Abnormal Behavior Detection Research Articles

Approaches to the Construction of Behavioural Patterns of Information System Users

The paper describes the methodology of constructing models of typical user behaviour in a distributed information system, which may operate with sensitive data. The model is designed for the detection of abnormal behaviour occurring during the invasion of an intruder in the system. Also, the paper deals with the general approach to the implementation of the model infrastructure and algorithms of the main modules. Moreover, two possible methods for implementing the model in the target system are described.

From Identity Verification to Behavior Prediction: Ethical Implications of Second Generation Biometrics

AbstractIn this article, we will compare ethical issues raised by first and second generation biometrics. First generation biometrics use characteristics readily visible to the naked eye to ensure that the person identified is the person he claims to be, whereas second generation biometrics focus on behavioral patterns with the aim of predicting suspicious behavior or hostile intentions. While the collection of biometric features for identification is visible to the person involved, capturing biometric features from a distance may go unnoticed. Our study of a range of U.S. and European projects of second generation biometrics, particularly of Future Attribute Screening Technology and Automatic Detection of Abnormal Behaviour and Threats in crowded Spaces, shows that if data subjects are not aware of the processing of their data, and if behavioral patterns are interpreted without any knowledge of the subject's will and motives, there are risks of discrimination and stigmatization. Thus, second generation biometrics raise some new ethical concerns besides issues of integrity, privacy, and data protection and further underscore the importance of the principle of informed consent in order to maintain public trust.

Zigbee Based Wireless Sensor and Actuator Network for Service Robot Intelligent Space

Wireless sensor and actuator network is the key technology of service robot intelligent space. This paper is concerned with design and implementation of a ZigBee based wireless sensor and actuator network (hereinafter referred to as ZWSAN), which has been applied in our service robot intelligent space successfully. Firstly, a simplified ZigBee stack applied to ZWSAN is proposed and the primitives of the stack are illustrated after a short overview of ZigBee protocols. Then the implementation of hardware module and software stack is introduced in detail as well as several representative devices integrated into ZWSAN, including environmental sensors for environmental perception, home devices controllers for device control, embedded speech recognition module for speech control, IMU module for abnormal behaviors detection and laser robot control for service robot navigation. An application example is described to demonstrate how the devices in ZWSAN to provide service cooperatively. Finally, we conclude this paper and discuss the future directions.

Design and Verification of Hybrid Dynamic Worm Detection System

This paper proposes a new design scheme for hybrid dynamic worm detection system. In the proposed scheme, the features of matching detection method based on protocol analysis, Bayesian detection method based on probability, and honeypot-based detection method are integrated for a relative complemented function to develop the advantages and avoid the disadvantages of each detection method. The designed hybrid dynamic worm detection system can be used for effective detection of abnormal data behavior of the hosts attacked by worms, and it also serves for dynamic real-time update of the rule base. Then a preliminary functional verification is performed on this system.

An energy model approach to people counting for abnormal crowd behavior detection

Abnormal crowd behavior detection plays an important role in surveillance applications. We propose a camera parameter independent and perspective distortion invariant approach to detect two types of abnormal crowd behavior. The two typical abnormal activities are people gathering and running. Since people counting is necessary for detecting the abnormal crowd behavior, we present an potential energy-based model to estimate the number of people in public scenes. Building histograms on the X- and Y-axes, respectively, we can obtain probability distribution of the foreground object and then define crowd entropy. We define the Crowd Distribution Index by combining the people counting results with crowd entropy to represent the spatial distribution of crowd. We set a threshold on Crowd Distribution Index to detect people gathering. To detect people running, the kinetic energy is determined by computation of optical flow and Crowd Distribution Index. With a threshold, kinetic energy can be used to detect people running. To test the performance of our algorithm, videos of different scenes and different crowd densities are used in the experiments. Without camera calibration and training data, our method can robustly detect abnormal behaviors with low computation load.

Online recognition of human activities and adaptation to habit changes by means of learning automata and fuzzy temporal windows

Smart Homes are intelligent spaces that contain resources to collect information about user’s activities and ease the assisted living. Abnormal behavior detection has been remarked as one of the most challenging application fields in this research area, due to its possibilities for assisting elders or people with special needs. These systems help to maintain people’s independence, enhancing their personal comfort and safety and delaying the process of moving to a nursing home. In this paper, we describe a new approach for the behavior recognition problem based on Learning Automata and fuzzy temporal windows. Our proposal learns the normal behaviors, and uses that knowledge to recognise normal and abnormal human activities in real time. In addition, our proposal is able to adapt online to environmental variations, changes in human habits, and temporal information, defined as an interval of time when the behavior should be performed.

Auto-Regressive Processes Explained by Self-Organized Maps. Application to the Detection of Abnormal Behavior in Industrial Processes

This paper analyzes the expected time evolution of an auto-regressive (AR) process using self-organized maps (SOM). It investigates how a SOM captures the time information given by the AR input process and how the transitions from one neuron to another one can be understood under a probabilistic perspective. In particular, regions of the map into which the AR process is expected to move are identified. This characterization allows detecting anomalous changes in the AR process structure or parameters. On the basis of the theoretical results, an anomaly detection method is proposed and applied to a real industrial process.

Abnormal crowd behavior detection using size-adapted spatio-temporal features

Abnormal crowd behavior detection is an important research issue in computer vision. However, complex real-life situations (e.g., severe occlusion, over-crowding, etc.) still challenge the effectiveness of previous algorithms. Recently, the methods based on spatio-temporal cuboid are popular in video analysis. To our knowledge, the spatio-temporal cuboid is always extracted randomly from a video sequence in the existing methods. The size of each cuboid and the total number of cuboids are determined empirically. The extracted features either contain the redundant information or lose a lot of important information which extremely affect the accuracy. In this paper, we propose an improved method. In our method, the spatio-temporal cuboid is no longer determined arbitrarily, but by the information contained in the video sequence. The spatio-temporal cuboid is extracted from video sequence with adaptive size. The total number of cuboids and the extracting positions can be determined automatically. Moreover, to compute the similarity between two spatio-temporal cuboids with different sizes, we design a novel data structure of codebook which is constructed as a set of two-level trees. The experiment results show that the detection rates of false positive and false negative are significantly reduced. Keywords: Codebook, latent dirichlet allocation (LDA), social force model, spatio-temporal cuboid.

Data mining model-based control charts for multivariate and autocorrelated processes

Process monitoring and diagnosis have been widely recognized as important and critical tools in system monitoring for detection of abnormal behavior and quality improvement. Although traditional statistical process control (SPC) tools are effective in simple manufacturing processes that generate a small volume of independent data, these tools are not capable of handling the large streams of multivariate and autocorrelated data found in modern systems. As the limitations of SPC methodology become increasingly obvious in the face of ever more complex processes, data mining algorithms, because of their proven capabilities to effectively analyze and manage large amounts of data, have the potential to resolve the challenging problems that are stretching SPC to its limits. In the present study we attempted to integrate state-of-the-art data mining algorithms with SPC techniques to achieve efficient monitoring in multivariate and autocorrelated processes. The data mining algorithms include artificial neural networks, support vector regression, and multivariate adaptive regression splines. The residuals of data mining models were utilized to construct multivariate cumulative sum control charts to monitor the process mean. Simulation results from various scenarios indicated that data mining model-based control charts performs better than traditional time-series model-based control charts.

Monitoring abnormal network traffic based on blind source separation approach

The randomness in network behaviors poses serious challenges for discovering abnormal patterns in network traffic flows. This paper presents a systematic approach for monitoring abnormal network traffic. The DFlow model is proposed to reduce the flow records and extract four features to capture the traffic patterns. The blind source separation method is applied to obtain the routine and abnormal behaviors from those features. A scale space filter is applied to filter the randomness in the traffic flows without affecting the behavior patterns. A threshold is selected based on a systematic criterion to evaluate the degree of abnormality. The contributions of different traffic features to the abnormal behavior detection are analyzed. It is found that the number of connection degree is the most important feature for traffic monitoring. A salient feature of this method is that it is effective for detecting the abnormal behaviors not associated with significant changes in traffic volumes. Another advantage of the new method is that no supervised learning process is needed. This is very important since high quality labeled samples are very difficult to acquire in actual networks especially the data traces associated with attacks. The experimental results based on the actual network data show that the method presented in the paper is effective for monitoring abnormal traffic flows in the gigabytes traffic environment and the accuracy is above 95%.

Machine learning methods for environmental monitoring and flood protection

More and more natural disasters are happening every year: floods, earthquakes, volcanic eruptions, etc. In order to reduce the risk of possible damages, governments all around the world are investing into development of Early Warning Systems (EWS) for environmental applications. The most important task of the EWS is identification of the onset of critical situations affecting environment and population, early enough to inform the authorities and general public. This paper describes an approach for monitoring of flood protections systems based on machine learning methods. An Artificial Intelligence (AI) component has been developed for detection of abnormal dike behaviour. The AI module has been integrated into an EWS platform of the UrbanFlood project (EU Seventh Framework Programme) and validated on real-time measurements from the sensors installed in a dike.

Abnormal crowd behavior detection using high-frequency and spatio-temporal features

Abnormal crowd behavior detection is an important research issue in computer vision. The traditional methods first extract the local spatio-temporal cuboid from video. Then the cuboid is described by optical flow or gradient features, etc. Unfortunately, because of the complex environmental conditions, such as severe occlusion, over-crowding, etc., the existing algorithms cannot be efficiently applied. In this paper, we derive the high-frequency and spatio-temporal (HFST) features to detect the abnormal crowd behaviors in videos. They are obtained by applying the wavelet transform to the plane in the cuboid which is parallel to the time direction. The high-frequency information characterize the dynamic properties of the cuboid. The HFST features are applied to the both global and local abnormal crowd behavior detection. For the global abnormal crowd behavior detection, Latent Dirichlet allocation is used to model the normal scenes. For the local abnormal crowd behavior detection, Multiple Hidden Markov Models, with an competitive mechanism, is employed to model the normal scenes. The comprehensive experiment results show that the speed of detection has been greatly improved using our approach. Moreover, a good accuracy has been achieved considering the false positive and false negative detection rates.

An Intelligent High-Frame-Rate Video Logging System for Abnormal Behavior Analysis

This paper introduces a high-speed vision system called IDP Express, which can execute real-time image processing and High-Frame-Rate (HFR) video recording simultaneously. In IDP Express, 512×512 pixel images from two camera heads and the processed results on a dedicated FPGA (Field Programmable Gate Array) board are transferred to standard PC memory at a rate of 1000 fps or more. Owing to the simultaneous HFR video processing and recording, IDP Express can be used as an intelligent video logging system for long-term high-speed phenomenon analysis. In this paper, a real-time abnormal behavior detection algorithm was implemented on IDP-Express to capture HFR videos of crucial moments of unpredictable abnormal behaviors in high-speed periodic motions. Several experiments were performed for a high-speed slider machine with repetitive operation at a frequency of 15 Hz and videos of the abnormal behaviors were automatically recorded to verify the effectiveness of our intelligent HFR video logging system.

An evidential approach for detection of abnormal behaviour in the presence of unreliable sensors

We address the problem of abnormal behaviour recognition of the inhabitant of a smart home in the presence of unreliable sensors. The corner stone of this work is a two-level architecture sensor fusion based on the Transferable Belief Model (TBM). The novelty of our work lies in the way we detect both unreliable sensors and abnormal behaviour within our architecture by using a temporal analysis of conflict resulting from the fusion of sensors. Detection of abnormal behaviour is based on a prediction/observation process and the influence of the faulty sources is discarded by discounting coefficients. Our architecture is tested in a real-life setting using three heterogeneous sensors enabling the detection of impossible transitions between three possible postures: Sitting, Standing and Lying. The impact of having a faulty sensor management is also tested in the real-life experiment for posture detection.

ZigBee Wireless Sensor Networks Based Detection and Help System for Elderly Abnormal Behaviors in Service Robot Intelligent Space

The detection of abnormal behaviors is one of the most important issues in the health monitoring system. Computer vision based techniques, usually combined with statistics, are labor-intensive, time-consuming and costly. Moreover, only monitoring but no help functions are provided. To overcome this limitation, this paper presents a ZigBee wireless sensor networks based detection and help system for elderly abnormal behaviors in service robot intelligent space. The main components of the system, including abnormal behaviors detection module, localization of abnormal behaviors, ceiling projector for robot navigation and development of ZigBee wireless sensor networks, are addressed in detail. Finally, we conclude this paper and future research direction is given.

Adaptive Mahalanobis Distance and $k$-Nearest Neighbor Rule for Fault Detection in Semiconductor Manufacturing

In recent years, fault detection has become a crucial issue in semiconductor manufacturing. Indeed, it is necessary to constantly improve equipment productivity. Rapid detection of abnormal behavior is one of the primary objectives. Statistical methods such as control charts are the most widely used approaches for fault detection. Due to the number of variables and the possible correlations between them, these control charts need to be multivariate. Among them, the most popular is probably the Hotelling T2 rule. However, this rule only makes sense when the variables are Gaussian, which is rarely true in practice. A possible alternative is to use nonparametric control charts, such as the k-nearest neighbor detection rule by He and Wang, in 2007, only constructed from the learning sample and without assumption on the variables distribution. This approach consists in evaluating the distance of an observation to its nearest neighbors in the learning sample constituted of observations under control. A fault is declared if this distance is too large. In this paper, a new adaptive Mahalanobis distance, which takes into account the local structure of dependence of the variables, is proposed. Simulation trials are performed to study the benefit of the new distance against the Euclidean distance. The method is applied on the photolithography step of the manufacture of an integrated circuit.

Situational Analysis in Real-Time Traffic Systems

The prediction of traffic situations is a vital issue in modern Intelligent Transport Systems (ITS). Particularly the real time detection and proper assessment of incidents may save live and may contribute to keep the transport network available. However, the influence factors of traffic are subject to multi changes; the influence factors are varying traffic demand, weather, seasons, etc. This allows only a very poor performance in real time assessment of traffic situations. This article focuses on the fact that the possible traffic patterns – depicted as time series – vary only very little on each site, representing specific traffic situations or “normal time series”.That the use of intelligent dedicated digital signal processing systems and communication media is in a position to improve the requirement of Real-Time traffic situational analysis in an efficient and effective way. Digital Finite Impulse Response (FIR) filters are used to analyse sensor measurement data in a way that allows an instantaneous assessment about the actual traffic situation and the detection of abnormal behaviour. A FIR filter cascade is used, each filter represents a specific normal time series like working day, weekend day, rain, winter, etc. The representation of each normal time series is achieved by discrete transformation of the normal time series in order to generate its frequency spectrum and by designing a filter structure with a corresponding frequency response.The deployment of the FIR filters can be in Traffic Control Centres with a vast amount of computational power as well as in the controller cabinets of local sensors on the basis of Digital Signal Processors.

HFR-Video-Based Machinery Surveillance for High-Speed Periodic Operations

This study introduces a form of vision-based machinery surveillance for abnormal behavior detection in high-speed periodic operation. This new surveillance method includes high-frame-rate (HFR) video logging with a phase encoding algorithm (for use with periodic operation) to efficiently match input images with pre-stored reference images. To allow periodic machinery operations to be monitored, the surveillance algorithm can estimate the phase of a periodic operation by inspecting temporal changes in the brightness at several significant pixels in an input image from a single camera; abnormal behavior in periodic operation can be intelligently detected at a crucial moment by comparing the input image with the reference image synchronized with its encoded phase without the heavy computation required to search all the reference images for the matching process. This algorithm was implemented by software on a high-speed vision platform, IDP Express, which can record input images of 512 × 512 pixels and processed results at 1000 fps for video logging. We verified the effectiveness of the HFR-video-based machinery surveillance by performing two on-line experiments for high-speed periodic operation at dozens of hertz using a sewing machine.

Nonparametric multivariate control charts based on a linkage ranking algorithm

AbstractControl charts have been widely recognized as important and critical tools in system monitoring for detection of abnormal behavior and quality improvement. In particular, multivariate control charts have been effectively used when a process involves a number of correlated quality characteristics. Most existing multivariate control charts were developed using the assumption of normally distributed quality characteristics. However, process data from modern industries often do not follow the normal distribution. Despite the great need for nonparametric control charts that can control the error rate regardless of the underlying distribution, few efforts have been made in this direction. In this paper, we propose a new nonparametric control chart (called the kLINK chart) based on a k‐linkage ranking algorithm that calculates the ranking of a new observation relative to the in‐control training data. A simulation study was performed to demonstrate the effectiveness of our kLINK chart and its superiority over the traditional Hotelling's T2 chart and the ranking depth control chart in nonnormal situations. In addition, to enable increased sensitivity to small shifts, we present an exponentially weighted moving average version of a kLINK chart. Copyright © 2010 John Wiley & Sons, Ltd.

Cerebral Palsy: State of Art

Abstract Cerebral palsy (CP) is the most common motor disability in childhood. It affects 2 to 2.5 children in 1000 live-births, with 20 to 30 fold increased prevalence in preterm infants. Despite of progress in perinatal care, the prevalence of cerebral palsy did not change in the last 50 years. New knowledge about etiological factors, such as inflammation, elevated level of cytokines, vascular strokes and genetic factors shift the origin of cerebral palsy mostly into antenatal period, making intrapartal damage responsible for less than 10% of cases. CP is becoming increasingly the subject of interdisciplinary research. Fetal neurosonography with a growing number of studies promises better understanding of the normal functional maturation of the human brain which may lead to effective prevention and treatment of cerebral palsy. Advances in 4D ultrasound resulted in development of KANET as tool for detection of abnormal fetal behavior.