False Positive Alarms Research Articles

A practical protocol to address barriers and slow acceptance for use of continuous ischemia monitoring in US hospitals

Background: In 2004, a Scientific Statement of practice standards for inhospital cardiac monitoring was published by the American Heart Association and endorsed by the International Society of Computerized Electrocardiology (ISCE), including recommendations for continuous ischemia (cST-seg) monitoring. In 2007, the author sent an electronic survey nationally to a random sample of 915 cardiologists from a pool of 4985 certified cardiologists registered with the electronic vendor, Epocrates. Of hospitals where respondents admitted patients, 49% had a standard of practice for using cSTseg monitoring for cardiac patients. Most responding cardiologists selected early identification of potential ischemia (83.5%) and early identification of reocclusion after percutaneous coronary intervention (PCI) (74%) as benefits of cST-segmonitoring. Regarding barriers, false-positive alarms for ischemia had the highest level of agreement as a barrier to cST-seg monitoring (61.5%), followed by lack of understanding for use of this technology by nursing staff (56.5%), extra telephone calls to you or your partners that you felt were based on inaccurate monitoring (48%), lack of understanding of this technology by other physicians (47%), and extra cost or treatment due to false-positive alarms (43%). More positive perceptions of benefit and clinical usefulness of cST-seg monitoring were reported by cardiologists who practice in hospitals that were implementing cST-seg monitoring guidelines. Conclusion: For practice standards to be incorporated into routine practice nationally, successful interdisciplinary protocols need to be shared. Thus, we are sharing our 572-bed hospital's protocol for cST-seg monitoring in effort to address specific barriers. An interdisciplinary team created the cST monitoring protocol, which stipulates that the ST alarm default is in the “on” setting for all patients. Thus, nursesmust manually turn ST alarms to “off” for patients who meet exclusion criteria (intraventricular conduction defect, paced rhythm, known pericarditis or myocardial contusion, ST-segment “sagging” due to digoxin). Before notifying the physician about an ST alarm, the nurse first verifies that the patient's patches are correctly placed and that the alarms are not due to artifact, particularly from patient movement. Next, for any 2-mm ST change sustained for 15 minutes (with or without symptoms), the nurse obtains a prn 12-lead ECG to confirm ST changes are present. The resident is paged to confirm suspected ischemia on the 12-lead before the attending physician is called. By following this protocol, we are able to reduce unnecessary telephone calls for false alarms and have interdisciplinary, hospital-wide cooperation for cST-seg monitoring.

Stabilizing the baseline current of a microbial fuel cell-based biosensor through overpotential control under non-toxic conditions

A MFC-based biosensor can act as online toxicity sensor. Electrical current is a direct linear measure for metabolic activity of electrochemically active microorganisms. Microorganisms gain energy from anodic overpotential and current strongly depends on anodic overpotential. Therefore control of anodic overpotential is necessary to detect toxic events and prevent false positive alarms. Anodic overpotential and thus current is influenced by anode potential, pH, substrate and bicarbonate concentrations. In terms of overpotential all factor showed a comparable effect, anode potential 1.2% change in current density per mV, pH 0.43%/mV, bicarbonate 0.75%/mV and acetate 0.8%/mV. At acetate saturation the maximum acetate conversion rate is reached and with that a constant bicarbonate concentration. Control of acetate and bicarbonate concentration can be less strict than control of anode potential and pH. Current density changes due to changing anode potential and pH are in the same order of magnitude as changes due to toxicity. Strict control of pH and anode potential in a small range is required. The importance of anodic overpotential control for detection of toxic compounds is shown. To reach a stable baseline current under nontoxic conditions a MFC-based biosensor should be operated at controlled anode potential, controlled pH and saturated substrate concentrations.

Filtering intrusion detection alarms

A Network Intrusion Detection System (NIDS) is an alarm system for networks. NIDS monitors all network actions and generates alarms when it detects suspicious or malicious attempts. A false positive alarm is generated when the NIDS misclassifies a normal action in the network as an attack. We present a data mining technique to assist network administrators to analyze and reduce false positive alarms that are produced by a NIDS. Our data mining technique is based on a Growing Hierarchical Self-Organizing Map (GHSOM) that adjusts its architecture during an unsupervised training process according to the characteristics of the input alarm data. GHSOM clusters these alarms in a way that supports network administrators in making decisions about true and false alarms. Our empirical results show that our technique is effective for real-world intrusion data.

Alarm limit settings for early warning systems to identify at‐risk patients

This paper is a report of a study conducted to provide objective data to assist with setting alarm limits for early warning systems. Early warning systems are used to provide timely detection of patient deterioration outside of critical care areas, but with little data from the general ward population to guide alarm limit settings. Monitoring systems used in critical care areas are known for excellent sensitivity in detecting signs of deterioration, but give high false positive alarm rates, which are managed with nurses caring for two or fewer patients. On general wards, nurses caring for four or more patients will be unable to manage a high number of false alarms. Physiological data from a general ward population would help to guide alarm limit settings. A dataset of continuous heart rate and respiratory rate data from a general ward population, previously collected from July 2003-January 2006, was analyzed for adult patients with no severe adverse events. Dataset modeling was constructed to analyze alarm frequency at varying heart rate and respiratory rate alarm limits. A total of 317 patients satisfied the inclusion criteria, with 780.71 days of total monitoring. Sample alarm settings appeared to optimize false positive alarm rates for the following settings: heart rate high 130-135, low 40-45; respiratory rate high 30-35, low 7-8. Rates for each selected limit can be added to calculate the total alarm frequency, which can be used to judge the impact on nurse workflow. Alarm frequency data will assist with evidence-based configuration of alarm limits for early warning systems.

Plug-and-Play for Medical Devices: Experiences from a Case Study

Medical devices are pervasive throughout modern healthcare, but each device works on its own and in isolation. Interoperable medical devices would lead to clear benefits for the care provider and the patient, such as more accurate assessment of the patient’s health and safety interlocks that would enable error-resilient systems. The Center for Integration of Medicine & Innovative Technology (www.CIMIT.org) sponsors the Medical Device Plug-and-Play Interoperability program (www.MDPnP.org), which is leading the development and adoption of standards for medical device interoperability. Such interoperable medical devices will lead to increased patient safety and enable new treatment options, and the aim of this project is to show the benefits of interoperable and interconnected medical devices.

Ultrasound screening for fetal structural abnormalities performed by trained midwives in the second trimester in a low‐risk population – an appraisal

To determine the performance of trained midwives in second trimester ultrasound screening for fetal structural abnormalities in a low-risk population. Retrospective study. University Department of Obstetrics and Gynecology. About 13,882 women with singleton pregnancies. The findings of routine second trimester anomaly scan performed by midwives were reviewed. Reasons for referral to maternal fetal medicine (MFM) specialists for further assessment were analyzed. The detection, false positive and false alarm rates for fetal anomalies. One hundred and eighty-nine pregnancies with unknown outcome were excluded from the final analysis. Overall, 617 (4.51%) women were referred to MFM specialists for further assessment, of which 470 (70.2%) were for soft markers alone and 147 (23.8%) for suspected fetal structural abnormalities. In these 13,693 fetuses with known outcome, malformed fetuses were present in 185, a prevalence of 1.35%. Of these, 115 were detected during the second trimester scan and two were detected in the third trimester. The remaining 68 malformed fetuses, most of which had minor anomalies, were identified after birth. The detection rate for a malformed fetus in second trimester scan was 62.2% (115/185) (95% CI 55.2-69.2). There were four cases of false positives and 33 cases of false alarm. Experienced midwives with proper training can detect the majority of major structural abnormalities. Continuous audit and quality control plays a significant role in optimizing the fetal structural examination.

A program-based anomaly intrusion detection scheme using multiple detection engines and fuzzy inference

In this paper, a hybrid anomaly intrusion detection scheme using program system calls is proposed. In this scheme, a hidden Markov model (HMM) detection engine and a normal database detection engine have been combined to utilise their respective advantages. A fuzzy-based inference mechanism is used to infer a soft boundary between anomalous and normal behaviour, which is otherwise very difficult to determine when they overlap or are very close. To address the challenging issue of high cost in HMM training, an incremental HMM training with optimal initialization of HMM parameters is suggested. Experimental results show that the proposed fuzzy-based detection scheme can reduce false positive alarms by 48%, compared to the single normal database detection scheme. Our HMM incremental training with the optimal initialization produced a significant improvement in terms of training time and storage as well. The HMM training time was reduced by four times and the memory requirement was also reduced significantly.

Specificity Improvement for Network Distributed Physiologic Alarms Based on a Simple Deterministic Reactive Intelligent Agent in the Critical Care Environment

Automated physiologic alarms are available in most commercial physiologic monitors. However, due to the variability of data coming from the physiologic sensors describing the state of patients, false positive alarms frequently occur. Each alarm requires review and documentation, which consumes clinicians' time, may reduce patient safety through 'alert fatigue' and makes automated physician paging infeasible. To address these issues a computerized architecture based on simple reactive intelligent agent technology has been developed and implemented in a live critical care unit to facilitate the investigation of deterministic algorithms for the improvement of the sensitivity and specificity of physiologic alarms. The initial proposed algorithm uses a combination of median filters and production rules to make decisions about what alarms to generate. The alarms are used to classify the state of patients and alerts can be easily viewed and distributed using standard network, SQL database and Internet technologies. To evaluate the proposed algorithm, a 28 day study was conducted in the University of Michigan Medical Center's 14 bed Cardiothoracic Intensive Care Unit. Alarms generated by patient monitors, the intelligent agent and alerts documented on patient flow sheets were compared. Significant improvements in the specificity of the physiologic alarms based on systolic and mean blood pressure was found on average to be 99% and 88% respectively. Even through significant improvements were noted based on this algorithm much work still needs to be done to ensure the sensitivity of alarms and methods to handle spurious sensor data due to patient or sensor movement and other influences.

Power efficient packet classification using cascaded bloom filter and off-the-shelf ternary CAM for WDM networks

In wavelength division multiplexing (WDM) networks, tens or hundreds of wavelengths can be transmitted over a single fiber. As transmission line speed goes to 10 Gb/s and beyond, ternary CAM (TCAM) is usually employed for wire speed packet classification. To the best of authors’ knowledge, this is the first paper that addresses the impact of WDM transmission on the power consumption of packet classification. We show that as the number of wavelengths increases in the WDM networks, the power consumption of TCAMs can become the limiting factor for WDM network expansion. For example, the power consumption of IPv4 and IPv6 packet classification with merely 32 channels at 40 Gb/s can be as high as 700 and 1400 W, respectively, while technology wise it is feasible to transmit over 500 channels over a single fiber. Existing power efficient TCAM designs require special modification to TCAM cell structures, which makes the adoption of the technology difficult. This paper proposes a novel approach which cascades bloom filter with off-the-shelf TCAM to greatly reduce the power consumption of packet classification. In particular, the proposed solution takes advantage of the fact that bloom filters may give false positive alarms but never give false negative alarms. By eliminating majority of non-matching packets before passing the packets to the TCAM, the TCAM is only activated to exam packets with a high potential of matching in the filter set. The proposed scheme greatly reduces the activation frequency of the TCAM, thus achieving great power savings.

Performance Analysis of Soft Computing Based Anomaly Detectors

Anomaly detectors have become a necessary component of the computer and information security framework. Some of the numerous drawbacks experienced by the current Anomaly detectors are large number of false positive and false negative alarms, difficulty in processing huge amount of traffic in real time, inadequacy in novel attack recognition and non-scalability. Consequently their efficacy in protecting against anomalies is limited. The use of soft computing techniques like Genetic algorithms, Neural networks and Fuzzy logic in implementing Anomaly detection is perused in this paper. Additionally, a few novel approaches for the detection of anomalies by identifying user actions and network traffic that might compromise a system's secure state, is also proposed. A potential solution to the problem has been contemplated, by comparing the performance of these systems based on various criteria. Characterization of the behavior of a single user (Host based) or a network (Network based) and recognition of anomalies through observation of deviation from normal behavior patterns are conducted to arrive at the solution. The implementations of Genetic algorithm based Anomaly detection system (GAAD), Neural network based Anomaly detection system (NNAD) and Fuzzy Logic based system (FLAD) are reported. Interesting conclusions are deduced from an exhaustive evaluation and comparison of the performance of these systems enabling an administrator to choose the best solution for a given scenario.

Abstract 2097: National Survey of Cardiologists’ Perceptions of Continuous ST-segment Monitoring

Continuous ST-segment (cST-seg) monitoring has been shown to help identify early and transient cardiac ischemia. American Heart Association and American Association of Critical Care Nurses recommend its use among specific patient populations. Investigators examined factors associated with cardiologists’ reported benefits, barriers, and perceptions of usefulness for cST-seg monitoring. A random sample (n=200) within a national pool of 4,985 cardiologists registered with the vendor Epocrates® was electronically surveyed. Cardiologists agreed/ strongly agreed that benefits of cST-seg monitoring included early identification of potential ischemia (83.5%), and early identification of reocclusion after PCI (74%) or fibrinolytics (72.5%). Cardiologists agreed/strongly agreed that barriers included false positive alarm for ischemia (61.5%); lack of understanding of this technology by nursing staff (56.5%); extra phone calls based on inaccurate monitoring (48%); lack of understanding of this technology by other physicians (47%); and extra cost/ treatment due to false positive alarms (43%). Cardiologists agreed/strongly agreed that cST-seg monitoring identifies patients who need further tests (69%) and is clinically useful in detecting transient myocardial ischemia (65%). The primary factor associated with higher benefits, clinical usefulness, and past use of cST-seg monitoring by cardiologists was whether or not their hospitals had a standard of practice for using cST-seg monitoring. The secondary factor was awareness of published consensus guidelines for cST-seg monitoring. Findings may indicate that when cardiologists are given the opportunity to work with a hospital that provides guidelines and experience in cST-seg monitoring, they may be more likely to appreciate its benefits and clinical utility. Clinical leaders should initiate multi-disciplinary efforts to review the level of evidence for possible incorporation of cST-seg monitoring into their hospitals’ standards of practice. Findings will help direct further research and interdisciplinary education in appropriate use of technology by critical care nurses and cardiologists.

Detecting nocturnal convulsions: Efficacy of the MP5 monitor

Although the cause of sudden unexplained death in epilepsy patients (SUDEP) is unknown, evidence implicates respiratory compromise. Most cases occur while the patient is in bed and unsupervised. We investigated the efficacy of the Medpage bed seizure monitor to detect generalized tonic-clonic seizures. Patients with a history of tonic-clonic seizures were enrolled on a video-EEG unit. The MP5 device was placed between the mattress and bed base between midnight and 8:00 a.m. 64 subjects were enrolled (1528 h). Five of eight tonic-clonic seizures were detected. There were 269 false positive alarms (146 h with false positive alarms). The sensitivity and specificity of the alarm were 62.5% and 90.4%, respectively. The negative predictive value of 99.8% illustrates the potential for this device to provide additional security for patients with tonic-clonic seizures, however individual calibration would likely be necessary to improve the positive predictive value of 3.3%, which requires further validation.

Network intrusion detection using genetic algorithm to find best DNA signature

Bioinformatics is part of computer science that joins between computer programming and molecular biology. DNA consists of long sequence of nucleotides which formulates the genome. Our method is to generate normal signature sequence and alignment threshold value from processing the system training data and encode observed network connection into corresponding DNA nucleotides sequence, then to align the signature sequence with observed sequence to find similarity degree value and decide whether the connection is attack or normal. Number of DNA sequences makes up each population, and then new generations are produced to select the Signature with best alignment value with normal network connection sequences. This paper ends up with accuracy value and threshold score for detecting the network anomalies that no known conditions exist for them to be discovered in addition for percentage of generating false positive and true negative alarms.

Should we be alarmed by our alarms?

The number of alarms in the anaesthesia environment has gone from none to many dozens during the past 50 years. Until recently, each equipment manufacturer designed their own alarm set, resulting overall in a chaotic acoustic environment. Anaesthesiologists tend to have an uneasy relationship with monitoring alarms. On one hand they warn of mishaps, but on the other the many unnecessary alarms can be irritating and actually impede clinical care. There is evidence that these factors prevent alarms from realizing their full potential to enhance patient safety. This review explores current developments in clinical alarm design and technology. A considerable body of research currently exists on the design of nonverbal auditory alarms, their relationship with human behaviour, and implications for medical alarms. Technology to reduce the unacceptably high rate of false-positive alarms is being introduced. Much work has been done to standardize alarm conditions and alarm sounds. Although this is a work in progress, the introduction of these standards should make clinical alarms more useful and less grating. The disadvantages of current clinical alarms have been identified and are in the process of being addressed.

Collaborative Detection of DDoS Attacks over Multiple Network Domains

This paper presents a new distributed approach to detecting DDoS (distributed denial of services) flooding attacks at the traffic-flow level The new defense system is suitable for efficient implementation over the core networks operated by Internet service providers (ISPs). At the early stage of a DDoS attack, some traffic fluctuations are detectable at Internet routers or at the gateways of edge networks. We develop a distributed change-point detection (DCD) architecture using change aggregation trees (CAT). The idea is to detect abrupt traffic changes across multiple network domains at the earliest time. Early detection of DDoS attacks minimizes the floe cling damages to the victim systems serviced by the provider. The system is built over attack-transit routers, which work together cooperatively. Each ISP domain has a CAT server to aggregate the flooding alerts reported by the routers. CAT domain servers collaborate among themselves to make the final decision. To resolve policy conflicts at different ISP domains, a new secure infrastructure protocol (SIP) is developed to establish mutual trust or consensus. We simulated the DCD system up to 16 network domains on the Cyber Defense Technology Experimental Research (DETER) testbed, a 220-node PC cluster for Internet emulation experiments at the University of Southern California (USC) Information Science Institute. Experimental results show that four network domains are sufficient to yield a 98 percent detection accuracy with only 1 percent false-positive alarms. Based on a 2006 Internet report on autonomous system (AS) domain distribution, we prove that this DDoS defense system can scale well to cover 84 AS domains. This security coverage is wide enough to safeguard most ISP core networks from real-life DDoS flooding attacks.

Accuracy Requirements for a Hypoglycemia Detector: An Analytical Model to Evaluate the Effects of Bias, Precision, and Rate of Glucose Change

There has been considerable debate on what constitutes a good hypoglycemia (Hypo) detector and what is the accuracy required from the continuous monitoring sensor to meet the requirements of such a detector. The performance of most continuous monitoring sensors today is characterized by the mean absolute relative difference (MARD), whereas Hypo detectors are characterized by the number of false positive and false negative alarms, which are more relevant to the performance of a Hypo detector. This article shows that the overall accuracy of the system and not just the sensor plays a key role. A mathematical model has been developed to investigate the relationship between the accuracy of the continuous monitoring system as described by the MARD, and the number of false negatives and false positives as a function of blood glucose rate change is established. A simulation method with N = 10,000 patients is used in developing the model and generating the results. Based on simulation for different scenarios for rate of change (0.5, 1.0, and 5.0 mg/dl per minute), sampling rate (from 1, 2.5, 5, and 10 minutes), and MARD (5, 7.5, 10, 12.5, and 15%), the false positive and false negative ratios are computed. The following key results are from these computations. 1. For a given glucose rate of change, there is an optimum sampling time. 2. The optimum sampling time as defined in the critical sampling rate section gives the best combination of low false positives and low false negatives. 3. There is a strong correlation between MARD and false positives and false negatives. 4. For false positives of <10% and false negatives of <5%, a MARD of <7.5% is needed. Based on the model, assumptions in the model, and the simulation on N = 10,000 patients for different scenarios for rate of glucose change, sampling rate, and MARD, it is concluded that the false negative and false positive ratio will vary depending on the alarm Hypo threshold set by the patient and the MARD value. Also, to achieve a false negative ratio <5% and a false positive ratio <10% would require continuous glucose monitoring to have an MARD < or =7.5%.

Continuous Oximetry/Capnometry Monitoring Reveals Frequent Desaturation and Bradypnea During Patient-Controlled Analgesia

The most serious complication of patient-controlled analgesia (PCA) is respiratory depression (RD). The incidence of RD in the literature is derived from intermittent sampling of pulse oximetry (Spo(2)) and respiratory rate and defined as a deviation below an arbitrary threshold. We monitored postsurgical patients in a hospital ward receiving morphine or meperidine PCA with continuous oximetry and capnography. Nurses responding to audible monitor bedside alarms documented respiratory status and interventions. A total of 178 patients were included in the analysis, 12% and 41% of whom had episodes of desaturation (Spo(2) <90%) and bradypnea (respiratory rate <10) lasting 3 min or more. One patient required "rescue" with positive pressure ventilation, and none required naloxone. Patients over 65 years of age and the morbidly obese were at greater risk for desaturation. Patients over 65 years of age were also more likely to have bradypnea, whereas the morbidly obese and patients receiving continuous infusions were less likely to have bradypnea. Our incidence of RD by bradypnea is significantly higher than the 1%-2% incidence in the literature, using the same threshold criteria but more stringent duration criteria, while our incidence of RD based on desaturation is consistent with previous estimates. We conclude that continuous respiratory monitoring is optimal for the safe administration of PCA, because any RD event can progress to respiratory arrest if undetected. Better alarm algorithms must be implemented to reduce the frequent alarms triggered by threshold criteria for RD.

Robust regression methods for intensive care monitoring

Alarm generation of modern patient monitoring systems still predominantly relies on simple threshold methods. This leads to an unacceptably high rate of false positive alarms. Many false positive alarms are generated by measurement artefacts and measurement noise. One approach to address this problem is to alarm on the underlying signal (that is, the noise-free time series of the physiological variable), instead of the raw measurement.

Robust filters for intensive care monitoring: beyond the running median / Robuste Filter für intensivmedizinisches Monitoring: mehr als ein gleitender Median

Current alarm systems in intensive care units create a very high rate of false positive alarms because most of them simply compare physiological measurements to fixed thresholds. An improvement can be expected when the actual measurements are replaced by smoothed estimates of the underlying signal. However, classical filtering procedures are not appropriate for signal extraction, as standard assumptions, such as stationarity, do no hold here: the time series measured often show long periods without change, but also upward or downward trends, sudden shifts and numerous large measurement artefacts. Alternative approaches are needed to extract the relevant information from the data, i.e., the underlying signal of the monitored variables and the relevant patterns of change, such as abrupt shifts and trends. This article reviews recent research on filter-based online signal extraction methods designed for application in intensive care.

Collaborative detection and filtering of shrew DDoS attacks using spectral analysis

This paper presents a new spectral template-matching approach to countering shrew distributed denial-of-service (DDoS) attacks. These attacks are stealthy, periodic, pulsing, and low-rate in attack volume, very different from the flooding type of attacks. They are launched with high narrow spikes in very low frequency, periodically. Thus, shrew attacks may endanger the victim systems for a long time without being detected. In other words, such attacks may reduce the quality of services unnoticeably. Our defense method calls for collaborative detection and filtering (CDF) of shrew DDoS attacks. We detect shrew attack flows hidden in legitimate TCP/UDP streams by spectral analysis against pre-stored template of average attack spectral characteristics. This novel scheme is suitable for either software or hardware implementation. The CDF scheme is implemented with the NS-2 network simulator using real-life Internet background traffic mixed with attack datasets used by established research groups. Our simulated results show high detection accuracy by merging alerts from cooperative routers. Both theoretical modeling and simulation experimental results are reported here. The experiments achieved up to 95% successful detection of network anomalies along with a low 10% false positive alarms. The scheme cuts off malicious flows containing shrew attacks using a newly developed packet-filtering scheme. Our filtering scheme retained 99% of legitimate TCP flows, compared with only 20% TCP flows retained by using the Drop Tail algorithm. The paper also considers DSP, FPGA, and network processor implementation issues and discusses limitations and further research challenges.