Machine learning algorithms for wireless sensor networks: A survey

Text categorization-assignment of natural language texts to one or more predefined categories based on their content-is an important component in many information organization and management tasks.Different automatic learning algorithms for text categori-zation have different classification accuracy.Very accurate text classifiers can be learned automatically from training examples.

Inductive learning algorithms and representations for text categorization

Nowadays, there is a huge and growing concern about security in information and communication technology among the scientific community because any attack or anomaly in the network can greatly affect many domains such as national security, private data storage, social welfare, economic issues, and so on. Therefore, the anomaly detection domain is a broad research area, and many different techniques and approaches for this purpose have emerged through the years. In this study, the main objective is to review the most important aspects pertaining to anomaly detection, covering an overview of a background analysis as well as a core study on the most relevant techniques, methods, and systems within the area. Therefore, in order to ease the understanding of this survey’s structure, the anomaly detection domain was reviewed under five dimensions: (1) network traffic anomalies, (2) network data types, (3) intrusion detection systems categories, (4) detection methods and systems, and (5) open issues. The paper concludes with an open issues summary discussing presently unsolved problems, and final remarks.

A comprehensive survey on network anomaly detection

Anomaly detection in high dimensional data is becoming a fundamental research problem that has various applications in the real world However, many existing anomaly detection techniques fail to retain sufficient accuracy due to so-called “big data” characterised by high-volume, and high-velocity data generated by variety of sources This phenomenon of having both problems together can be referred to the “curse of big dimensionality,” that affect existing techniques in terms of both performance and accuracy To address this gap and to understand the core problem, it is necessary to identify the unique challenges brought by the anomaly detection with both high dimensionality and big data problems Hence, this survey aims to document the state of anomaly detection in high dimensional big data by representing the unique challenges using a triangular model of vertices: the problem (big dimensionality), techniques/algorithms (anomaly detection), and tools (big data applications/frameworks) Authors’ work that fall directly into any of the vertices or closely related to them are taken into consideration for review Furthermore, the limitations of traditional approaches and current strategies of high dimensional data are discussed along with recent techniques and applications on big data required for the optimization of anomaly detection

/pdf/a-comprehensive-survey-of-anomaly-detection-techniques-for-kivhrp20d7.pdf

A comprehensive survey of anomaly detection techniques for high dimensional big data

Outlier detection is an important topic in machine learning and has been used in a wide range of applications. In this paper, we approach outlier detection as a binary-classification issue by sampling potential outliers from a uniform reference distribution. However, due to the sparsity of data in high-dimensional space, a limited number of potential outliers may fail to provide sufficient information to assist the classifier in describing a boundary that can separate outliers from normal data effectively. To address this, we propose a novel Single-Objective Generative Adversarial Active Learning (SO-GAAL) method for outlier detection, which can directly generate informative potential outliers based on the mini-max game between a generator and a discriminator. Moreover, to prevent the generator from falling into the mode collapsing problem, the stop node of training should be determined when SO-GAAL is able to provide sufficient information. But without any prior information, it is extremely difficult for SO-GAAL. Therefore, we expand the network structure of SO-GAAL from a single generator to multiple generators with different objectives (MO-GAAL), which can generate a reasonable reference distribution for the whole dataset. We empirically compare the proposed approach with several state-of-the-art outlier detection methods on both synthetic and real-world datasets. The results show that MO-GAAL outperforms its competitors in the majority of cases, especially for datasets with various cluster types or high irrelevant variable ratio. The experiment codes are available at: https://github.com/leibinghe/GAAL-based-outlier-detection .

Generative Adversarial Active Learning for Unsupervised Outlier Detection

Anomaly detection in a WSN is an important aspect of data analysis in order to identify data items that significantly differ from normal data. A characteristic of the data generated by a WSN is that the data distribution may alter over the lifetime of the network due to the changing nature of the phenomenon being observed. Anomaly detection techniques must be able to adapt to a non-stationary data distribution in order to perform optimally. In this survey, we provide a comprehensive overview of approaches to anomaly detection in a WSN and their operation in a non-stationary environment.

Anomaly detection in wireless sensor networks in a non-stationary environment

Principal component analysis and the residual error is an effective anomaly detection technique. In an environment where anomalies are present in the training set, the derived principal components can be skewed by the anomalies. A further aspect of anomaly detection is that data might be distributed across different nodes in a network and their communication to a centralized processing unit is prohibited due to communication cost. Current solutions to distributed anomaly detection rely on a hierarchical network infrastructure to aggregate data or models; however, in this environment, links close to the root of the tree become critical and congested. In this paper, an algorithm is proposed that is more robust in its derivation of the principal components of a training set containing anomalies. A distributed form of the algorithm is then derived where each node in a network can iterate towards the centralized solution by exchanging small matrices with neighboring nodes. Experimental evaluations on both synthetic and real-world data sets demonstrate the superior performance of the proposed approach in comparison to principal component analysis and alternative anomaly detection techniques. In addition, it is shown that in a variety of network infrastructures, the distributed form of the anomaly detection model is able to derive a close approximation of the centralized model.

/pdf/distributed-anomaly-detection-using-minimum-volume-1ft0sbkuly.pdf

Distributed Anomaly Detection Using Minimum Volume Elliptical Principal Component Analysis

Time series analysis aims to extract meaningful information from data that has been generated in sequence by a dynamic
process. The modelling of the non-linear dynamics of a signal is often performed using a linear space with a similarity
metric which is either linear or attempts to model the non-linearity of the data in the linear space. In this research, a
different approach is taken where the non-linear dynamics of the time series are represented using a phase space. Training
data is used to construct the phase space in which the data lies on or close to a lower-dimensional manifold. The basis
of the non-linear manifold is derived using the kernel principal components derived using kernel principal component
analysis where fewer components are retained in order to identify the lower-dimensional manifold. Data instances are
projected onto the manifold, and those with a large distance between the original point and the projection are considered
to be derived from a different underlying process. The proposed algorithm is able to perform time series classification
on univariate and multivariate data. Evaluations on a large number of real-world data sets demonstrate the accuracy of
the new algorithm and how it exceeds state-of-the-art performance.

Univariate and Multivariate Time Series Manifold Learning

Kernel principal component analysis and the reconstruction error is an effective anomaly detection technique for non-linear data sets. In an environment where a phenomenon is generating data that is non-stationary, anomaly detection requires a recomputation of the kernel eigenspace in order to represent the current data distribution. Recomputation is a computationally complex operation and reducing computational complexity is therefore a key challenge. In this paper, we propose an algorithm that is able to accurately remove data from a kernel eigenspace without performing a batch recomputation. Coupled with a kernel eigenspace update, we demonstrate that our technique is able to remove and add data to a kernel eigenspace more accurately than existing techniques. An adaptive version determines an appropriately sized sliding window of data and when a model update is necessary. Experimental evaluations on both synthetic and real-world data sets demonstrate the superior performance of the proposed approach in comparison to alternative incremental KPCA approaches and alternative anomaly detection techniques.

Adaptive Anomaly Detection with Kernel Eigenspace Splitting and Merging

Anomaly detection in a Wireless Sensor Network is an important aspect of data analysis in order to facilitate intrusion and event detection. A key challenge is creating optimal classifiers constructed from training sets in which the anomaly rates are varying due to the existence of non-stationary distributions in the data. In this paper we propose an adaptive algorithm that can dynamically adjust the anomaly rate parameter, which can be represented by a model parameter of a one-class quarter-sphere support vector machine. This algorithm operates in an online, iterative manner producing an optimal model for a training set, which is presented sequentially. Our evaluations demonstrate that our algorithm is capable of constructing optimal models for a training set that minimizes the error rate on the classification set compared to a static model, where the anomaly rate is kept stationary.

Colin O'Reilly

Papers

Anomaly detection in wireless sensor networks in a non-stationary environment

Distributed Anomaly Detection Using Minimum Volume Elliptical Principal Component Analysis

Univariate and Multivariate Time Series Manifold Learning

Adaptive Anomaly Detection with Kernel Eigenspace Splitting and Merging

Online anomaly rate parameter tracking for anomaly detection in wireless sensor networks