Showing papers on "Change detection published in 2006"

A novel approach to detection of intrusions in computer networks via adaptive sequential and batch-sequential change-point detection methods

Abstract: Large-scale computer network attacks in their final stages can readily be identified by observing very abrupt changes in the network traffic. In the early stage of an attack, however, these changes are hard to detect and difficult to distinguish from usual traffic fluctuations. Rapid response, a minimal false-alarm rate, and the capability to detect a wide spectrum of attacks are the crucial features of intrusion detection systems. In this paper, we develop efficient adaptive sequential and batch-sequential methods for an early detection of attacks that lead to changes in network traffic, such as denial-of-service attacks, worm-based attacks, port-scanning, and man-in-the-middle attacks. These methods employ a statistical analysis of data from multiple layers of the network protocol to detect very subtle traffic changes. The algorithms are based on change-point detection theory and utilize a thresholding of test statistics to achieve a fixed rate of false alarms while allowing us to detect changes in statistical models as soon as possible. There are three attractive features of the proposed approach. First, the developed algorithms are self-learning, which enables them to adapt to various network loads and usage patterns. Secondly, they allow for the detection of attacks with a small average delay for a given false-alarm rate. Thirdly, they are computationally simple and thus can be implemented online. Theoretical frameworks for detection procedures are presented. We also give the results of the experimental study with the use of a network simulator testbed as well as real-life testing for TCP SYN flooding attacks

Generalized minimum-error thresholding for unsupervised change detection from SAR amplitude imagery

Abstract: The availability of synthetic aperture radar (SAR) data offers great potential for environmental monitoring due to the insensitiveness of SAR imagery to atmospheric and sunlight-illumination conditions. In addition, the short revisit time provided by future SAR-based missions will allow a huge amount of multitemporal SAR data to become systematically available for monitoring applications. In this paper, the problem of detecting the changes that occurred on the ground by analyzing SAR imagery is addressed by a completely unsupervised approach, i.e., by developing an automatic thresholding technique. The image-ratioing approach to SAR change detection is adopted, and the Kittler and Illingworth minimum-error thresholding algorithm is generalized to take into account the non-Gaussian distribution of the amplitude values of SAR images. In particular, a SAR-specific parametric modeling approach for the ratio image is proposed and integrated into the thresholding process. Experimental results, which confirm the accuracy of the method for real X-band SAR and spaceborne imaging radar C-band images, are presented

Multiple support vector machines for land cover change detection: An application for mapping urban extensions

Abstract: The reliability of support vector machines for classifying hyper-spectral images of remote sensing has been proven in various studies. In this paper, we investigate their applicability for land cover change detection. First, SVM-based change detection is presented and performed for mapping urban growth in the Algerian capital. Different performance indicators, as well as a comparison with artificial neural networks, are used to support our experimental analysis. In a second step, a combination framework is proposed to improve change detection accuracy. Two combination rules, namely, Fuzzy Integral and Attractor Dynamics, are implemented and evaluated with respect to individual SVMs. Recognition rates achieved by individual SVMs, compared to neural networks, confirm their efficiency for land cover change detection. Furthermore, the relevance of SVM combination is highlighted.

A unifying framework for detecting outliers and change points from time series

Abstract: We are concerned with the issue of detecting outliers and change points from time series. In the area of data mining, there have been increased interest in these issues since outlier detection is related to fraud detection, rare event discovery, etc., while change-point detection is related to event/trend change detection, activity monitoring, etc. Although, in most previous work, outlier detection and change point detection have not been related explicitly, this paper presents a unifying framework for dealing with both of them. In this framework, a probabilistic model of time series is incrementally learned using an online discounting learning algorithm, which can track a drifting data source adaptively by forgetting out-of-date statistics gradually. A score for any given data is calculated in terms of its deviation from the learned model, with a higher score indicating a high possibility of being an outlier. By taking an average of the scores over a window of a fixed length and sliding the window, we may obtain a new time series consisting of moving-averaged scores. Change point detection is then reduced to the issue of detecting outliers in that time series. We compare the performance of our framework with those of conventional methods to demonstrate its validity through simulation and experimental applications to incidents detection in network security.

Detection of multiple change-points in multivariate time series

Abstract: We consider the multiple change-point problem for multivariate time series, including strongly dependent processes, with an unknown number of change-points. We assume that the covariance structure of the series changes abruptly at some unknown common change-point times. The proposed adaptive method is able to detect changes in multivariate i.i.d., weakly and strongly dependent series. This adaptive method outperforms the Schwarz criteria, mainly for the case of weakly dependent data. We consider applications to multivariate series of daily stock indices returns and series generated by an artificial financial market.

Robust detection and classification of longitudinal changes in color retinal fundus images for monitoring diabetic retinopathy

Abstract: A fully automated approach is presented for robust detection and classification of changes in longitudinal time-series of color retinal fundus images of diabetic retinopathy. The method is robust to: 1) spatial variations in illumination resulting from instrument limitations and changes both within, and between patient visits; 2) imaging artifacts such as dust particles; 3) outliers in the training data; 4) segmentation and alignment errors. Robustness to illumination variation is achieved by a novel iterative algorithm to estimate the reflectance of the retina exploiting automatically extracted segmentations of the retinal vasculature, optic disk, fovea, and pathologies. Robustness to dust artifacts is achieved by exploiting their spectral characteristics, enabling application to film-based, as well as digital imaging systems. False changes from alignment errors are minimized by subpixel accuracy registration using a 12-parameter transformation that accounts for unknown retinal curvature and camera parameters. Bayesian detection and classification algorithms are used to generate a color-coded output that is readily inspected. A multiobserver validation on 43 image pairs from 22 eyes involving nonproliferative and proliferative diabetic retinopathies, showed a 97% change detection rate, a 3 % miss rate, and a 10% false alarm rate. The performance in correctly classifying the changes was 99.3%. A self-consistency metric, and an error factor were developed to measure performance over more than two periods. The average self consistency was 94% and the error factor was 0.06%. Although this study focuses on diabetic changes, the proposed techniques have broader applicability in ophthalmology.

Unsupervised change detection on SAR images using fuzzy hidden Markov chains

Abstract: This work deals with unsupervised change detection in temporal sets of synthetic aperture radar (SAR) images. We focus on one of the most widely used change detector in the SAR context, the so-called log-ratio. In order to deal with the classification issue, we propose to use a new fuzzy version of hidden Markov chains (HMCs), and thus to address fuzzy change detection with a statistical approach. The main characteristic of the proposed model is to simultaneously use Dirac and Lebesgue measures at the class chain level. This allows the coexistence of hard pixels (obtained with the classical HMC segmentation) and fuzzy pixels (obtained with the fuzzy measure) in the same image. The quality assessment of the proposed method is achieved with several bidate sets of simulated images, and comparisons with classical HMC are also provided. Experimental results on real European Remote Sensing 2 Precision Image (ERS-2 PRI) images confirm the effectiveness of the proposed approach.

Change Detection of Multitemporal SAR Data in Urban Areas Combining Feature-Based and Pixel-Based Techniques

Abstract: In this paper, the problem of change detection from synthetic aperture radar (SAR) images is addressed. Feature-level change-detection algorithms are still in their preliminary design stage. Indeed, while pixel-based approaches are already implemented into existing, commercial software, this is not the case for feature comparison approaches. Here, the authors propose a joint use of both approaches. The approach is based on the extraction and comparison of linear features from multiple SAR images, to confirm pixel-based changes. Though simple, the methodology proves to be effective, irrespectively of misregistration errors due to reprojection problems or difference in the sensor's viewing geometry, which are common in multitemporal SAR images. The procedure is validated through synthetic examples, but also two real change-detection situations, using airborne and satellite SAR data over the area of the Getty Museum, Los Angeles, as well as over an area around the city of Bam, Iran, stricken in 2003 by a serious earthquake

Coherent Change Detection: Theoretical Description and Experimental Results

Abstract: : This report investigates techniques for detecting fine scale scene changes using repeat pass Synthetic Aperture Radar (SAR) imagery As SAR is a coherent imaging system two forms of change detection may be considered, namely incoherent and coherent change detection Incoherent change detection identifies changes in the mean backscatter power of a scene typically via an average intensity ratio change statistic Coherent change detection on the other hand, identifies changes in both the amplitude and phase of the transduced imagery using the sample coherence change statistic Coherent change detection thus has the potential to detect very subtle scene changes to the sub-resolution cell scattering structure that may be undetectable using incoherent techniques The repeat pass SAR imagery however, must be acquired and processed interferometrically This report examines the processing steps required to form a coherent image pair and describes an interferometric spotlight SAR processor for processing repeat pass collections acquired with DSTO Ingara X-band SAR The detection performance of the commonly used average intensity ratio and sample coherence change statistics are provided as well as the performance of a recently proposed log likelihood change statistic The three change statistics are applied to experimental repeat pass SAR data to demonstrate the relative performance of the change statistics

Change detection of multitemporal SAR data in urban areas combining feature-based and pixel-based techniques

Abstract: In this paper, the problem of change detection from synthetic aperture radar (SAR) images is addressed. Feature-level change-detection algorithms are still in their preliminary design stage. Indeed, while pixel-based approaches are already implemented into existing, commercial software, this is not the case for feature comparison approaches. Here, the authors propose a joint use of both approaches. The approach is based on the extraction and comparison of linear features from multiple SAR images, to confirm pixel-based changes. Though simple, the methodology proves to be effective, irrespectively of misregistration errors due to reprojection problems or difference in the sensor's viewing geometry, which are common in multitemporal SAR images. The procedure is validated through synthetic examples, but also two real change-detection situations, using airborne and satellite SAR data over the area of the Getty Museum, Los Angeles, as well as over an area around the city of Bam, Iran, stricken in 2003 by a serious earthquake.

Sequential change-point detection when unknown parameters are present in the pre-change distribution

Abstract: In the sequential change-point detection literature, most research specifies a required frequency of false alarms at a given pre-change distribution f_θ and tries to minimize the detection delay for every possible post-change distribution g_λ. In this paper, motivated by a number of practical examples, we first consider the reverse question by specifying a required detection delay at a given post-change distribution and trying to minimize the frequency of false alarms for every possible pre-change distribution f_θ. We present asymptotically optimal procedures for one-parameter exponential families. Next, we develop a general theory for change-point problems when both the pre-change distribution f_θ and the post-change distribution g_λ involve unknown parameters. We also apply our approach to the special case of detecting shifts in the mean of independent normal observations.

Detecting scene changes using synthetic aperture Radar interferometry

Abstract: In repeat-pass interferometric synthetic aperture radar (SAR), man-made scene disturbances are commonly detected by identifying changes in the mean backscatter power of the scene or by identifying regions of low coherence. Change statistics such as the sample mean backscatter-power ratio and the sample coherence, however, are susceptible to high false-alarm rates unless the change in the mean backscatter power is large or there is sufficient contrast in scene coherence between the changed and unchanged regions of the image pair. Furthermore, as the sample mean backscatter-power ratio and sample coherence measure different properties of a SAR image pair, both change statistics need to be considered to properly characterize scene changes. In this paper, models describing the changed and unchanged regions of a scene are postulated, and the detection problem is expressed in a Bayesian hypothesis-testing framework. Forming the log-likelihood ratio gives a single sufficient statistic, encoding changes in both the coherence and the mean backscatter power, for discriminating between the unchanged- and changed-scene models. The theoretical detection performance of the change statistic is derived and shows a significant improvement over both the sample mean backscatter-power ratio and sample coherence change statistics. Finally, the superior detection performance of the log-likelihood change statistic is demonstrated using experimental data collected using the Defence Science and Technology Organisation's Ingara X-band airborne SAR

A Hopfield Neural Network for Image Change Detection

Abstract: This paper outlines an optimization relaxation approach based on the analog Hopfield neural network (HNN) for solving the image change detection problem between two images. A difference image is obtained by subtracting pixel by pixel both images. The network topology is built so that each pixel in the difference image is a node in the network. Each node is characterized by its state, which determines if a pixel has changed. An energy function is derived, so that the network converges to stable states. The analog Hopfield's model allows each node to take on analog state values. Unlike most widely used approaches, where binary labels (changed/unchanged) are assigned to each pixel, the analog property provides the strength of the change. The main contribution of this paper is reflected in the customization of the analog Hopfield neural network to derive an automatic image change detection approach. When a pixel is being processed, some existing image change detection procedures consider only interpixel relations on its neighborhood. The main drawback of such approaches is the labeling of this pixel as changed or unchanged according to the information supplied by its neighbors, where its own information is ignored. The Hopfield model overcomes this drawback and for each pixel allows a tradeoff between the influence of its neighborhood and its own criterion. This is mapped under the energy function to be minimized. The performance of the proposed method is illustrated by comparative analysis against some existing image change detection methods

Automatic identification of the number and values of decision thresholds in the log-ratio image for change detection in SAR images

Abstract: In this letter, we propose an extension of an automatic and unsupervised change-detection method for synthetic aperture radar images we presented earlier. By analyzing a properly defined cost function, the proposed method allows the automatic detection of the number (zero, one, or two) and the values of the decision thresholds associated with changes (if any) in the log-ratio image. This cost function is the minimum value of the criterion function adopted to select the decision threshold in the log-ratio image according to a modified double-thresholding Kittler-Illingworth algorithm (implemented under the generalized Gaussian assumption for changed and unchanged classes). Experimental results carried out both on real and simulated multitemporal synthetic aperture radar images proved the effectiveness of the proposed automatic method in detecting both the number of changes to be identified (the situation of no changes is also explicitly identified) and the related threshold values

Adaptive Change Detection in Heart Rate Trend Monitoring in Anesthetized Children

Abstract: The proposed algorithm is designed to detect changes in the heart rate trend signal which fits the dynamic linear model description. Based on this model, the interpatient and intraoperative variations are handled by estimating the noise covariances via an adaptive Kalman filter. An exponentially weighted moving average predictor switches between two different forgetting coefficients to allow the historical data to have a varying influence in prediction. The cumulative sum testing of the residuals identifies the change points online. The algorithm was tested on a substantial volume of real clinical data. Comparison of the proposed algorithm with Trigg's approach revealed that the algorithm performs more favorably with a shorter delay. The receiver operating characteristic curve analysis indicates that the algorithm outperformed the change detection by clinicians in real time

A challenge problem for detection of targets in foliage

Abstract: This paper describes a challenge problem whose scope is detection of stationary vehicles in foliage using VHF-band SAR data. The data for this challenge problem consists of images collected by the Swedish CARABAS-II system which produces SAR images at the low VHF-band (20-90 MHz). At these frequencies the electromagnetic energy from the radar penetrates the foliage of the forest, providing a return from a target concealed in a forest. Thus, VHF-band SAR technology transforms the foliage penetration problem into a traditional detection problem where the goal is to reduce the false alarm rate (FAR). Reducing the FAR requires suppressing the clutter in a VHF-band SAR image which is dominated by larger tree trunks, buildings and other man-made objects. The purpose of releasing the CARABAS-II data set is to provide the community with VHF-band SAR data that supports development of new algorithms for robust target detection with a low false alarm rate. The set of images supports single-pass, two-pass and multi-pass target detection.

Proposed Framework for Anomalous Change Detection

Abstract: For the anomalous change detection problem, you have a pair of images, taken of the same scene, but at difierent times and typically under difierent viewing conditions. You are looking for interesting difierences between the two images. There will be some difierences thatarepervasive,perhapsduetooverall contrast, brightness or focus difierences, or maybe due to atmospheric or even seasonal changes { but there may also be changes that occur in only a few pixels. These rare changes are potentially indicative of something truly changinginthescene,andtheideaisto

Markovian Fusion Approach to Robust Unsupervised Change Detection in Remotely Sensed Imagery

Abstract: The most common methodology to carry out an automatic unsupervised change detection in remotely sensed imagery is to find the best global threshold in the histogram of the so-called difference image. The unsupervised nature of the change detection process, however, makes it nontrivial to find the most appropriate thresholding algorithm for a given difference image, because the best global threshold depends on its statistical peculiarities, which are often unknown. In this letter, a solution to this issue based on the fusion of an ensemble of different thresholding algorithms through a Markov random field framework is proposed. Experiments conducted on a set of five real remote sensing images acquired by different sensors and referring to different kinds of changes show the high robustness of the proposed unsupervised change detection approach

Real-time crowd density estimation from video

Abstract: A system and method for automated and/or semi-automated analysis of video for discerning patterns of interest in video streams. In a preferred embodiment, the present invention is directed to identifying patterns of interest in indoor settings. In one aspect, the present invention deals with the change detection problem using a Markov Random Field approach where information from different sources are naturally combined with additional constraints to provide the final detection map. A slight modification is made of the regularity term within the MRF model that accounts for real-discontinuities in the observed data. The defined objective function is implemented in a multi-scale framework that decreases the computational cost and the risk of convergence to local minima. To achieve real-time performance, fast deterministic relaxation algorithms are used to perform the minimization. The crowdedness measure used is a geometric measure of occupancy that is quasi-invariant to objects translating on the platform.

Problem Determination in Enterprise Middleware Systems using Change Point Correlation of Time Series Data

Abstract: Clustered enterprise middleware systems employing dynamic workload scheduling are susceptible to a variety of application malfunctions that can manifest themselves in a counterintuitive fashion and cause debilitating damage. Until now, diagnosing problems in that domain involves investigating log files and configuration settings and requires in-depth knowledge of the middleware architecture and application design. This paper presents a method for problem determination using change point detection techniques and problem signatures consisting of a combination of changes (or absence of changes) in different metrics. We implemented this approach on a clustered middleware system and applied it to the detection of the storm drain condition: a debilitating problem encountered in clustered systems with counterintuitive symptoms. Our experimental results show that the system detects 93% of storm drain faults with no false positives.

A Novel Method for Mapping Land Cover Changes: Incorporating Time and Space With Geostatistics

Abstract: Landsat data are now available for more than 30 years, providing the longest high-resolution record of Earth monitoring. This unprecedented time series of satellite imagery allows for extensive temporal observation of terrestrial processes such as land cover and land use change. However, despite this unique opportunity, most existing change detection techniques do not fully capitalize on this long time series. In this paper, a method that exploits both the temporal and spatial domains of time series satellite data to map land cover changes is presented. The time series of each pixel in the image is modeled with a combination of: 1) pixel-specific remotely sensed data; 2) neighboring pixels derived from ground observation data; and 3) time series transition probabilities. The spatial information is modeled with variograms and integrated using indicator kriging; time series transition probabilities are combined using an information-based cascade approach. This results in a map that is significantly more accurate in identifying when, where, and what land cover changes occurred. For the six images used in this paper, the prediction accuracy of the time series improves significantly, increasing from 31% to 61%, when both space and time are considered with the maximum likelihood. The consideration of spatial continuity also reduced unwanted speckles in the classified images, removing the need for any postprocessing. These results indicate that combining space and time domains significantly improves the accuracy of temporal change detection analyses and can produce high-quality time series land cover maps

Interference from filled delays on visual change detection.

Abstract: Failure to detect changes to salient visual input across a brief interval has popularized the use of change detection, a paradigm that plays important roles in recent studies of visual perception, short-term memory, and consciousness. Much research has focused on the nature of visual representation for the pre- and postchange displays, yet little is known about how visual change detection is interfered with by events inserted between the pre- and postchange displays. To address this question, we tested change detection of colors, spatial locations, and natural scenes, when the interval between changes was (1) blank, (2) filled with a visual scene, or (3) filled with an auditory word. Participants were asked to either ignore the filled visual or auditory event or attend to it by categorizing it as animate or inanimate. Results showed that the ability to detect visual changes was dramatically impaired by attending to a secondary task during the delay. This interference was significant for auditory as well as for visual interfering events and was invariant to the complexity of the prechange displays. Passive listening produced no interference, whereas passive viewing produced small but significant interference. We conclude that visual change detection relies significantly on central, amodal attention.