Abstract Video-based emotion change estimation using spatiotemporal features is an emerging area of research, enabling various practical applications. Existing methods often overlook continual analysis of the changes in emotions during spontaneous conversations. In this study, considering a set of spatial and temporal attributes, a novel one-dimensional weighted emotion model is proposed to accurately scale the emotion intensity levels. Further, a tri-stream deep framework, called TriCe , is proposed to estimate the emotion changes using three complementary modal information from videos, namely key-frame, video and voice. In TriCe, each modal information is extracted separately and combined using an adaptive fusion technique, which is then used to recognize the emotion level. Experimental results on a newly constructed benchmark emotion dataset demonstrate that our TriCe framework is feasible in estimating emotion changes. Comparison with other existing works demonstrates that the TriCe sets the benchmark for emotion estimation.

Abstract Over the years, researchers have applied various deep learning techniques to automatically recognise plant diseases from both raster and spectral images. The primary focus of the existing studies is developing individual species-specific or disease-specific models, where the former recognises diseases of single crop type and the latter recognises single diseases of single or multiple crop types. Building one global model to recognise diseases of multiple crops has also been widely explored, where a class is treated as a crop-disease combination. While training individual species-specific or disease-specific deep models is labour-intensive, embracing a vast number of crop species and inherent diseases present on this planet makes the model cumbersome. In order to address this problem, a more intuitive and feasible family-based plant disease characterisation approach with botanical reasoning is proposed in this study. This approach demonstrates the feasibility of six state-of-the-art deep neural networks through a set of extensive experiments incorporating six key strategies. The results on a newly built family-based plant disease dataset confirm that the proposed novel approach is convincing to be applied in a plant family-based disease recognition problem. Further, this study creates future opportunities for more intuitive plant disease data collection and benchmark classification model development.

Abstract Visual Assessment of cluster Tendency (VAT) is a popular method that visually represents the possible clusters found in a dataset as dark blocks along the diagonal of a reordered dissimilarity image (RDI). Although many variants of the VAT algorithm have been proposed to improve the visualisation quality on different types of datasets, they still suffer from the challenge of extracting clusters with varied densities. In this paper, we focus on overcoming this drawback of VAT algorithms by incorporating kernel methods and also propose a novel adaptive cluster extraction strategy, named CER, to effectively identify the local clusters from the RDI. We examine their effects on an improved VAT method (iVAT) and systematically evaluate the clustering performance on 18 synthetic and real-world datasets. The experimental results reveal that the recently proposed data-dependent dissimilarity measure, namely the Isolation kernel, helps to significantly improve the RDI image for easy cluster identification. Furthermore, the proposed cluster extraction method, CER, outperforms other existing methods on most of the datasets in terms of a series of dissimilarity measures.

First developed to rank website relevance, PageRank has become ubiquitous in many areas of graph machine learning including deep learning. We demonstrate that a number of recently published deep graph neural networks are qualitatively equivalent to shallow networks utilizing Personalized PageRank (PPR), and that their performance improvements over existing PPR implementations can be fully explained by hyperparameter choices. We also show that PPR with these hyperparameters outperform more recently published sophisticated variations of PPR-based graph neural networks, and present efficient implementations that reduce training times and memory requirements while improving scalability.

Hand gesture recognition is the process of detecting the hand movements via sensor measurements for detecting an activity, such as writing a letter or a number. Recognising the handwritten characters using wearable devices enables machine-human interaction to occur without the need for a communication method. An intelligent automated framework is required to accurately detect the handwritten characters using wrist worn sensor signals, in particular, with minimal number of sensors. Moreover, the system developed needs to have the capacity to recognise the characters written in different sizes. In order to address these, we analyse performance of several machine learning models using single/multiple sensors namely, accelerometer or/and gyroscope, for recognising hand gesture characters including alphabet and numbers of varying sizes. We formulate a set of features that enable robust and accurate detection of the characters.We performed novel data collection using an off-the-shelf wrist-worn sensor based device, and evaluated our framework to detect the different characters effectively. The maximum accuracy (90.40%) was achieved using both sensors and Random Forest (RF) model. This was dropped to 82.51% for the same model using accelerometer sensor alone. Using the gyroscope sensor, an overall average accuracy of 80.16% was achieved with the Forward Neural Network (FNN) model. Although the model based on both sensors showed the best performance, our evaluation reveals that it is feasible to develop a machine learning model using single sensor to detect hand gesture characters of varying sizes with reasonable (≥ 80%) accuracy.

Understanding anunknown facial emotionthat emerges in the future underpins significant impacts in various domains. Knowing the fact that emotional states grow in vocabulary, new emotional states need to be adapted while the existing knowledge of known emotional states is preserved. While human beings spontaneously perform this task, the challenge is, how to devise a deep learning technique that can effectively recognize an unknown emotion category in the future. Although the deep convolutional neural network has shown excellent emotion recognition performances in the past, it is conventionally a predefined multi-way classifier showing little resilience towards adding a new emotion class. Considering the aforementioned challenge, in this paper, we propose a generic deep convolutional neural network-based architecture that constantly absorbs the upcoming emotion categories and recognizes them effectively. We further propose an indicator loss, which is associated with the distillation mechanism that preserves the existing knowledge. In order to demonstrate the feasibility of our proposed method, we evaluated our model using benchmark emotion datasets. The results confirm that the proposed approach is superior in recognizing unknown emotional states compared to continual learning benchmarks. Further, our proposed method demonstrates higher accuracy, compared to the transfer learning baselines.

Electrocardiogram (ECG) acquisition requires an automated system and analysis pipeline for understanding specific rhythm irregularities. Deep neural networks have become a popular technique for tracing ECG signals, outperforming human experts. Despite this, convolutional neural networks are susceptible to adversarial examples that can misclassify ECG signals and decrease the model’s precision. Moreover, they do not generalize well on the out-of-distribution dataset. The GAN architecture has been employed in recent works to synthesize adversarial ECG signals to increase existing training data. However, they use a disjointed CNN-based classification architecture to detect arrhythmia. Till now, no versatile architecture has been proposed that can detect adversarial examples and classify arrhythmia simultaneously. To alleviate this, we propose a novel Conditional Generative Adversarial Network to simultaneously generate ECG signals for different categories and detect cardiac abnormalities. Moreover, the model is conditioned on class-specific ECG signals to synthesize realistic adversarial examples. Consequently, we compare our architecture and show how it outperforms other classification models in normal/abnormal ECG signal detection by benchmarking real world and adversarial signals.

Recognizing emotions in context from an image has become an emerging topic in the recent past due to its high practical demand in various domains. Performance of the existing works is limited as they predominantly utilized the entire image and the primary human subject as major cues to recognize the emotions from images. However, in addition to the primary human subject, other human subjects in a scene also play a vital role in determining the image's overall emotional state. In this work, a novel visual feature type is introduced based on the features extracted from other human subjects in order to enhance emotion recognition performance. A novel deep learning based hybrid framework is also proposed to effectively integrate the proposed feature with the visual cues from the entire image and primary human subject. The extensive experiments carried out on a subset of the Emotic dataset reveal that the newly introduced visual feature type contributes to the overall emotional state of the scene. Furthermore, the proposed framework achieved 45.11% average accuracy for discrete emotion categories, which is a significant improvement in the emotion recognition performance compared to existing techniques that use emotion information from the entire image and primary human subject.

With the development of information technology, thousands of devices are connected to the Internet, various types of data are accessed and transmitted through the network, which pose huge security threats while bringing convenience to people. In order to deal with security issues, many effective solutions have been given based on traditional machine learning. However, due to the characteristics of big data in cyber security, there exists a bottleneck for methods of traditional machine learning in improving security. Owning to the advantages of processing big data and high-dimensional data, new solutions for cyber security are provided based on deep learning. In this paper, the applications of deep learning are classified, analyzed and summarized in the field of cyber security, and the applications are compared between deep learning and traditional machine learning in the security field. The challenges and problems faced by deep learning in cyber security are analyzed and presented. The findings illustrate that deep learning has a better effect on some aspects of cyber security and should be considered as the first option.

The widespread use of Internet-of-Things (IoT) technologies, smartphones, and social media services generates huge amounts of data streaming at high velocity. Automatic interpretation of these rapidly arriving data streams is required for the timely detection of interesting events that usually emerge in the form of clusters. This article proposes a new relative of the visual assessment of the cluster tendency (VAT) model, which produces a record of structural evolution in the data stream by building a cluster heat map of the entire processing history in the stream. The existing VAT-based algorithms for streaming data, called inc-VAT/inc-iVAT and dec-VAT/dec-iVAT, are not suitable for high-velocity and high-volume streaming data because of high memory requirements and slower processing speed as the accumulated data increases. The scalable iVAT (siVAT) algorithm can handle big batch data, but for streaming data, it needs to be (re)applied everytime a new datapoint arrives, which is not feasible due to the associated computation complexities. To address this problem, we propose an incremental siVAT algorithm, called inc-siVAT, which deals with the streaming data in chunks. It first extracts a small size smart sample using an intelligent sampling scheme, called maximin random sampling (MMRS), then incrementally updates the smart sample points on the fly, using our novel incremental MMRS (inc-MMRS) algorithm, to reflect changes in the data stream after each chunk is processed, and finally, produces an incrementally built iVAT image of the updated smart sample, using the inc-VAT/inc-iVAT and dec-VAT/dec-iVAT algorithms. These images can be used to visualize the evolving cluster structure and for anomaly detection in streaming data. Our method is illustrated with one synthetic and four real datasets, two of which evolve significantly over time. Our numerical experiments demonstrate the algorithm's ability to successfully identify anomalies and visualize changing cluster structure in streaming data.

Due to the widespread functional benefits, such as supporting internet connectivity, having high visibility and enabling easy connectivity between sensors, the Internet of Things (IoT) has become popular and used in many applications, such as for smart city, smart health, smart home, and smart vehicle realizations. These IoT-based systems contribute to both daily life and business, including sensitive and emergency situations. In general, the devices or sensors used in the IoT have very limited computational power, storage capacity, and communication capabilities, but they help to collect a large amount of data as well as maintain communication with the other devices in the network. Since most of the IoT devices have no physical security, and often are open to everyone via radio communication and via the internet, they are highly vulnerable to existing and emerging novel security attacks. Further, the IoT devices are usually integrated with the corporate networks; in this case, the impact of attacks will be much more significant than operating in isolation. Due to the constraints of the IoT devices, and the nature of their operation, existing security mechanisms are less effective for countering the attacks that are specific to the IoT-based systems. This article presents a new insider attack, namedloophole attack, that exploits the vulnerabilities present in a widely used IPv6 routing protocol in IoT-based systems, calledRPL(Routing over Low Power and Lossy Networks). To protect the IoT system from this insider attack, a machine learning based security mechanism is presented. The proposed attack has been implemented using a Contiki IoT operating system that runs on the Cooja simulator, and the impacts of the attack are analyzed. Evaluation on the collected network traffic data demonstrates that the machine learning based approaches, along with the proposed features, help to accurately detect the insider attack from the network traffic data.

To provide effective services for intelligent transportation systems (ITS), such as optimizing ride services and recommending trips, it is important to predict the distributions of passenger flows from various origins to destinations. However, existing crowd flow prediction models have not sufficiently addressed this problem, and most methods have only focused on in and out flows of individual regions. The main challenges of origin-destination (OD) crowd flow prediction are diverse flow patterns across city networks and data sparsity. To solve these problems, we propose a Multi Attention 3D Residual Network (MAThR) to predict city-wide OD crowd flows. In particular, we develop a multi-component 3D residual structure with a novel global self-attention mechanism to dynamically aggregate the OD spatial-temporal dependencies, by modeling three components: contextual information of the region, and long and short term periodic crowd flows. For each component, we design a tensor criss-cross self-attention block, which can simultaneously discover the global and local correlation of spatial (where), temporal (when) and contextual (which) information between all OD pairs. Evaluation on real-world crowd flow data demonstrates the advantages of our MAThR method on prediction accuracy, compared to other existing state-of-the-art methods.

Summary This research presents a novel framework comprising the IPS gateway, analysis system, and honeypot for identifying and detecting ransomware based on the client honeypot concept, and active interception of downloads using Suricata inline intruder prevention system. Unlike previous frameworks that report on the accuracy rate of detecting ransomware, the proposed framework features a multiple voting platform for the validation of confidence levels in the accuracy detection rates. The proposed framework achieves high accuracy levels than other machine learning models for the detection of ransomware.

A new support vector machine (SVM) variant, called CS++-SVM, is presented combining multiclass classification and anomaly detection in a single-step process to create a trained machine that can simultaneously classify test data belonging to classes represented in the training set and label as anomalous test data belonging to classes not represented in the training set. A theoretical analysis of the properties of the new method, showing how it combines properties inherited both from the conic-segmentation SVM (CS-SVM) and the $1$-class SVM (to which the method described reduces to in the case of unlabelled training data), is given. Finally, experimental results are presented to demonstrate the effectiveness of the algorithm for both simulated and real-world data.

Detecting emotional states of human from videos is essential in order to automate the process of profiling human behaviour, which has applications in a variety of domains, such as social, medical and behavioural science. Considerable research has been carried out for binary classification of emotions using facial expressions. However, a challenge exists to automate the feature extraction process to recognise the various intensities or levels of emotions. The intensity information of emotions is essential for tasks such as sentiment analysis. In this work, we propose a metric-based intensity estimation mechanism for primary emotions, and a deep hybrid convolutional neural network-based approach to recognise the defined intensities of the primary emotions from spontaneous and posed sequences. Further, we extend the intensity estimation approach to detect the basic emotions. The frame level facial action coding system annotations and the intensities of action units associated with each primary emotion are considered for deriving the various intensity levels of emotions. The evaluation on benchmark datasets demonstrates that our proposed approach is capable of correctly classifying the various intensity levels of emotions as well as detecting them.

Anomalous event detection in videos is an important and challenging task. This paper proposes a deep representation approach to the problem, which extracts and represents features in an unsupervised way. This algorithm can detect anomalous activity like standing statically and loitering among a crowd of people. Our proposed framework is a two-channel scheme by using feature channels extracted from the appearance and foreground of the original video. Two hybrid deep learning architectures SDAE-DBN-PSVM (a four-layer Stacked Denoising Auto-encoder with three-layer Deep Belief Nets and Plane-based one class SVM) are implemented for these two channels to learn the high-level feature representation automatically and produce two anomaly scores. Finally, a fusion scheme is proposed for combining anomaly scores and detecting anomalous events. Experimental results on a large real-world dataset (MCG) and two benchmark datasets (UCSD and Subway) demonstrate the effectiveness of this approach. Furthermore, quantitative analyses of the effects of the amount of training data and the illumination conditions of the video on the accuracy of anomaly detection are presented.

Trajectory prediction (TP) is of great importance for a wide range of location-based applications in intelligent transport systems, such as location-based advertising, route planning, traffic management, and early warning systems. In the last few years, the widespread use of GPS navigation systems and wireless communication technology enabled vehicles has resulted in huge volumes of trajectory data. The task of utilizing these data employing spatio-temporal techniques for TP in an efficient and accurate manner is an ongoing research problem. Existing TP approaches are limited to the short-term predictions. Moreover, they cannot handle a large volume of trajectory data for long-term prediction. To address these limitations, we propose a scalable clustering and Markov chain-based hybrid framework, called Traj-clusiVAT-based TP, for both short- and long-term TPs, which can handle a large number of overlapping trajectories in a dense road network. Traj-clusiVAT can also determine the number of clusters, which represent different movement behaviors in input trajectory data. In our experiments, we compare our proposed approach with a mixed Markov model-based scheme and a trajectory clustering, NETSCAN-based TP method for both short- and long-term TPs. We performed our experiments on two real, vehicle trajectory datasets, including a large-scale trajectory dataset consisting of 3.28 million trajectories obtained from 15 061 taxis in Singapore over a period of one month. The experimental results on two real trajectory datasets show that our proposed approach outperforms the existing approaches in terms of both short- and long-term prediction performances, based on the prediction accuracy and distance error (in km).

Clustering large volumes of high-dimensional data is a challenging task. Many clustering algorithms have been developed to address either handling datasets with a very large sample size or with a very high number of dimensions, but they are often impractical when the data is large in both aspects. To simultaneously overcome both the `curse of dimensionality' problem due to high dimensions and scalability problems due to large sample size, we propose a new fast clustering algorithm called FensiVAT. FensiVAT is a hybrid, ensemble-based clustering algorithm which uses fast data-space reduction and an intelligent sampling strategy. In addition to clustering, FensiVAT also provides visual evidence that is used to estimate the number of clusters (cluster tendency assessment) in the data. In our experiments, we compare FensiVAT with nine state-of-the-art approaches which are popular for large sample size or high-dimensional data clustering. Experimental results suggest that FensiVAT, which can cluster large volumes of high-dimensional datasets in a few seconds, is the fastest and most accurate method of the ones tested.

Subspace clustering aims to find groups of similar objects (clusters) that exist in lower dimensional subspaces from a high dimensional dataset. It has a wide range of applications, such as analysing high dimensional sensor data or DNA sequences. However, existing algorithms have limitations in finding clusters in non-disjoint subspaces and scaling to large data, which impinge their applicability in areas such as bioinformatics and the Internet of Things. We aim to address such limitations by proposing a subspace clustering algorithm using a bottom-up strategy. Our algorithm first searches for base clusters in low dimensional subspaces. It then forms clusters in higher-dimensional subspaces using these base clusters, which we formulate as a frequent pattern mining problem. This formulation enables efficient search for clusters in higher-dimensional subspaces, which is done using FP-trees. The proposed algorithm is evaluated against traditional bottom-up clustering algorithms and state-of-the-art subspace clustering algorithms. The experimental results show that the proposed algorithm produces clusters with high accuracy, and scales well to large volumes of data. We also demonstrate the algorithm's performance using real-life ten genomic datasets.

The problem of determining whether clusters are present in numerical data (tendency assessment) is an important first step of cluster analysis. One tool for cluster tendency assessment is the visual assessment of tendency (VAT) algorithm. VAT and improved VAT (iVAT) produce an image that provides visual evidence about the number of clusters to seek in the original dataset. These methods have been successful in determining potential cluster structure in various datasets, but they can be computationally expensive for datasets with a very large number of samples. A scalable version of iVAT called siVAT approximates iVAT images, but siVAT can be computationally expensive for big datasets. In this article, we introduce a modification of siVAT called siVAT+ which approximates cluster heat maps for large volumes of high dimensional data much more rapidly than siVAT. We compare siVAT+ with siVAT on six large, high dimensional datasets. Experimental results confirm that siVAT+ obtains images similar to siVAT images in a few seconds, and is 8 - 55 times faster than siVAT.

Real-time environment monitoring and analysis is an important research area of Internet of Things (IoT). Understanding the behavior of the complex ecosystem requires analysis of detailed observations of an environment over a range of different conditions. One such example in urban areas includes the study of tree canopy cover over the microclimate environment using heterogeneous sensor data. There are several challenges that need to be addressed, such as obtaining reliable and detailed observations over monitoring area, detecting unusual events from data, and visualizing events in real-time in a way that is easily understandable by the end users (e.g., city councils). In this regard, we propose an integrated geovisualization framework, built for real-time wireless sensor network data on the synergy of computational intelligence and visual methods, to analyze complex patterns of urban microclimate. A Bayesian maximum entropy-based method and a hyperellipsoidal model-based algorithm have been build in our integrated framework to address above challenges. The proposed integrated framework was verified using the dataset from an indoor and two outdoor network of IoT devices deployed at two strategically selected locations in Melbourne, Australia. The data from these deployments are used for evaluation and demonstration of these components' functionality along with the designed interactive visualization components.

Random projection is a popular method for dimensionality reduction due to its simplicity and efficiency. In the past few years, random projection and fuzzy c-means based cluster ensemble approaches have been developed for high-dimensional data clustering. However, they require large amounts of space for storing a big affinity matrix, and incur large computation time while clustering in this affinity matrix. In this paper, we propose a new random projection, fuzzy c-means based cluster ensemble framework for high-dimensional data. Our framework uses cumulative agreement to aggregate fuzzy partitions. Fuzzy partitions of random projections are ranked using external and internal cluster validity indices. The best partition in the ranked queue is the core (or base) partition. Remaining partitions then provide cumulative inputs to the core, thus, arriving at a consensus best overall partition built from the ensemble. Experimental results with Gaussian mixture datasets and a variety of real datasets demonstrate that our approach outperforms three state-of-the-art methods in terms of accuracy and space-time complexity. Our algorithm runs one to two orders of magnitude faster than other state-of-the-arts algorithms.

Clustering of large-scale vehicle trajectories is an important aspect for understanding urban traffic patterns, particularly for optimizing public transport routes and frequencies and improving the decisions made by authorities. Existing trajectory clustering schemes are not well suited to large numbers of trajectories in dense city road networks due to the difficulty in finding a representative distance measure between trajectories that can scale to very large datasets. In this paper, we propose a novel Dijkstra-based dynamic time warping distance measure, trajDTW between two trajectories, which is suitable for large numbers of overlapping trajectories in a dense road network as found in major cities around the world. We also propose a novel fast-clusiVAT algorithm that can suggest the number of clusters in a trajectory dataset and identify and visualize the trajectories belonging to each cluster. We conduct experiments on a large-scale taxi trajectory dataset consisting of 3.28 million trajectories obtained from the GPS traces of 15 061 taxis within Singapore over a period of one month. Our analysis finds 13 trajectory clusters spanning the major expressways of Singapore, each of which can be further divided into two sub-clusters based on the travel direction. For each cluster, we provide a time-based distribution of trajectories to yield insights into how urban mobility patterns change with the time of day. We compare the trajectory clusters obtained using our approach with those obtained using popular general and trajectory specific clustering frameworks: DBSCAN, OPTICS, NETSCAN, and NEAT. We demonstrate that the clusters obtained using our novel fast-clusiVAT framework are better than those obtained using other clustering schemes, evaluated based on two internal cluster validity measures: Dunn's and Silhouette indices. Moreover, our fast-clusiVAT algorithm achieves significant speedup over a comparable approach without loss of cluster quality.

One-class support vector machines (OCSVMs) are very effective for semisupervised anomaly detection. However, their performance strongly depends on the settings of their hyperparameters, which has not been well studied. Moreover, unavailability of a clean training set that only comprises normal data in many real-life problems has given rise to the application of OCSVMs in an unsupervised manner. However, it has been shown that if the training set includes anomalies, the normal boundary created by OCSVMs is prone to skew toward the anomalies. This problem decreases the detection rate of anomalies and results in poor performance of the classifier. In this paper, we propose a new technique to set the hyperparameters and clean suspected anomalies from unlabelled training sets. The proposed method removes suspected anomalies based on a $K$ -nearest neighbors technique, which is then used to directly estimate the hyperparameters. We examine several benchmark data sets with diverse distributions and dimensionality. Our findings suggest that on the examined data sets, the proposed technique is roughly 70 times faster than supervised parameter estimation via grid-search and cross validation, and one to three orders of magnitude faster than broadly used semisupervised and unsupervised parameter estimation methods for OCSVMs. Moreover, our method statistically outperforms those semisupervised and unsupervised methods and its accuracy is comparable to supervised grid-search and cross validation.

One of the most crucial tasks for utility companies is load forecasting in order to plan future demand for generation capacity and infrastructure. Improving load forecasting accuracy over a short period is a challenging open problem due to the variety of factors that influence the load, and the volume of data that needs to be considered. This paper proposes a new approach for short term load forecasting using an effective new combination of clustering and deep learning methods, along with a new weighted aggregation mechanism. Our evaluation using smart meter data from a publicly available real-life dataset demonstrates the improved accuracy of our approach over existing methods.

Anomaly detection is important for time-critical Internet of Things (IoT) applications, such as healthcare and emergency management. The recent introduction of Fog computing architecture provides an efficient platform for delay sensitive IoT applications. Exploiting the advantages of Fog computing for anomaly detection provides the ability to detect abnormal patterns in an accurate and timely manner. Use of Centralized and Distributed anomaly detection methods suffer from significant latency and energy consumption issues. Hence, we propose a novel anomaly detection method, called Fog-Empowered anomaly detection, by harnessing the processing power of the Fog computing platform and using an efficient hyperellipsoidal clustering algorithm. The end nodes in the Fog computing architecture do not perform any processing or clustering on the data. The Fog layer and the Cloud layer nodes perform the clustering and anomaly detection process, thus helping to achieve anomaly detection in a timely manner. The evaluation using synthetic and real datasets demonstrates that our proposed approach achieves a significant reduction in latency and energy consumption compared to the Distributed and Centralized schemes, while achieving a comparable detection accuracy compared to a Centralized scheme.

With the advancement in the Internet of Things (IoT) technologies, variety of sensors including inexpensive, low-precision sensors with sufficient computing and communication capabilities are increasingly deployed for monitoring large geographical areas. One of the problems with the use of inexpensive sensors is that they often suffer from random or systematic errors such as drift. The sensor drift is the result of slow changes that occur in the measurement driven by aging, loss of calibration, and changes in the phenomena being monitored over a time period. These drifting sensors need to be calibrated automatically for continuous and reliable monitoring. Existing methods for drift detection and correction do not consider the measurement errors or uncertainties present in those inexpensive low-precision sensors, hence, resulting in unreliable drift estimates. In this article, we propose a novel framework to automatically detect and correct the drifts by employing Bayesian Maximum Entropy (BME) and Kalman filtering (KF) techniques. The BME method is a spatiotemporal estimation method that incorporates the measurement errors of low-precision sensors as interval quantities along with the high-precision sensor measurements in their computations. Our scheme can be implemented in a centralized as well as in a distributed manner to detect and correct the drift generated in the sensors. For the centralized scheme, we compare several Kriging-based estimation techniques in combination with KF, and show the superiority of our proposed BME-based method in detecting and correcting the drift. We also propose a multivariate BME framework for drift detection, in which multiple features can be used to improve the drift estimates. To demonstrate the applicability of our distributed approach on a real-world application scenario, we implemented our algorithm on each wireless sensor node in order to perform in-network drift detection. The evaluation on real IoT datasets gathered from an indoor and an outdoor deployments reveal the superiority of our method in correctly identifying and correcting the drifts that develop in the sensors, in real time, compared to the existing approaches in the literature.

With the emergence of data streaming applications that produce large data in motion, anomaly detection in non-stationary environments has become a major research focus. Unknown and unstable behaviour of data over time, limits the application of traditional anomaly detection methods that have been designed for stationary data. Moreover, basic assumptions of many existing works in the adaptive anomaly detection domain, such as the availability of labelled data over time or dealing with a known type of change in the data, are not valid for real-life applications. In this paper, we propose an unsupervised ensemble based anomaly detection method using One Class Support Vector Machines (OCSVMs). The proposed method is able to detect potential changes in the distribution of the normal data and adapts itself accordingly, without requiring any external feedback, e.g., ground truth labels. Moreover, it is able to automatically select an appropriate set of recent instances during learning phases, and an appropriate set of models during prediction phases by identifying active concepts. We evaluate our proposed method against state-of-the-art adaptive anomaly detection methods that can be applied in an unsupervised manner, on both real and synthetic non-stationary data. The results show that with considerably lower computational cost, our method outperforms the other methods.

Identifying unusual or anomalous patterns in an underlying dataset is an important but challenging task in many applications. The focus of the unsupervised anomaly detection literature has mostly been on vectorised data. However, many applications are more naturally described using higher-order tensor representations. Approaches that vectorise tensorial data can destroy the structural information encoded in the high-dimensional space, and lead to the problem of the curse of dimensionality. In this paper we present the first unsupervised tensorial anomaly detection method, along with a randomised version of our method. Our anomaly detection method, the One-class Support Tensor Machine (1STM), is a generalisation of conventional one-class Support Vector Machines to higher-order spaces. 1STM preserves the multiway structure of tensor data, while achieving significant improvement in accuracy and efficiency over conventional vectorised methods. We then leverage the theory of nonlinear random projections to propose the Randomised 1STM (R1STM). Our empirical analysis on several real and synthetic datasets shows that our R1STM algorithm delivers comparable or better accuracy to a state-of-the-art deep learning method and traditional kernelised approaches for anomaly detection, while being approximately 100 times faster in training and testing.

Clustering of big data has received much attention recently. In this paper, we present a new clusiVAT algorithm and compare it with four other popular data clustering algorithms. Three of the four comparison methods are based on the well known, classical batch k -means model. Specifically, we use k -means, single pass k -means, online k -means, and clustering using representatives (CURE) for numerical comparisons. clusiVAT is based on sampling the data, imaging the reordered distance matrix to estimate the number of clusters in the data visually, clustering the samples using a relative of single linkage (SL), and then noniteratively extending the labels to the rest of the data-set using the nearest prototype rule. Previous work has established that clusiVAT produces true SL clusters in compact-separated data. We have performed experiments to show that k -means and its modified algorithms suffer from initialization issues that cause many failures. On the other hand, clusiVAT needs no initialization, and almost always finds partitions that accurately match ground truth labels in labeled data. CURE also finds SL type partitions but is much slower than the other four algorithms. In our experiments, clusiVAT proves to be the fastest and most accurate of the five algorithms; e.g., it recovers 97% of the ground truth labels in the real world KDD-99 cup data (4 292 637 samples in 41 dimensions) in 76 s.

The growth in pervasive network infrastructure called the Internet of Things (IoT) enables a wide range of physical objects and environments to be monitored in fine spatial and temporal detail. The detailed, dynamic data that are collected in large quantities from sensor devices provide the basis for a variety of applications. Automatic interpretation of these evolving large data is required for timely detection of interesting events. This article develops and exemplifies two new relatives of the visual assessment of tendency (VAT) and improved visual assessment of tendency (iVAT) models, which uses cluster heat maps to visualize structure in static datasets. One new model is initialized with a static VAT/iVAT image, and then incrementally (hence inc-VAT/inc-iVAT) updates the current minimal spanning tree (MST) used by VAT with an efficient edge insertion scheme. Similarly, dec-VAT/dec-iVAT efficiently removes a node from the current VAT MST. A sequence of inc-iVAT/dec-iVAT images can be used for (visual) anomaly detection in evolving data streams and for sliding window based cluster assessment for time series data. The method is illustrated with four real datasets (three of them being smart city IoT data). The evaluation demonstrates the algorithms’ ability to successfully isolate anomalies and visualize changing cluster structure in the streaming data.

The problem of unsupervised anomaly detection arises in awide variety of practical applications. While one-class sup-port vector machines have demonstrated their effectiveness asan anomaly detection technique, their ability to model largedatasets is limited due to their memory and time complexityfor training. To address this issue for supervised learning ofkernel machines, there has been growing interest in randomprojection methods as an alternative to the computationallyexpensive problems of kernel matrix construction and sup-port vector optimisation. In this paper we leverage the theoryof nonlinear random projections and propose the RandomisedOne-class SVM (R1SVM), which is an efficient and scalableanomaly detection technique that can be trained on large-scale datasets. Our empirical analysis on several real-life andsynthetic datasets shows that our randomised 1SVM algo-rithm achieves comparable or better accuracy to deep autoen-coder and traditional kernelised approaches for anomaly de-tection, while being approximately 100 times faster in train-ing and testing

Pedestrians movements have a major impact on the dynamics of cities and provide valuable guidance to city planners. In this paper we model the normal behaviours of pedestrian flows and detect anomalous events from pedestrian counting data of the City of Melbourne. Since the data spans an extended period, and pedestrian activities can change intermittently (e.g., activities in winter vs. summer), we applied an Ensemble Switching Model, which is a dynamic anomaly detection technique that can accommodate systems that switch between different states. The results are compared with those produced by a static clustering model (HyCARCE) and also cross-validated with known events. We found that the results from the Ensemble Switching Model are valid and more accurate than HyCARCE.

Cognitive radio (CR) provides the ability to sense the range of frequencies (spectrum) that are not utilized by the incumbent user (primary user) and to opportunistically use the unoccupied spectrum in a heterogeneous environment. This can use a collaborative spectrum sensing approach to detect the spectrum holes. However, this nature of the collaborative mechanism is vulnerable to security attacks and faulty observations communicated by the opportunistic users (secondary users). Detecting such malicious users in CR networks is challenging as the pattern of malicious behavior is unknown apriori. In this paper we present an unsupervised approach to detect those malicious users, utilizing the pattern of their historic behavior. Our evaluation reveals that the proposed scheme effectively detects the malicious data in the system and provides a robust framework for CR to operate in this environment.

Wireless sensor networks are often deployed in large numbers, over a large geographical region, in order to monitor the phenomena of interest. Sensors used in the sensor networks often suffer from random or systematic errors such as drift and bias. Even if they are calibrated at the time of deployment, they tend to drift as time progresses. Consequently, the progressive manual calibration of such a large-scale sensor network becomes impossible in practice. In this article, we address this challenge by proposing a collaborative framework to automatically detect and correct the drift in order to keep the data collected from these networks reliable. We propose a novel scheme that uses geospatial estimation-based interpolation techniques on measurements from neighboring sensors to collaboratively predict the value of phenomenon being observed. The predicted values are then used iteratively to correct the sensor drift by means of a Kalman filter. Our scheme can be implemented in a centralized as well as distributed manner to detect and correct the drift generated in the sensors. For centralized implementation of our scheme, we compare several kriging- and nonkriging-based geospatial estimation techniques in combination with the Kalman filter, and show the superiority of the kriging-based methods in detecting and correcting the drift. To demonstrate the applicability of our distributed approach on a real world application scenario, we implement our algorithm on a network consisting of Wireless Sensor Network (WSN) hardware. We further evaluate single as well as multiple drifting sensor scenarios to show the effectiveness of our algorithm for detecting and correcting drift. Further, we address the issue of high power usage for data transmission among neighboring nodes leading to low network lifetime for the distributed approach by proposing two power saving schemes. Moreover, we compare our algorithm with a blind calibration scheme in the literature and demonstrate its superiority in detecting both linear and nonlinear drifts.

Large scale monitoring applications require large numbers of sensors deployed in a region for accurate and high resolution spatio-temporal measurements and estimation. This can be achieved practically by deploying a mix of high capacity, high precision, expensive and low capacity, low precision, cheap sensors in the monitored region. However, the resource constrained nature of low-capacity sensors, and the availability of limited numbers of high-capacity sensors are a challenge to achieving highly accurate estimations. In this paper we propose a framework combining Bayesian compressive sensing and a robust Bayesian maximum entropy based spatio-temporal estimation technique to address this important problem. Evaluation on real wireless sensor network data reveals the trade-off between the spatio-temporal estimation accuracy and the communication overhead incurred in the network, and provides a mechanism to choose the right compressive ratios, such that a given estimation accuracy is achieved for a known communication overhead in the network.

Increased levels of particulate matter (PM) in the atmosphere have contributed to an increase in mortality and morbidity in communities and are the main contributing factor for respiratory health problems in the population. Currently, PM concentrations are sparsely monitored; for instance, a region of over 2200 square kilometers surrounding Melbourne in Victoria, Australia, is monitored using ten sensor stations. This paper proposes to improve the estimation of PM concentration by complementing the existing high-precision but expensive PM devices with low-cost lower precision PM sensor nodes. Our evaluation reveals that local PM estimation accuracies improve with higher densities of low-precision sensor nodes. Our analysis examines the impact of the precision of the lost-cost sensors on the overall estimation accuracy.

ABSTRACT Two new incremental models for online anomaly detection in data streams at nodes inwireless sensor networksare discussed. These models are incremental versions of a model that uses ellipsoids to detect first, second, and higher‐ordered anomaliesin arrears. The incremental versions can also be used this way but have additional capabilities offered by processing data incrementally as they arrive in time. Specifically, they can detect anomalies ‘on‐the‐fly’ in near real time. They can also be used to track temporal changes in near real‐time because of sensor drift, cyclic variation, or seasonal changes. One of the new models has a mechanism that enables graceful degradation of inputs in the distant past (fading memory). Three real datasets from single sensors in deployed environmental monitoring networks are used to illustrate various facets of the new models. Examples compare the incremental version with the previous batch and dynamic models and show that the incremental versions can detect various types of dynamic anomalies in near real time. Copyright © 2012 John Wiley & Sons, Ltd.

Recent algorithmic and computational improvements have reduced the time it takes to build a minimal spanning tree (MST) for big data sets. In this paper we compare single linkage clustering based on MSTs built with the Filter-Kruskal method to the proposed clusiVAT algorithm, which is based on sampling the data, imaging the sample to estimate the number of clusters, followed by non-iterative extension of the labels to the rest of the big data with the nearest prototype rule. Numerical experiments with both synthetic and real data confirm the theory that clusiVAT produces true single linkage clusters in compact, separated data. We also show that single linkage fails, while clusiVAT finds high quality partitions that match ground truth labels very well. And clusiVAT is fast: it recovers the preferred c = 3 Gaussian clusters in a mixture of 1 million two-dimensional data points with 100% accuracy in 3.1 seconds.

The sustainable management of coastal and offshore ecosystems, such as for example coral reef environments, requires an energy efficient collection of accurate data across various temporal and spatial scales. To suitably address the energy supply of marine sensors, in this paper a novel energy harvesting device is proposed, based on a Tubular Permanent MagnetLinear Generator (TPM-LiG). The application is related to the sea wave energy conversion for small sensorized buoy. The optimization process is developed by means of evolutionary computation techniques. The advantage of these algorithms is in the wide exploration of the variables space and in the effective exploitation of the fitness function. The algorithm has been tested on a benchmark case and then applied to the optimization of a power-buoy prototype which has been realized in laboratory with potential significant implications in future marine environment applications.

Internet-of-Things (IoT) is a concept referring to interconnected people and objects and smart city is one of the many applications of IoT. Wireless Sensor Network (WSN) is a specific technology that helps to create “Smart Cities”. It aims at creating a distributed network of intelligent sensor nodes which can measure various parameters for efficient management of the city. The data thus collected through a range of sensors is processed and is delivered wirelessly in real-time to the citizens or the appropriate authorities. Since the application framework for smart city application is huge, it would require a large number of different types of sensors for its implementation and the project could be viable only if we use low resolution, low precision but inexpensive sensors. The sensors in sensor network can suffer from random or systematic errors. Most common problem with inexpensive sensors used in WSNs for smart city applications is of drift and bias. They can be calibrated at the time of deployment, but they develop drift, which is the slow change in the reading of sensor from actual value as time progresses. In this paper we have proposed a framework to automatically detect and correct the drift of the sensor nodes to keep the WSN usable. Kriging based interpolation of the sensor readings of neighboring sensors is used to predict actual value at the sensor node and the measured drift is then kalman filtered to get correct drift estimates. We have demonstrated the results of this algorithm on real sensor data obtained from Intel Research Berkeley Laboratory deployment and shown that our system is able to detect and correct smooth drift and bias generated in the sensors. We have also shown that our system is robust with respect to the number of sensor nodes drifting and significantly outperforms the traditional averaging based interpolation methods.

One of the applications that motivates this research is a system for detection of the anomalies in wireless sensor networks (WSNs). Individual sensor measurements are converted to ellipsoidal summaries; a data matrix D is built using a dissimilarity measure between pairs of ellipsoids; clusters of ellipsoids are suggested by dark blocks along the diagonal of an iVAT (improved Visual Assessment of Tendency) image of D; and finally, the single linkage algorithm extracts clusters from D, using the iVAT image as a guide to the selection of an optimal partition. We illustrate this model for higher dimensional data with synthetic, real and benchmark data sets. Our examples show that two of the four measures, viz, Focal distance and Bhattacharyya distance, provide very similar and reliable bases for estimating cluster structures in sets of higher dimensional ellipsoids, that single linkage can successfully extract the indicated clusters, and that our model can find both first and second order anomalies in WSN data.

Anomaly detection in a Wireless Sensor Network is an important aspect of data analysis in order to facilitate intrusion and event detection. A key challenge is creating optimal classifiers constructed from training sets in which the anomaly rates are varying due to the existence of non-stationary distributions in the data. In this paper we propose an adaptive algorithm that can dynamically adjust the anomaly rate parameter, which can be represented by a model parameter of a one-class quarter-sphere support vector machine. This algorithm operates in an online, iterative manner producing an optimal model for a training set, which is presented sequentially. Our evaluations demonstrate that our algorithm is capable of constructing optimal models for a training set that minimizes the error rate on the classification set compared to a static model, where the anomaly rate is kept stationary.

Wireless Sensor Networks (WSNs) provide a low cost option for gathering spatially dense data from different environments. However, WSNs have limited energy resources that hinder the dissemination of the raw data over the network to a central location. This has stimulated research into efficient data mining approaches, which can exploit the restricted computational capabilities of the sensors to model their normal behavior. Having a normal model of the network, sensors can then forward anomalous measurements to the base station. Most of the current data modeling approaches proposed for WSNs require a fixed offline training period and use batch training in contrast to the real streaming nature of data in these networks. In addition they usually work in stationary environments. In this paper we present an efficient online model construction algorithm that captures the normal behavior of the system. Our model is capable of tracking changes in the data distribution in the monitored environment. We illustrate the proposed algorithm with numerical results on both real-life and simulated data sets, which demonstrate the efficiency and accuracy of our approach compared to existing methods.

Fuzzy boundaries and unpredictable anomalies displayed in the raw sensor data make the process of defining a strong ellipsoid boundary for the raw data in the ellipsoid-based anomaly detection algorithms in wireless sensor networks a difficult problem. We have shown, using synthetic and real sensor data, that the random variable that represents the difference between any two randomly selected raw data points follows an identically independently distributed Gaussian distribution. We have used this statistical property to calculate ellipsoid boundaries for the Gaussian distribution which displays a robust ellipsoid shape and then to map each point of the distribution function to its corresponding raw data point to isolate anomalies from the sensor data. We have demonstrated the performance of the proposed approach by comparing it with the standard approach using both synthetic datasets and real Intel Berkeley Research Laboratory and Grand St Bernard datasets.

Anomaly detection in wireless sensor networks is an important challenge for tasks such as intrusion detection and monitoring applications. This paper proposes two approaches to detecting anomalies from measurements from sensor networks. The first approach is a linear programming-based hyperellipsoidal formulation, which is called a centered hyperellipsoidal support vector machine (CESVM). While this CESVM approach has advantages in terms of its flexibility in the selection of parameters and the computational complexity, it has limited scope for distributed implementation in sensor networks. In our second approach, we propose a distributed anomaly detection algorithm for sensor networks using a one-class quarter-sphere support vector machine (QSSVM). Here a hypersphere is found that captures normal data vectors in a higher dimensional space for each sensor node. Then summary information about the hyperspheres is communicated among the nodes to arrive at a global hypersphere, which is used by the sensors to identify any anomalies in their measurements. We show that the CESVM and QSSVM formulations can both achieve high detection accuracies on a variety of real and synthetic data sets. Our evaluation of the distributed algorithm using QSSVM reveals that it detects anomalies with comparable accuracy and less communication overhead than a centralized approach.

Anomalies in wireless sensor networks can occur due to malicious attacks, faulty sensors, changes in the observed external phenomena, or errors in communication. Defining and detecting these interesting events in energy-constrained situations is an important task in managing these types of networks. A key challenge is how to detect anomalies with few false alarms while preserving the limited energy in the network. In this article, we define different types of anomalies that occur in wireless sensor networks and provide formal models for them. We illustrate the model using statistical parameters on a dataset gathered from a real wireless sensor network deployment at the Intel Berkeley Research Laboratory. Our experiments with a novel distributed anomaly detection algorithm show that it can detect elliptical anomalies with exactly the same accuracy as that of a centralized scheme, while achieving a significant reduction in energy consumption in the network. Finally, we demonstrate that our model compares favorably to four other well-known schemes on four datasets.

A challenge in using machine learning for tasks such as network intrusion detection and fault diagnosis is the difficulty in obtaining clean data for training in order to model the normal behavior of the system. Unsupervised anomaly detection techniques such as one class support vector machines (SVMs) have been introduced to overcome this difficulty. One class support vector machines model the normal or target data using non-linear surfaces in the input space while ignoring the anomalous data. Our approach to this problem is based on fitting a hyperellipsoid with a minimal effective radius, centered at the origin, around a majority of the data vectors in a higher dimensional space. We formulate this as a linear optimisation problem, which is advantageous in terms of its computational complexity. We demonstrate using real data from the great duck Island Project that our approach achieves better detection performance and flexibility in terms of parameter selection, compared to an earlier detection scheme using a quarter sphere SVM.

Anomaly detection is an important challenge for tasks such as fault diagnosis and intrusion detection in energy constrained wireless sensor networks. A key problem is how to minimise the communication overhead in the network while performing in-network computation when detecting anomalies. Our approach to this problem is based on a formulation that uses distributed, one-class quarter-sphere support vector machines to identify anomalous measurements in the data. We demonstrate using sensor data from the Great Duck Island Project that our distributed approach is energy efficient in terms of communication overhead while achieving comparable accuracy to a centralised scheme.