Conventional Anomaly Detection Research Articles

A hybrid artificial immune system (AIS) model for power aware secure Mobile Ad Hoc Networks (MANETs) routing protocols

Abstract Securing ad hoc routing protocols for MANETs is a significant challenge due to number of reasons: (1) mobility results in continuously changing network topology – the premise of stable self or non-self is void, (2) the proposed security solution must be lightweight so that it can be deployed on resource constrained mobile nodes, and (3) the solution should provide high detection accuracy and low false positive rate. The major contribution of this paper is a hybrid AIS model – combining the relevant features of classical self/non-self paradigm with the emerging danger theory paradigm – that has the capability to meet the above-mentioned challenges of the MANET environment. As a case study, we use our hybrid model to develop a power aware security framework for BeeAdHoc– a well-known bio-inspired routing protocol. We have realized our framework in ns-2 simulator. We have also developed an attacker framework in ns-2 that has the capability to launch a number of Byzantine attacks on BeeAdHoc. The results of our experiments show that our proposed framework meets all its requirements: (1) the adaptive learning because of changing self/non-self, (2) high detection accuracy and low false positive rate, (3) lightweight in terms of processing and communication overheads, and (4) better or comparable performance compared with non-secure versions of existing state-of-the-art MANET routing protocols – DSR and AODV. We have also compared our hybrid AIS model with self/non-self, danger theory and a conventional anomaly detection system to show its merits over these schemes. Finally, we propose an extension of the framework for securing DSR.

Maximized subspace model for hyperspectral anomaly detection

An important application in remote sensing using hyperspectral imaging system is the detection of anomalies in a large background in real-time. A basic anomaly detector for hyperspectral imagery that performs reasonaly well is the RX detector. In practice, the subspace RX (SSRX) detector which deletes the clutter subspace has been known to perform better than the RX detector. In this paper an anomaly detector that can do better than the SSRX detector without having to delete the clutter subspace is developed. The anomaly detector partials out the effect of the clutter subspace by predicting the background using a linear combination of the clutter subspace. The Mahalanobis distance of the resulting residual is defined as the anomaly detector. The coefficients of the linear combination are chosen to maximize a criterion based on squared correlation. The experimental results are obtained by implementing the anomaly detector as a global anomaly detector in unsupervised mode with background statistics computed from hyperspectral data cubes with wavelengths in the visible and near-infrared range. The results show that the anomaly detector has a better performance than the SSRX detector. In conclusion, the anomaly detector that is based on partialling out can achieve better performance than the conventional anomaly detectors.

Estimating Anomality of the Video Sequences for Surveillance Using 1-Class SVM

We have proposed a method to detect and quantitatively extract anomalies from surveillance videos. Using our method, anomalies are detected as patterns based on spatio-temporal features that are outliers in new feature space. Conventional anomaly detection methods use features such as tracks or local spatio-temporal features, both of which provide insufficient timing information. Using our method, the principal components of spatio-temporal features of change are extracted from the frames of video sequences of several seconds duration. This enables anomalies based on movement irregularity, both position and speed, to be determined and thus permits the automatic detection of anomal events in sequences of constant length without regard to their start and end. We used a 1-class SVM, which is a non-supervised outlier detection method. The output from the SVM indicates the distance between the outlier and the concentrated base pattern. We demonstrated that the anomalies extracted using our method subjectively matched perceived irregularities in the pattern of movements. Our method is useful in surveillance services because the captured images can be shown in the order of anomality, which significantly reduces the time needed.

Anomaly Detection on Mobile Phone Based Operational Behavior

Information protection schemes on mobile phones become important challenges because mobile phones have many types of private information. In general, user authentication and anomaly detection are effective to prevent attacks by illegal users. However, the user authentication can be applied only at the beginning of use and the conventional anomaly detection is not suited for mobile phones, only but computer systems. In this paper, we propose a simple and easy-to-use anomaly detection scheme on mobile phones. The scheme records the keystrokes as the mobile phone is operated, and an anomaly detection algorithm calculates a score of similarity, to detect illegal users. We implemented a prototype system on the BREW (Binary Run-time Environment for Wireless) emulator and evaluated error rates by using results from 15 testers. From experiments results, we show the proposed scheme is able to apply the anomaly detection by checking the similarity score several times.