Meta-Morisita Index: Anomaly Behaviour Detection for Large Scale Tracking Data with Spatio-Temporal Marks

Abstract

In this paper, we propose a work flow for processing and analysing large-scale tracking data with spatio-temporal marks that uses an infrastructure for machine learning methods based on a meta-data representation of point patterns. The tracking log (IP address) of cyber security devices usually maps to geolocation and timestamp, such data is called spatiotemporal data. Existing spatio-temporal analysis methods do not include a specific mechanism for analysing meta-data (point pattern information) generated from large-scale tracking data with spatio-temporal marks. In this work, we extend a spatial point pattern analysis method (the Morisita Index) with metadata analysis, which includes anomaly behaviour detection and unsupervised learning to support spatio-temporal data analysis (on both physical and cyber data) and demonstrate its practical use. The resulting work flow has a robust capability to detect anomalies among large-scale tracking data with spatio-temporal marks using meta-data based on point pattern analysis and returns visualized reports to end users.