Anomaly detection is an important problem that has been researched within diverse research areas and application domains. Many anomaly detection techniques have been specifically developed for certain application domains, while others are more generic. This survey tries to provide a structured and comprehensive overview of the research on anomaly detection. We have grouped existing techniques into different categories based on the underlying approach adopted by each technique. For each category we have identified key assumptions, which are used by the techniques to differentiate between normal and anomalous behavior. When applying a given technique to a particular domain, these assumptions can be used as guidelines to assess the effectiveness of the technique in that domain. For each category, we provide a basic anomaly detection technique, and then show how the different existing techniques in that category are variants of the basic technique. This template provides an easier and more succinct understanding of the techniques belonging to each category. Further, for each category, we identify the advantages and disadvantages of the techniques in that category. We also provide a discussion on the computational complexity of the techniques since it is an important issue in real application domains. We hope that this survey will provide a better understanding of the different directions in which research has been done on this topic, and how techniques developed in one area can be applied in domains for which they were not intended to begin with.

/pdf/anomaly-detection-a-survey-1x33g9m0a3.pdf

Anomaly detection: A survey

https://www.robots.ox.ac.uk/~davidc/pubs/NDreview2014.pdf

Review: A review of novelty detection

An electronic device with a display and a fingerprint sensor may authenticate a user for a respective function. While a respective function of the device is in a locked state, the device displays a graphical element on the display, the graphical element indicating a first direction of finger movement that enables unlocking of the respective function. While displaying the graphical element, the device detects an input that includes movement of a finger in the first direction over the fingerprint sensor and determines whether the input meets unlock criteria based at least in part on fingerprint information of the finger detected by the fingerprint sensor during the input. In accordance with a determination that the input meets the unlock criteria, the device unlocks the respective function; and in accordance with a determination that the input does not meet the unlock criteria, the device maintains the respective function in the locked state.

Embedded authentication systems in an electronic device

Though research on the Semantic Web has progressed at a steady pace, its promise has yet to be realized. One major difficulty is that, by its very nature, the Semantic Web is a large, uncensored system to which anyone may contribute. This raises the question of how much credence to give each source. We cannot expect each user to know the trustworthiness of each source, nor would we want to assign top-down or global credibility values due to the subjective nature of trust. We tackle this problem by employing a web of trust, in which each user maintains trusts in a small number of other users. We then compose these trusts into trust values for all other users. The result of our computation is not an agglomerate "trustworthiness" of each user. Instead, each user receives a personalized set of trusts, which may vary widely from person to person. We define properties for combination functions which merge such trusts, and define a class of functions for which merging may be done locally while maintaining these properties. We give examples of specific functions and apply them to data from Epinions and our BibServ bibliography server. Experiments confirm that the methods are robust to noise, and do not put unreasonable expectations on users. We hope that these methods will help move the Semantic Web closer to fulfilling its promise.

Trust management for the Semantic Web

Traditional trust management schemes developed for wired and wireless ad hoc networks are not well suited for sensor networks due to their higher consumption of resources such as memory and power. In this work, we propose a new lightweight group-based trust management scheme (GTMS) for wireless sensor networks, which employs clustering. Our approach reduces the cost of trust evaluation. Also, theoretical as well as simulation results show that our scheme demands less memory, energy, and communication overheads as compared to the current state-of-the-art trust management schemes and it is more suitable for large-scale sensor networks. Furthermore, GTMS also enables us to detect and prevent malicious, selfish, and faulty nodes.

Group-Based Trust Management Scheme for Clustered Wireless Sensor Networks

Ubiquitous computing foresees a massively networked world supporting a population of diverse but cooperating mobile devices where trust relationships between entities are uncertain. Though there have been lots of effort focusing on trust for ubiquitous systems, they did not attach enough importance to uncertainty in their model. On the other hand, most of the works draw a general picture without a detailed computational model. In this paper, we present a trust model based on the vectors of trust values of different entities. The evaluation of trust depends upon the recommendation of peer entities common to the interacting entities. These recommendations are weighted according to the number and time of past interactions. Furthermore we present a method of handling false recommendations without introducing significant computational burden. The model can calculate trust between two entities in situations both in which there is past experience among the interacting entities and in which the two entities are communicating for the first time. Several tuning parameters are suggested which can be adjusted to meet the security requirement of a ubiquitous system.

/pdf/a-trust-model-for-ubiquitous-systems-based-on-vectors-of-1uknr84fbx.pdf

A trust model for ubiquitous systems based on vectors of trust values

Important applications of Wireless Ad Hoc Networks make them very attractive to attackers, therefore more research is required to guarantee the security for Wireless Ad Hoc Networks. In this paper, we proposed a transmission time based mechanism (TTM) to detect wormhole attacks - one of the most popular & serious attacks in Wireless Ad Hoc Networks. TTM detects wormhole attacks during route setup procedure by computing transmission time between every two successive nodes along the established path. Wormhole is identified base on the fact that transmission time between two fake neighbors created by wormhole is considerably higher than that between two real neighbors which are within radio range of each other. TTM has good performance, little overhead and no special hardware required. TTM is designed specifically for Ad Hoc On-Demand Vector Routing Protocol (AODV) but it can be extended to work with other routing protocols.

/pdf/ttm-an-efficient-mechanism-to-detect-wormhole-attacks-in-38s053gkn4.pdf

TTM: An Efficient Mechanism to Detect Wormhole Attacks in Wireless Ad-hoc Networks

Context-based access control is an emerging approach for modeling adaptive solution, making access control management more flexible and powerful. But in the ubiquitous environment, this approach is not enough for many emerging security vulnerabilities. Thus, improving current access control mechanisms is still necessary. Risk is an effective tool used for decision-making in economics. In this paper, we design a new model for risk assessment in ubiquitous environment and use risk as a key component in decision-making process in our access control model. This solution makes access control management more dynamic and precise

/pdf/enforcing-access-control-using-risk-assessment-3yfyi78co4.pdf

Enforcing Access Control Using Risk Assessment

Wireless sensor networks (WSNs) consisting of thousands of sensor nodes have many potential applications nowadays from temperature, light monitoring in a smart house to detecting enemy’s movement in a battle field. In most cases, sensor networks are deployed in open and unprotected environments so it is very attractive to adversaries. Although some preventive mechanisms were proposed and installed, they do not guarantee the security of sensor networks one hundred percent. Thus, it is necessary to have some mechanisms of intrusion detection as a second protecting wall to prevent intruders from causing damages to the networks.

An anomaly detection algorithm for detecting attacks in wireless sensor networks

Ubiquitous Life Care (u-Life care) nowadays becomes more attractive to computer science researchers due to a demand on a high quality and low cost of care services at anytime and anywhere. Many works exploit sensor networks to monitor patient's health status, movements, and real-time daily life activities to provide care services to them. Context information with real-time daily life activities can help in better services, service suggestions, and change in system behavior for better healthcare. Our proposed Secured Wireless Sensor Network - integrated Cloud Computing for ubiquitous - Life Care (SC3) monitors human health as well as activities. In this paper we focus on Human Activity Recognition Engine (HARE) framework architecture, backbone of SC3 and discussed it in detail. Camera-based and sensor-based activity recognition engines are discussed in detail along with the manipulation of recognized activities using Context-aware Activity Manipulation Engine (CAME) and Intelligent Life Style Provider (i-LiSP). Preliminary results of CAME showed robust and accurate response to medical emergencies. We have deployed five different activity recognition engines on Cloud to identify different set of activities of Alzheimer's disease patients.

Le Xuan Hung

Papers

A trust model for ubiquitous systems based on vectors of trust values

TTM: An Efficient Mechanism to Detect Wormhole Attacks in Wireless Ad-hoc Networks

Enforcing Access Control Using Risk Assessment

An anomaly detection algorithm for detecting attacks in wireless sensor networks

Context-aware Human Activity Recognition and decision making