Unsupervised anomaly detection in underwater acoustic sensor networks

Abstract

An underwater acoustic sensor network (UASN) offers a promising solution for the exploration of underwater resources remotely. As the UASN acoustic channel is open and the environment is hostile, the risk of malicious activities is very high, particularly in time-critical military applications. In this paper, we propose an unsupervised anomaly detection system by learning the social behavioral correlation among nodes. The location data retrieved from sensors are learned using long short term memory (LSTM) networks to capture the anomalous nature. The network is simulated by modeling anomalies and analyzed the performance. The analysis of results indicates that the anomaly detection system offers an acceptable accuracy with high true positive rate and F-Score by showing consistency in multiple mobility behavior.

Keywords

Underwater sensor networks time series analysis anomaly detection long shot term memory network

1 Introduction

The growing need of ocean exploration demands the development of the smart underwater acoustic sensor network(UASN). A typical UASN consists of a floating gateway node, and a set of sensors. The sensor nodes deployed in underwater is responsible for environmental sensing and data collection. These sensor nodes communicate with the floating gateway node to transfer sensed data through the acoustic channel. The gateway node forwards these data packets to the remote control station for further processing and interpretation [1]. This type of sensor networks have a wide variety of applications ranging from pollution monitoring to military surveillance.

Practically, UASN is highly energy constraint that in turn become vulnerable to faults and malicious activities. Because of its isolated and hostile domain nature, an adversary can easily interrupt through the unsecured acoustic channel [2 –4]. Also, in UASN enabled IoT applications, security and privacy are key requirements. Moreover, operations like routing and localization depend on freshness and integrity of data. In large networks, forwarding and processing the erroneous wrong location information results in wastage of energy and time. Thus, to ensure accurate and timely environmental sensing, authentication should be addressed. Since the significance of secure communication in UASN is very well discussed in the literature, security enabled network models and algorithms are hardly proposed [5 –8]. Specific to military applications, a terrorist can hack the network to inject false packets. So the gateway node should ensure the genuineness of each incoming packet from each sensor node before forwarding it to the remote control station. Hence, it is required to enable the gateway node of the UASN with a proper anomaly detection mechanism.

In this paper, we propose an unsupervised anomaly detection system by learning social behavioral correlation among nodes. The sequence of location coordinates of sensors are learned using long short term memory (LSTM) networks to capture the anomalous nature. The network is simulated using AquaSim simulator [9, 10] with anomalous packet transmissions and evaluated the performance of the detection system. We simulated the network, modeled anomalies and analyzed the performance. The experimental results showed the consistency of the detection system in multiple mobility behavior.

2 Related work

Even though the anomaly detection in terrestrial wireless sensor network is technically matured, most of the proposed solutions are application specific and suitable only when underlying data distribution is known. Those techniques cannot be applied to the UASN domain because the behavior of the network is completely different.

The security issues and challenges in building secure protocols of UASN are well discussed in the last few years [3, 8]. The impact of wormhole attacks in underwater communication are studied in [5 –7]. Mridula et al. discussed the uncertainty in anchor node based localization [11]. Dini and Duca [8] discussed the significance of enabling confidentiality and integrity in UASN routing, and proposed a secure communication suit. They also discussed the security issues in network discovery [12]. Ateniese et al. introduced security framework for secure routing in UASNs [13]. Das and Thampi [14] proposed a fuzzy logic based anomaly tracking system in the localization process of underwater sensor networks. Xu and Liu proposed a three tier security framework for UASN [15]. Shanti et al. introduced a probability based secure localization approach for UASN. The challenges in underwater communication and the need of a trust model is addressed by Han et al. [16]. Jiang et al. proposed a cloud based trust model for UASNs [17]. Most of the proposals are focused to either a specific security attack or a particular networking operation. The significance of checking the genuineness of each incoming packet, motivates us to design an anomaly detection system at the gateway node.

The inherent mobility characteristics of the UASN nodes should be considered in the design of the anomaly detection system so that computational complexity can be minimized with good accuracy level and less false alarms. Therefore, an unsupervised anomaly detection system is proposed which learns social behavioral correlation among sensor nodes in underwater.

3 Anomaly detection

The architecture of a typical UASN is shown in Fig. 1. The network is assumed to be having a gateway node and a set of sensor nodes geographically distributed and mobile in nature. The working of sensor nodes are in such a way that, each sensor node periodically transmits its sensed data along with location to the gateway node [1, 18].

Fig. 1

UASN architecture.

The anomaly detection system is meant to examines the abnormal behavior of packets. For each packet from sensor nodes, the gateway node checks its genuineness. Fig. 2 illustrates the steps involved in anomaly detection. It has two phases: prediction phase and detection phase. In prediction phase, the coordinates of the sensor node from where the packet is transmitted is predicted using an intelligent prediction engine. In the detection phase, the predicted location is compared with the actual values embedded in the packet. The gateway node forwards each data packet to the remote control station only when it is detected as non anomalous.

Fig. 2

Proposed Anomaly detection system: The location history of sensor nodes are passed to the prediction engine. The prediction engine predicts the coordinates of a sensor node by learning its past history and its social correlation with neighboring nodes.

3.1 Learning the behavior

The inconsistency of the received packet is examined using the location data retrieved from the packet. The variations in other packet-level parameters such as time-interval, the number of retransmissions, and packet collisions do not show a consistent behavior because of the hostile nature of the underwater environment. Also, retrieving and handling multiple packet-level parameters require high computational cost.

The gateway node accepts packets from all the sensor nodes that contain both sensed data and their location coordinates. The gateway node keeps track of the time series of location data of all the sensors along with their immediate neighbors. Table 1 shows the format of data stored in the gateway node at time ‘n’. The gateway node analyzes the behavior of sensors by learning history of coordinate data. Anomalies are detected by exploiting the time series prediction principles on these stored coordinate data. By deeply learning the past history, the location parameter (x_s, y_s) at time t_n+1 can be predicted.

Table 1
Data stored in gateway node

Time Node id Location Immediate neighbors

0 S ₀ (x_s0, y_s0) A set of S_i s

where, S_i∈{ S₀S₁, . . . , S_n }

⋮ ⋮ ⋮

S _n (x_sn, y_sn) A set of S_i s

where, S_i∈{ S₀S₁, . . . , S_n }

1 S ₀ (x_s0, y_s0) A set of S_i s

where, S_i∈{ S₀S₁, . . . , S_n }

⋮ ⋮ ⋮

S _n (x_sn, y_sn) A set of S_i s

where, S_i∈{ S₀S₁, . . . , S_n }

2 S ₀ (x_s0, y_s0) A set of S_i s

where, S_i∈{ S₀S₁, . . . , S_n }

⋮ ⋮ ⋮

S _n (x_sn, y_sn) A set of S_i s

where, S_i∈{ S₀S₁, . . . , S_n }

... ⋮ ⋮ ⋮

n S ₀ (x_s0, y_s0) A set of S_i s

where, S_i∈{ S₀S₁, . . . , S_n }

⋮ ⋮ ⋮

S _n (x_sn, y_sn) A set of S_i s

where, S_i∈{ S₀S₁, . . . , S_n }

Time	Node id	Location	Immediate neighbors
0	S ₀	(x_s0, y_s0)	A set of S_i s
			where, S_i∈{ S₀S₁, . . . , S_n }
	⋮	⋮	⋮
S _n	(x_sn, y_sn)	A set of S_i s
			where, S_i∈{ S₀S₁, . . . , S_n }
1	S ₀	(x_s0, y_s0)	A set of S_i s
			where, S_i∈{ S₀S₁, . . . , S_n }
	⋮	⋮	⋮
S _n	(x_sn, y_sn)	A set of S_i s
			where, S_i∈{ S₀S₁, . . . , S_n }
2	S ₀	(x_s0, y_s0)	A set of S_i s
			where, S_i∈{ S₀S₁, . . . , S_n }
	⋮	⋮	⋮
S _n	(x_sn, y_sn)	A set of S_i s
			where, S_i∈{ S₀S₁, . . . , S_n }
...	⋮	⋮	⋮
n	S ₀	(x_s0, y_s0)	A set of S_i s
			where, S_i∈{ S₀S₁, . . . , S_n }
	⋮	⋮	⋮
S _n	(x_sn, y_sn)	A set of S_i s
			where, S_i∈{ S₀S₁, . . . , S_n }

3.2 Social correlation among nodes

In UASN domain, sensor nodes exhibit a spatial correlation property [18, 19]. Figure 3 depicts the mobility behavior of 20 sensor nodes simulated for 500s in the Aqua-sim [10] simulator. The coordinates of a sensor node are positively correlated with the coordinates of its immediate neighbors. That means, the immediate neighboring nodes exhibit a similar mobility pattern.

Fig. 3

The plot of x-coordinate values of 20 sensor nodes simulated for 500s in Aqua-sim.

3.3 Prediction using LSTM Network

In UASN domain, mobility of an object is with respect to the water current. Hence, the location at a particular time t, (X_s(t), Y_s(t)) exhibits a temporal correlation with its lagged data (X_s(t-1), Y_s(t-1)). Therefore, it is possible to predict the future values of this time series data by observing the behavior of its previous values. The long short term memory networks are able to learn the behavior from time series sequence data to predict the subsequent future values. The sequence of X-coordinate and Y-coordinate are considered as independent time series X[t] and Y[t]. For each incoming packet, the coordinates are predicted using a two-step LSTM network model. Figure 4 depicts the high level view of the network model. The LSTM network model was trained using a single GPU machine with keras implementation.

Fig. 4

The coordinate history of sensor node Si and sensor node Sj (Si’s neighboring node) are inputs of the two step LSTM network model to learn the mobility behavior and social correlation.

3.4 Detection

The displacement between actual and predicted location is calculated using Euclidean principle. A threshold parameter θ is defined in such a way that, it represents the maximum vicinity a node can move after the last packet reception time. If the calculated displacement is greater than the predefined θ value, the packet is marked as anomalous. Else, identified as genuine packet and gateway node starts forwarding it to the control station. It is assumed that the maximum distance a sensor node can travel within that time duration can be predefine.

4 Experimental Results and Discussion

The performance of the anomaly detection scheme is evaluated by conducting simulation experiments.

4.1 Simulation settings

A network of 20 nodes is simulated in a 500 × 500 × 500m³ space using AquaSim simulator [10]. AquaSim is the simulator developed by UConn 1

¹
University of Connecticut

for the research and development of underwater sensor networks. Table 2 lists the simulation setup. The UASN network is simulated in such a way that sensor nodes send packets to gateway node at random intervals of time. The Bonn Motion [20] tool is used to model the mobility. The mobility trace generated is imported to AquaSim. The mobility model simulated is the reference point group mobility model (RPGM) [21] with two different mobility behavior. Mobility rate as 0.2 m/s and mobility rate varying from 0 to 1 m/s are simulated. The anomalous packets are modeled as random packets initiating at random intervals with certain random coordinate values.

Table 2

Simulation setup

Simulator: AquaSim
Communication channel	UnderWater channel
Attenuation model	Thorp’s attenuation
Communication range	100 m
Packet size	50 bytes
Mobility model	RPGM
Network Layer	Vector based forwarding
MAC	Broadcast mac
Bit rate	10 kbps
Frequency	25 kHz
Initial Energy	10000 J
Simulation time	500 s

The sequence of coordinate data generated is logged from trace file separately for training and prediction.

4.2 Results and discussion

The performance metrics used to evaluate the detection system are listed in Table 3. The true positive count is t_P, t_N represents the true negative count, f_P represents the count of false positives, and f_N is the count of false negatives. Results of detection system in two different mobility behavior is tested separately (Tables 4 and 5). In both cases, the system performs with good accuracy of 80% and 84% for 5 m displacement criteria. The results are compared with the fuzzy based anomaly tracking system [14] proposed for underwater localization (Fig 5). Our proposed approach shows significant improvement in accuracy and precision.

Fig. 5

Comparison with Fuzzy based anomaly detection [14].

Table 3

Performance measures

Metric	Calculation
Accuracy	$\frac{t_{P} + t_{N}}{t_{P} + t_{N} + f_{P} + f_{N}}$
Precision	$\frac{t_{P}}{t_{P} + f_{P}}$
True positive rate (TPR)	$\frac{t_{P}}{t_{P} + f_{N}}$
False positive rate (FPR)	$\frac{f_{P}}{f_{P} + t_{N}}$
F-Score	$2 * \frac{Precision * TPR}{Precision + TPR}$

4.2.1 The impact of θ

The value of θ plays an important role in the performance of the detection system. Therefore, we analyzed the behavior of the detection system with respect to θ by evaluating accuracy, precision, TPR, F-Score, and the ROC curve of the detection system for different θ values. Tables 4 and 5 shows the performance variation of detection algorithm with respect to θ. Figure 6 shows the ROC curve. The value of θ as 5m coverage shows comparatively acceptable accuracy level with high precision rate. In the case of 0 to 1 m/s RPGM mobility rate, θ as 5m provides the highest F-score with less false positive rate.

Fig. 6

The ROC curve of anomaly detection at the gateway node with different θ values.

Table 4

Performance of the detection system with different θ values (RPGM mobilty-0.2 m/s)

θ	Accuracy	Precision	TPR	FPR	F-score
(%)	(%)	(%)
5 m	0.8	1	0.75	0.0	0.857
10 m	0.8	1	0.75	0.0	0.857
20 m	0.88	1	0.85	0.0	0.919

Table 5

Performance of the detection system with different θ values (RPGM mobilty from 0 to 1 m/s)

θ	Accuracy	Precision	TPR	FPR	F-score
(%)	(%)	(%)
1 m	0.76	0.938	0.75	0.2	0.833
2 m	0.84	0.944	0.85	0.2	0.895
5 m	0.84	0.944	0.85	0.2	0.895
10 m	0.8	0.826	0.95	0.8	0.884
50 m	0.8	0.826	0.95	0.8	0.884

5 Conclusion

We proposed an unsupervised anomaly detection system by learning the social behavioral correlation among nodes. The location data retrieved from sensors are learned using long short term memory networks to capture the anomalous nature. We simulated the network using AquaSim, modeled anomalies and evaluated the performance. The network with different mobility behavior is simulated to analyze the consistency of the detection system. The results indicate that the anomaly detection system offers an acceptable accuracy with high true positive rate and F-Score by showing consistency in multiple mobility behavior.

The whole concept of anomaly detection is derived based on the spatial correlation property of underwater objects. Moreover, the complexity level analysis of detection schemes helps to observe the variations in network performance. The challenging domain properties of UASN are considered in the design of algorithms to make it scalable enough to build a trusted secure UASN platform in future.

References

A.P.

Das and

S.M.

Thampi , Single anchor node based localization in mobile underwater wireless sensor networks, in Algorithms and Architectures for Parallel Processing Springer, 2015, pp. 757–770.

Kong ,

Ji ,

Wang ,

Gerla ,

Bagrodia and

Bhargava , Low-cost attacks against packet delivery, localization and time synchronization services in under-water sensor networks, in Proceedings of the 4th ACM Workshop on Wireless Security ACM, 2005, pp. 87–96.

A.P.

Das and

S.M.

Thampi , Secure communication in mobile underwater wireless sensor networks, in Proceedings of the IEEE International Conference on Advances in Computing, Communications and Informatics, India, 2015, pp. 2164–2173.

Cong ,

Yang ,

Wei and

Zhou , Security in underwater sensor network, in Communications and Mobile Computing (CMC), 2010 International Conference on, vol. 1, 2010, pp. 162–168. IEEE.

Zhang and

Zhang , Wormhole-resilient secure neighbor discovery in underwater acoustic networks, in INFOCOM, 2010 Proceedings IEEE, 2010, pp. 1–9.

Wang ,

Kong ,

Bhargava and

Gerla , Visualisation of wormholes in underwater sensor networks: a distributed approach, International Journal of Security and Networks 3(1) (2008), 10–23.

Kong ,

Ji ,

Wang ,

Gerla ,

Bagrodia and

Bhargava , On wormhole attacks in under-water sensor networks: A two-tier localization approach, UCLA Computer Science Department Technical Report 4005 (2004).

Dini and

Lo Duca , A secure communication suite for underwater acoustic sensor networks, Sensors 12(11) (2012), 15133–15158.

A.P.

Das and

S.M.

Thampi , Simulation tools for underwater sensor networks: A survey, Network Protocols and Algorithms 8(4) (2016), 41–55.

10.

“Aqua-sim,” http://obinet.engr.uconn.edu/wiki/index.php/Aqua-Sim.

11.

Mridula and

Ameer , Localization under anchor node uncertainty for underwater acoustic sensor networks, International Journal of Communication Systems 31(2) (2018), e3445.

12.

Dini and

A.L.

Duca , Seflood: A secure network discovery protocol for underwater acoustic networks, in Computers and Communications (ISCC), 2011 IEEE Symposium on IEEE, 2011, pp. 636–638.

13.

Ateniese ,

Capossele ,

Gjanci ,

Petrioli and

Spaccini , Secfun: Security framework for underwater acoustic sensor networks, in OCEANS 2015-Genova IEEE, 2015, pp. 1–9.

14.

A.P.

Das and

S.M.

Thampi , Anomaly detection in uasn localization based on time series analysis and fuzzy logic, in Mobile Networks and Applications, in Press.

15.

Xu and

Liu , Sensevault: A three-tier framework for securing mobile underwater sensor networks, IEEE Transactions on Mobile Computing (2018).

16.

Han ,

Jiang ,

Shu and

Guizani , An attack-resistant trust model based on multidimensional trust metrics in underwater acoustic sensor network, IEEE Transactions on Mobile Computing 14(12) (2015), 2447–2459.

17.

Jiang ,

Han ,

Shu ,

Chan and

Wang , A trust model based on cloud theory in underwater acoustic sensor networks, IEEE Transactions on Industrial Informatics 13(1) (2017), 342–350.

18.

A.P.

Das and

S.M.

Thampi , Fault-resilient localization for underwater sensor networks, Ad Hoc Networks, 2016.

19.

Meiqin ,

Xiaodong and

Senlin , Localization based on best spatial correlation distance mobility prediction for underwater wireless sensor networks, in 34th Chinese Control Conference, Hangzhou, 2015, pp. 7827–7832.

20.

“Bonnmotion,” http://sys.cs.uos.de/bonnmotion/index.shtml.

21.

Pei ,

Gerla ,

Hong and

C.-C.

Chiang , A wireless hierarchical routing protocol with group mobility, in Proceedings of the IEEE Wireless Communications and Networking Conference, New Orleans, USA, 1999, pp.1538–1542.

Unsupervised anomaly detection in underwater acoustic sensor networks

Abstract

Keywords

1 Introduction

2 Related work

3 Anomaly detection

4 Experimental Results and Discussion

4.1 Simulation settings

1 University of Connecticut

References

¹
University of Connecticut