Adaptive Anomaly Detection for IoT Data in Hierarchical Edge Computing
Singapore University of Technology and Design（新加坡科技设计大学）；CNRS（法国国家科学研究中心）；SAMOVAR（萨莫瓦实验室）；Telecom Sud Paris（巴黎南部电信学院）；Institut Mines-Telecom（矿业电信学院）；Paris-Saclay University（巴黎萨克雷大学）；Missouri University of Science and Technology（密苏里科技大学）；Institute for Infocomm Research, A*STAR（新加坡科技研究局资讯通信研究院）
Mao V. Ngo, Hakima Chaouchi, Tie Luo, Tony Q. S. Quek
备注：
To be published in the AAAI Workshop on Artificial Intelligence of Things (AIoT), Feb 2020
Advances in deep neural networks (DNN) greatly bolster real-time detection of anomalous IoT data. However, IoT devices can barely afford complex DNN models due to limited computational power and energy supply. While one can offload anomaly detection tasks to the cloud, it incurs long delay and requires large bandwidth when thousands of IoT devices stream data to the cloud concurrently. In this paper, we propose an adaptive anomaly detection approach for hierarchical edge computing (HEC) systems to solve this problem. Specifically, we first construct three anomaly detection DNN models of increasing complexity, and associate them with the three layers of HEC from bottom to top, i.e., IoT devices, edge servers, and cloud. Then, we design an adaptive scheme to select one of the models based on the contextual information extracted from input data, to perform anomaly detection. The selection is formulated as a contextual bandit problem and is characterized by a single-step Markov decision process, with an objective of achieving high detection accuracy and low detection delay simultaneously. We evaluate our proposed approach using a real IoT dataset, and demonstrate that it reduces detection delay by 84% while maintaining almost the same accuracy as compared to offloading detection tasks to the cloud. In addition, our evaluation also shows that it outperforms other baseline schemes.
The Internet of Things (IoT) is a system that connects physical computing devices, sensors, software, and other technologies. Data can be collected, transferred, and exchanged with other devices over the network without requiring human interactions. One challenge the development of IoT faces is the existence of anomaly data in the network. Therefore, research on anomaly detection in the IoT environment has become popular and necessary in recent years. This survey provides an overview to understand the current progress of the different anomaly detection algorithms and how they can be applied in…
In the era of Internet of Things (IoT), network-wide anomaly detection is a crucial part of monitoring IoT networks due to the inherent security vulnerabilities of most IoT devices. Principal Components Analysis (PCA) has been proposed to separate network traffics into two disjoint subspaces corresponding to normal and malicious behaviors for anomaly detection. However, the privacy concerns and limitations of devices' computing resources compromise the practical effectiveness of PCA. We propose a federated PCA-based Grassmannian optimization framework that coordinates IoT devices to aggregate …
Singapore University of Technology and Design（新加坡科技设计大学）；Institute for Infocomm Research, A*STAR（新加坡科技研究局资讯通信研究院）；Missouri University of Science and Technology（密苏里科技大学）；CNRS（法国国家科学研究中心）；Telecom Sud Paris（南巴黎电信学院）；Institut Mines Telecom（矿业电信学院）；Paris-Saclay University（巴黎-萨克雷大学）
Advances in deep neural networks (DNN) greatly bolster real-time detection of anomalous IoT data. However, IoT devices can hardly afford complex DNN models, and offloading anomaly detection tasks to the cloud incurs long delay. In this paper, we propose and build a demo for an adaptive anomaly detection approach for distributed hierarchical edge computing (HEC) systems to solve this problem, for both univariate and multivariate IoT data. First, we construct multiple anomaly detection DNN models with increasing complexity, and associate each model with a layer in HEC from bottom to top. Then, w…
Georgia Institute of Technology（佐治亚理工学院）；Ben-Gurion University（本-古里安大学）
Due to their rapid growth and deployment, the Internet of things (IoT) have become a central aspect of our daily lives. Unfortunately, IoT devices tend to have many vulnerabilities which can be exploited by an attacker. Unsupervised techniques, such as anomaly detection, can be used to secure these devices in a plug-and-protect manner. However, anomaly detection models must be trained for a long time in order to capture all benign behaviors. Furthermore, the anomaly detection model is vulnerable to adversarial attacks since, during the training phase, all observations are assumed to be benign.…
The rapid development in the field of System of Chip (SoC) technology, Internet of Things (IoT), cloud computing, and artificial intelligence has brought more possibilities of improving and solving the current problems. With data analytics and the use of machine learning/deep learning, it is made possible to learn the underlying patterns and make decisions based on what was learned from massive data generated from IoT sensors. When combined with cloud computing, the whole pipeline can be automated, and free of manual controls and operations. In this paper, an implementation of an automated dat…
Due to their rapid growth and deployment, Internet of things (IoT) devices have become a central aspect of our daily lives. However, they tend to have many vulnerabilities which can be exploited by an attacker. Unsupervised techniques, such as anomaly detection, can help us secure the IoT devices. However, an anomaly detection model must be trained for a long time in order to capture all benign behaviors. This approach is vulnerable to adversarial attacks since all observations are assumed to be benign while training the anomaly detection model. In this paper, we propose CIoTA, a lightweight f…
Institute of Computer Science（计算机科学研究所）；AGH University of Science and Technology（AGH科技大学）
The growing number of IoT devices and their use to monitor the operation of machines and equipment increases interest in anomaly detection algorithms running on devices. However, the difficulty is the limitations of the available computational and memory resources on the devices. In the case of microcontrollers (MCUs), these are single megabytes of program and several hundred kilobytes of working memory. Consequently, algorithms must be appropriately matched to the capabilities of the devices. In the paper, we analyse the processing pipeline for anomaly detection and implementation of the Loca…
Institute for Infocomm Research, A*STAR（新加坡科技研究局资讯通信研究院）；Singapore University of Technology and Design（新加坡科技设计大学）
Wireless sensor networks (WSN) are fundamental to the Internet of Things (IoT) by bridging the gap between the physical and the cyber worlds. Anomaly detection is a critical task in this context as it is responsible for identifying various events of interests such as equipment faults and undiscovered phenomena. However, this task is challenging because of the elusive nature of anomalies and the volatility of the ambient environments. In a resource-scarce setting like WSN, this challenge is further elevated and weakens the suitability of many existing solutions. In this paper, for the first tim…
Anomaly Detection in Industrial Machinery using IoT Devices and Machine Learning: a Systematic Mapping
SENAI Institute of Innovation for Information and Communication Technologies (ISI-TICs)（SENAI信息与通信技术创新研究所（ISI-TICs））；Federal Rural University of Pernambuco (UFRPE)（伯南布哥联邦农村大学（UFRPE））
Efficient Personalized Federated PCA with Manifold Optimization for IoT Anomaly Detection
School of Mechatronic Engineering and Automation, Shanghai University（机电工程与自动化学院，上海大学）；School of Intelligent Systems Engineering, Sun Yat-sen University（智能系统工程学院，中山大学）
Modeling Quantum Federated Autoencoder for Anomaly Detection in IoT Networks
School of Information Technology Deakin University Geelong, Australia（信息技术学院，德金大学，澳大利亚吉朗）；School of Information Technology Deakin University Geelong, Melbourne（信息技术学院，德金大学，澳大利亚吉朗墨尔本）；School of Information Technology, Deakin University, Geelong, Australia（信息技术学院，德金大学，澳大利亚吉朗）
Network Anomaly Detection for IoT Using Hyperdimensional Computing on NSL-KDD
Computer Science and Engineering, Wright State University, Ohio, USA（计算机科学与工程系，怀特州立大学，俄亥俄州，美国）；Computer Science and Engineering, Azad University, Ahvaz, Iran（计算机科学与工程系，阿扎德大学，阿瓦兹，伊朗）
Columbia University（哥伦比亚大学）；University of Chicago（芝加哥大学）
Insecure Internet of things (IoT) devices pose significant threats to critical infrastructure and the Internet at large; detecting anomalous behavior from these devices remains of critical importance, but fast, efficient, accurate anomaly detection (also called "novelty detection") for these classes of devices remains elusive. One-Class Support Vector Machines (OCSVM) are one of the state-of-the-art approaches for novelty detection (or anomaly detection) in machine learning, due to their flexibility in fitting complex nonlinear boundaries between {normal} and {novel} data. IoT devices in smart…
George Washington University（乔治华盛顿大学）；Rutgers University（罗格斯大学）；Shandong University（山东大学）
Many real-world IoT systems, which include a variety of internet-connected sensory devices, produce substantial amounts of multivariate time series data. Meanwhile, vital IoT infrastructures like smart power grids and water distribution networks are frequently targeted by cyber-attacks, making anomaly detection an important study topic. Modeling such relatedness is, nevertheless, unavoidable for any efficient and effective anomaly detection system, given the intricate topological and nonlinear connections that are originally unknown among sensors. Furthermore, detecting anomalies in multivaria…
Federated Quantum Kernel Learning for Anomaly Detection in Multivariate IoT Time-Series
Department of Electrical and Electronic Engineering, Imperial College London（电子工程系，帝国理工学院伦敦分校）；Centre for Quantum Engineering, Science and Technology (QuEST), Imperial College London（量子工程、科学与技术中心（QuEST），帝国理工学院伦敦分校）；Graduate Institute of Applied Physics, National Taiwan University（应用物理研究所，国立台湾大学）
Real-Time Adaptive Anomaly Detection in Industrial IoT Environments
CIISE, Concordia University, Montréal, QC, Canada（Concordia大学）；Ericsson Research, Lund, Sweden（爱立信研究）；Computer Science Programme, University of Western Cape, Capetown, South Africa（南非开普敦大学计算机科学项目）
Univ. Grenoble Alpes（格勒诺布尔阿尔卑斯大学）；ABB Corporate Research（ABB企业研究院）；Beijing Institute of Technology（北京理工大学）；INSA Lyon（里昂国立应用科学学院）；TU Delft（代尔夫特理工大学）
Classification algorithms have been widely adopted to detect anomalies for various systems, e.g., IoT, cloud and face recognition, under the common assumption that the data source is clean, i.e., features and labels are correctly set. However, data collected from the wild can be unreliable due to careless annotations or malicious data transformation for incorrect anomaly detection. In this paper, we present a two-layer on-line learning framework for robust anomaly detection (RAD) in the presence of unreliable anomaly labels, where the first layer is to filter out the suspicious data, and the s…
The University of Queensland（昆士兰大学）；Griffith University（格里菲斯大学）
Monitoring and detecting abnormal events in cyber-physical systems is crucial to industrial production. With the prevalent deployment of the Industrial Internet of Things (IIoT), an enormous amount of time series data is collected to facilitate machine learning models for anomaly detection, and it is of the utmost importance to directly deploy the trained models on the IIoT devices. However, it is most challenging to deploy complex deep learning models such as Convolutional Neural Networks (CNNs) on these memory-constrained IIoT devices embedded with microcontrollers (MCUs). To alleviate the m…
CGGM: A conditional graph generation model with adaptive sparsity for node anomaly detection in IoT networks
College of Artificial Intelligence, Dalian Maritime University（大连海事大学人工智能学院）；Singapore University of Technology and Design（新加坡科技设计大学）；Yonsei University（延世大学）
Insitu sensors and Wireless Sensor Networks (WSNs) have become more and more popular in the last decade, due to their potential to be used in various applications of many different fields. As of today, WSNs are pretty much used by any monitoring system: from those that are health care related, to those that are used for environmental forecasting or surveillance purposes. All applications that make use of insitu sensors, strongly rely on their correct operation, which however, is quite difficult to guarantee. These sensors in fact, are typically cheap and prone to malfunction. Additionally, for…
Hunan University（湖南大学）；Virginia Tech（弗吉尼亚理工大学）；Queen Mary University of London（伦敦玛丽女王大学）
The rapid deployment of Internet of Things (IoT) applications leads to massive data that need to be processed. These IoT applications have specific communication requirements on latency and bandwidth, and present new features on their generated data such as time-dependency. Therefore, it is desirable to reshape the current IoT architectures by exploring their inherent nature of communication and computing to support smart IoT data process and analysis. We introduce in this paper features of IoT data, trends of IoT network architectures, some problems in IoT data analysis, and their solutions. …
LIAAD-INESC TEC（波尔图LIAAD-INESC技术研究所）；Dalhousie University（达尔豪斯大学）；University of Porto（波尔图大学）；Fraunhofer AICOS Portugal（弗劳恩霍夫葡萄牙AICOS研究所）
The early detection of anomalous events in time series data is essential in many domains of application. In this paper we deal with critical health events, which represent a significant cause of mortality in intensive care units of hospitals. The timely prediction of these events is crucial for mitigating their consequences and improving healthcare. One of the most common approaches to tackle early anomaly detection problems is standard classification methods. In this paper we propose a novel method that uses a layered learning architecture to address these tasks. One key contribution of our w…
The generalization of deep learning has helped us, in the past, address challenges such as malware identification and anomaly detection in the network security domain. However, as effective as it is, scarcity of memory and processing power makes it difficult to perform these tasks in Internet of Things (IoT) devices. This research finds an easy way out of this bottleneck by depreciating the need for feature engineering and subsequent processing in machine learning techniques. In this study, we introduce a Featureless machine learning process to perform anomaly detection. It uses unprocessed by…
Digital Twin-Driven Communication-Efficient Federated Anomaly Detection for Industrial IoT
Department of Electronic Systems, Norwegian University of Science and Technology（电子系统系，挪威科学与技术大学）；Department of Engineering Cybernetics, Norwegian University of Science and Technology（工程控制系，挪威科学与技术大学）；Department of Gas Technology, SINTEF Energy Research（气体技术系，SINTEF能源研究）
Multivariate anomaly detection can be used to identify outages within large volumes of telemetry data for computing systems. However, developing an efficient anomaly detector that can provide users with relevant information is a challenging problem. We introduce our approach to hierarchical multivariate anomaly detection called DeCorus, a statistical multivariate anomaly detector which achieves linear complexity. It extends standard statistical techniques to improve their ability to find relevant anomalies within noisy signals and makes use of types of domain knowledge that system operators co…
University of Oslo（奥斯陆大学）；SimulaMet；OsloMet（奥斯陆城市大学）；UiT（特罗姆瑟大学）
The interest for video anomaly detection systems has gained traction for the past few years. The current approaches use deep learning to perform anomaly detection in videos, but this approach has multiple problems. For starters, deep learning in general has issues with noise, concept drift, explainability, and training data volumes. Additionally, anomaly detection in itself is a complex task and faces challenges such as unknowness, heterogeneity, and class imbalance. Anomaly detection using deep learning is therefore mainly constrained to generative models such as generative adversarial networ…
Tel Aviv University（特拉维夫大学）；Facebook AI Research（Facebook人工智能研究院）
Anomaly detection, the task of identifying unusual samples in data, often relies on a large set of training samples. In this work, we consider the setting of few-shot anomaly detection in images, where only a few images are given at training. We devise a hierarchical generative model that captures the multi-scale patch distribution of each training image. We further enhance the representation of our model by using image transformations and optimize scale-specific patch-discriminators to distinguish between real and fake patches of the image, as well as between different transformations applied…
Cornell University（康奈尔大学）；University of California, Davis（加利福尼亚大学戴维斯分校）
We consider the problem of detecting a few targets among a large number of hierarchical data streams. The data streams are modeled as random processes with unknown and potentially heavy-tailed distributions. The objective is an active inference strategy that determines, sequentially, which data stream to collect samples from in order to minimize the sample complexity under a reliability constraint. We propose an active inference strategy that induces a biased random walk on the tree-structured hierarchy based on confidence bounds of sample statistics. We then establish its order optimality in …
Cyber-Physical Anomaly Detection in IoT-Enabled Smart Grids Using Machine Learning and Metaheuristic Feature Optimization
Department of Mathematical and Computer Sciences, University of Sarajevo（萨拉热窝大学数学与计算机科学系）；Singidunum University（辛吉杜姆大学）；Trinity University（特里尼蒂大学）；Sinergija University（辛格里雅大学）
Although home IoT (Internet of Things) devices are typically plain and task oriented, the context of their daily use may affect their traffic patterns. For this reason, anomaly-based intrusion detection systems tend to suffer from a high false positive rate (FPR). To overcome this, we propose a two-step collaborative anomaly detection method which first uses an autoencoder to differentiate frequent (`benign') and infrequent (possibly `malicious') traffic flows. Clustering is then used to analyze only the infrequent flows and classify them as either known ('rare yet benign') or unknown (`malici…
Anomaly detection incurs certain sampling and sensing costs and therefore it is of great importance to strike a balance between the detection accuracy and these costs. In this work, we study anomaly detection by considering the detection of threshold crossings in a stochastic time series without the knowledge of its statistics. To reduce the sampling cost in this detection process, we propose the use of hierarchical generative adversarial networks (GANs) to perform nonuniform sampling. In order to improve the detection accuracy and reduce the delay in detection, we introduce a buffer zone in t…
AWS AI Labs（AWS人工智能实验室）；CMU（卡内基梅隆大学）；Amazon Research（亚马逊研究院）；UCLA（加州大学洛杉矶分校）
Multivariate time series anomaly detection has become an active area of research in recent years, with Deep Learning models outperforming previous approaches on benchmark datasets. Among reconstruction-based models, most previous work has focused on Variational Autoencoders and Generative Adversarial Networks. This work presents DGHL, a new family of generative models for time series anomaly detection, trained by maximizing the observed likelihood by posterior sampling and alternating back-propagation. A top-down Convolution Network maps a novel hierarchical latent space to time series windows…
As the number of Internet of Things (IoT) devices and systems have surged, IoT data analytics techniques have been developed to detect malicious cyber-attacks and secure IoT systems; however, concept drift issues often occur in IoT data analytics, as IoT data is often dynamic data streams that change over time, causing model degradation and attack detection failure. This is because traditional data analytics models are static models that cannot adapt to data distribution changes. In this paper, we propose a Performance Weighted Probability Averaging Ensemble (PWPAE) framework for drift adaptiv…
