T12 - Anomaly Detection - Techniques and Applications

Automatic anomaly detection is a research area that is growing within several applications such as event and threat detection, intrusion detection, fault detection, fraud detection, system health monitoring and biological monitoring. A large number of techniques are used for designing and developing algorithms for automatic anomaly detection. Many of the algorithms are specifically developed for certain applications while other algorithms are more generic.
In this tutorial we will present and discuss algorithms for automatic and semi-automatic anomaly detection based on data and information fusion, for security and safety applications.
Anomaly detection refers to the problem of finding patterns in data that do not confirm to an established normal behaviour. These patterns often contain important information which can indicate that a certain event is about to occur, or has just occurred.
Algorithms based on sensor and information fusion will be discussed and investigated via practical examples. Possibilities, limitations and challenges will be discussed. Useful algorithms will be presented including hidden Markov models, clustering algorithms, statistical relational learning, optical flow, supervised learning, semi-supervised learning and unsupervised learning.
Ethical issues are often closely related to anomaly detection (for example surveillance applications). How to deal with ethical issues based on data from sensor networks will be discussed.
The objectives of the tutorial are to give the participant:

1. An overview of the research and an understanding of possibilities, limitations and challenges. The applications include urban, terrain and maritime environments (e.g. crowd analysis, traffic monitoring), intrusion detection in information systems, image processing, sensor networks, medical and public health, fraud detection and anomalies in biological data.
2. Detailed examples of selected algorithms and applications in urban, terrain and maritime environments. This will give the participant a starting point for own work with anomaly detection.

The focus in part 2 will be on specific algorithms for anomaly detection in surveillance applications for urban, terrain and maritime environments. These environments are often complex and offers among other things occlusion, changing weather and light conditions as well as changing normal behaviours. Therefore algorithms based on multiple sensors and information sources will be advantageous. Typical input data from sensors include detections and tracking data. Below there is a brief description of some aspects that need to be considered when developing algorithms for urban environments. In a similar way important aspects can be found also for terrain and maritime environments.

Detection of criminal behaviour is difficult because the perpetrator will try to avoid detection. Some criminal acts are explicit and should therefore be detectable, e. g. physical violence and malicious damage. But other criminal acts may be very difficult to detect, for example pick- pocketing and smuggling. A surveillance system detecting specific events or behaviours will, if known to the perpetrator, challenge the perpetrator to disguise his/her behaviour to a behaviour that cannot be detected. It may not be possible to find a specific characteristic of persons with criminal intent that can be used to detect them. However, criminals are usually rare and at least some parts of their behaviour, the criminal act, are also rare. A hypothesis is that if an appropriate characteristic is found then the criminals should be found among those acting unusually. But it is not criminal to act unusually, so it is necessary to have an operator making the final decision if the unusual person should be considered suspect and cause for further investigation. To be useful, the algorithms should not have too many false alarms and the criminals should be found among the unusual.
Early warning is even more difficult because it may not at all be clear what characteristics to expect from a person with the intent to commit a crime. Anomaly detection followed by analysis of an operator may be the only way to find them. In this case there may also be a problem of deciding when to intervene because no criminal act has yet been committed.
Anomaly detection requires a model of the aspects of interest and a way to describe the normal instances so the unusual can be found. The model should allow a narrow description of normal instances so that as few as possible of the unusual fit in the normal class.

Instructor biography

Maria Andersson is senior scientist in Sensor Informatics at the Swedish Defence Research Agency (FOI) in Linköping, Sweden. She is also guest researcher at Automatic Control, Linköping University.

She received the M.Sc. degree in mechanical engineering 1989 and the Ph.D. degree in energy systems 1997, both from Linköping University. During 1997–2001 she was a systems engineer at Saab Aeronautics in Linköping. In 2001 she joined FOI. Her research interests include automatic anomaly detection, sensor fusion, object tracking, machine learning and computer vision.

She is a VINNMER Fellow1 (research fellow) working as a guest researcher 2012-2014 at Automatic Control, Linköping University, within the sensor informatics group lead by Prof Fredrik Gustafsson.

She is deeply involved in various security research projects including projects from EU FP7 security research programme. In these projects she focuses on anomaly detection and event recognition.