Kumar

Anomaly detection: a survey

ACM Computing Surveys 2009 41 3, article 15

10.1145/1541880.1541882

2-s2.0-68049121093

Zhang

Meratnia

Havinga

An online outlier detection technique for wireless sensor networks using unsupervised quarter-sphere support vector machine

Proceedings of the International Conference on Intelligent Sensors, Sensor Networks and Information Processing (ISSNIP' 08)

December 2008

151 156

10.1109/issnip.2008.4761978

2-s2.0-63149149520

O'Reilly

Gluhak

Imran

Rajasegarar

Online anomaly rate parameter tracking for anomaly detection in wireless sensor networks

Proceedings of the 9th Annual IEEE Communications Society Conference on Sensor, Mesh and Ad Hoc Communications and Networks (SECON ’12)

June 2012

Seoul, Korea

191 199

10.1109/secon.2012.6275776

2-s2.0-84867967519

Laskov

Schafer

Kotenko

Intrusion detection in unlabeled data with quarter sphere support vector machines

Detection of Intrusions and Malware & Vulnerability Assessment 2004

Dortmund

Zhang

Meratnia

Havinga

P. J. M.

Outlier detection techniques for wireless sensor network: a survey

2008

University of Twente

Schölkopf

Platt

J. C.

Shawe-Taylor

Smola

A. J.

Williamson

R. C.

Estimating the support of a high-dimensional distribution

Journal of Neural Computation 2001 13 7 1443 1471

10.1162/089976601750264965

2-s2.0-0000487102

Tax

D. M. J.

Duin

R. P. W.

Support vector data description

Journal of Machine Learning 2004 54 1 45 66

10.1023/b:mach.0000008084.60811.49

2-s2.0-0942266514

Campbell

Bennett

K. P.

A linear programming approach to novelty detection

Advances in Neural Information Processing Systems 2001 14 395 401

10.

Rajasegarar

Leckie

Palaniswami

Bezdek

J. C.

Quarter sphere based distributed anomaly detection in wireless sensor networks

Proceedings of the IEEE International Conference on Communications (ICC ′07)

June 2007

3864 3869

10.1109/icc.2007.637

2-s2.0-38549109147

11.

Zhang

Meratnia

Havinga

P. J. M.

Ensuring high sensor data quality through use of online outlier detection techniques

International Journal of Sensor Networks 2010 7 3 141 151

10.1504/IJSNET.2010.033116

2-s2.0-79960480833

12.

Rajasegarar

Leckie

Bezdek

J. C.

Palaniswami

Centered hyperspherical and hyperellipsoidal one-class support vector machines for anomaly detection in sensor networks

IEEE Transactions on Information Forensics and Security 2010 5 3 518 533

10.1109/tifs.2010.2051543

2-s2.0-77955684744

13.

Schölkopf

Smola

A. J.

Müller

K.-R.

Nonlinear component analysis as a kernel eigenvalue problem

Neural Computation 1998 10 5 1299 1319

10.1162/089976698300017467

2-s2.0-0347243182

14.

Hoare

C. A. R.

Algorithm 65: find

Communications of the ACM 1961 4 7 321 322

10.1145/366622.366647

15.

http://sensorscope.epfl.ch/index.php/MainPage

16.

Zhang

Meratnia

Havinga

Adaptive and online one-class support vector machine-based outlier detection techniques for wireless sensor networks

Proceedings of the International Conference on Advanced Information Networking and Applications Workshops (WAINA ′09)

May 2009

990 995

10.1109/waina.2009.200

2-s2.0-70350130114