Gautam Thatte

Parametric methods for anomaly detection in aggregate traffic

This paper develops parametric methods to detect network anomalies using only aggregate traffic statistics, in contrast to other works requiring flow separation, even when the anomaly is a small fraction of the total traffic. By adopting simple statistical models for anomalous and background traffic in the time domain, one can estimate model parameters in real time, thus obviating the need for a long training phase or manual parameter tuning. The proposed bivariate parametric detection mechanism (bPDM) uses a sequential probability ratio test, allowing for control over the false positive rate while examining the tradeoff between detection time and the strength of an anomaly. Additionally, it uses both traffic-rate and packet-size statistics, yielding a bivariate model that eliminates most false positives. The method is analyzed using the bit-rate signal-to-noise ratio (SNR) metric, which is shown to be an effective metric for anomaly detection. The performance of the bPDM is evaluated in three ways. First, synthetically generated traffic provides for a controlled comparison of detection time as a function of the anomalous level of traffic. Second, the approach is shown to be able to detect controlled artificial attacks over the University of Southern California (USC), Los Angeles, campus network in varying real traffic mixes. Third, the proposed algorithm achieves rapid detection of real denial-of-service attacks as determined by the replay of previously captured network traces. The method developed in this paper is able to detect all attacks in these scenarios in a few seconds or less.

Multimodal Physical Activity Recognition by Fusing Temporal and Cepstral Information

A physical activity (PA) recognition algorithm for a wearable wireless sensor network using both ambulatory electrocardiogram (ECG) and accelerometer signals is proposed. First, in the time domain, the cardiac activity mean and the motion artifact noise of the ECG signal are modeled by a Hermite polynomial expansion and principal component analysis, respectively. A set of time domain accelerometer features is also extracted. A support vector machine (SVM) is employed for supervised classification using these time domain features. Second, motivated by their potential for handling convolutional noise, cepstral features extracted from ECG and accelerometer signals based on a frame level analysis are modeled using Gaussian mixture models (GMMs). Third, to reduce the dimension of the tri-axial accelerometer cepstral features which are concatenated and fused at the feature level, heteroscedastic linear discriminant analysis is performed. Finally, to improve the overall recognition performance, fusion of the multimodal (ECG and accelerometer) and multidomain (time domain SVM and cepstral domain GMM) subsystems at the score level is performed. The classification accuracy ranges from 79.3% to 97.3% for various testing scenarios and outperforms the state-of-the-art single accelerometer based PA recognition system by over 24% relative error reduction on our nine-category PA database.

Sensor Selection and Power Allocation for Distributed Estimation in Sensor Networks: Beyond the Star Topology

Optimal power allocation for distributed parameter estimation in a wireless sensor network with a fusion center under a total network power constraint is considered. For the simple star topology, an analysis of the effect of the measurement noise variance on the optimal power allocation policy is presented. The optimal solution evolves from sensor selection, to water- filling, to channel inversion as the measurement noise variance increases; in the last solution, the sensor with the weakest channel signal-to-noise ratio (SNR) is allocated the largest fraction of the total power. Relaying nodes are then introduced to form the more complex branch, tree, and linear topologies. The optimal power allocation strategies for these complex topologies are then considered for both amplify-and-forward and estimate-and-forward transmission protocols. Analytical solutions for these cases appear to be intractable, and thus asymptotically optimal (for increasing measurement noise variance) solutions are derived. The solutions to this asymptotic problem offer near-optimal performance even for modest measurement noise. The optimal limiting power policy for the leaf nodes in branch and tree topologies is channel inversion, whereas in linear networks, the optimal solution is a form of weighted channel inversion. The results are extended to a multipath channel model and to the estimation of a vector of random parameters.

KNOWME: a case study in wireless body area sensor network design

Wireless body area sensing networks have the potential to revolutionize health care in the near term. The coupling of biosensors with a wireless infrastructure enables the real-time monitoring of an individuals health and related behaviors continuously, as well as the provision of realtime feedback with nimble, adaptive, and personalized interventions. The KNOWME platform is reviewed, and lessons learned from system integration, optimization, and in-field deployment are provided. KNOWME is an endto- end body area sensing system that integrates off-the-shelf sensors with a Nokia N95 mobile phone to continuously monitor and analyze the biometric signals of a subject. KNOWME development by an interdisciplinary team and in-laboratory, as well as in-field deployment studies, employing pediatric obesity as a case study condition to monitor and evaluate physical activity, have revealed four major challenges: (1) achieving robustness to highly varying operating environments due to subject-induced variability such as mobility or sensor placement, (2) balancing the tension between acquiring high fidelity data and minimizing network energy consumption, (3) enabling accurate physical activity detection using a modest number of sensors, and (4) designing WBANs to determine physiological quantities of interest such as energy expenditure. The KNOWME platform described in this article directly addresses these challenges.

Optimal Time-Resource Allocation for Energy-Efficient Physical Activity Detection

The optimal allocation of samples for physical activity detection in a wireless body area network for health-monitoring is considered. The number of biometric samples collected at the mobile device fusion center, from both device-internal and external Bluetooth heterogeneous sensors, is optimized to minimize the transmission power for a fixed number of samples, and to meet a performance requirement defined using the probability of misclassification between multiple hypotheses. A filter-based feature selection method determines an optimal feature set for classification, and a correlated Gaussian model is considered. Using experimental data from overweight adolescent subjects, it is found that allocating a greater proportion of samples to sensors which better discriminate between certain activity levels can result in either a lower probability of error or energy-savings ranging from 18% to 22%, in comparison to equal allocation of samples. The current activity of the subjects and the performance requirements do not significantly affect the optimal allocation, but employing personalized models results in improved energy-efficiency. As the number of samples is an integer, an exhaustive search to determine the optimal allocation is typical, but computationally expensive. To this end, an alternate, continuous-valued vector optimization is derived which yields approximately optimal allocations and can be implemented on the mobile fusion center due to its significantly lower complexity.

KNOWME: An Energy-Efficient Multimodal Body Area Network for Physical Activity Monitoring

The use of biometric sensors for monitoring an individual’s health and related behaviors, continuously and in real time, promises to revolutionize healthcare in the near future. In an effort to better understand the complex interplay between one’s medical condition and social, environmental, and metabolic parameters, this article presents the KNOWME platform, a complete, end-to-end, body area sensing system that integrates off-the-shelf biometric sensors with a Nokia N95 mobile phone to continuously monitor the metabolic signals of a subject. With a current focus on pediatric obesity, KNOWME employs metabolic signals to monitor and evaluate physical activity. KNOWME development and in-lab deployment studies have revealed three major challenges: (1) the need for robustness to highly varying operating environments due to subject-induced variability, such as mobility or sensor placement; (2) balancing the tension between achieving high fidelity data collection and minimizing network energy consumption; and (3) accurate physical activity detection using a modest number of sensors. The KNOWME platform described herein directly addresses these three challenges. Design robustness is achieved by creating a three-tiered sensor data collection architecture. The system architecture is designed to provide robust, continuous, multichannel data collection and scales without compromising normal mobile device operation. Novel physical activity detection methods which exploit new representations of sensor signals provide accurate and efficient physical activity detection. The physical activity detection method employs personalized training phases and accounts for intersession variability. Finally, exploiting the features of the hardware implementation, a low-complexity sensor sampling algorithm is developed, resulting in significant energy savings without loss of performance.

Detection of low-rate attacks in computer networks

This paper develops two parametric methods to detect low-rate denial-of-service attacks and other similar near-periodic traffic, without the need for flow separation. The first method, the periodic attack detector, is based on a previous approach that exploits the near-periodic nature of attack traffic in aggregate traffic by modeling the peak frequency in the traffic spectrum. The new method adopts simple statistical models for attack and background traffic in the time-domain. Both approaches use sequential probability ratio tests (SPRTs), allowing control over false alarm rate while examining the trade-off between detection time and attack strength. We evaluate these methods with real and synthetic traces, observing that the new Poisson- based scheme uniformly detects attacks more rapidly, often in less than 200 ms, and with lower complexity than the periodic attack detector. Current entropy-based detection methods provide an equivalent time to detection but require flow-separation since they utilize source/destination IP addresses. We evaluate sensitivity to attack strength (compared to the rate of background traffic) with synthetic traces, finding that the new approach can detect attacks that represent only 10% of the total traffic bitrate in fractions of a second.

Energy-efficient multihypothesis activity-detection for health-monitoring applications

Multi-hypothesis activity-detection using a wireless body area network is considered. A fusion center receives samples of biometric signals from heterogeneous sensors. Due to the different discrimination capabilities of each sensor, an optimized allocation of samples per sensor results in lower energy consumption. Optimal sample allocation is determined by minimizing the probability of misclassification given the current activity state of the user. For a particular scenario, optimal allocation can achieve the same accuracy (97%) as equal allocation across sensors with an energy savings of 26%. As the number of samples is an integer, further energy reduction is achieved by developing an approximation to the probability of misclassification which allows for a continuous-valued vector optimization. This alternate optimization yields approximately optimal allocations with significantly lower complexity, facilitating real-time implementation.

Power Allocation in Linear and Tree WSN Topologies

Estimation at a fusion center in a wireless sensor network is examined. The problem at hand is to perform power allocation subject to a total network power constraint while minimizing the mean-squared error of the estimate. In particular, amplify-and-forward and estimate-and-forward protocols are considered in linear and tree topologies. Analytical solutions for these cases appear to be intractable, and thus asymptotically optimal (for increasing measurement noise variance) solutions are derived. The optimal limiting power policy for the leaf nodes in branch and tree topologies is power equalization, whereas in linear networks, the optimal solution is weighted power equalization.

Optimal Allocation of Time-Resources for Multihypothesis Activity-Level Detection

The optimal allocation of samples for activity-level detection in a wireless body area network for health-monitoring applications is considered. A wireless body area network with heterogeneous sensors is deployed in a simple star topology with the fusion center receiving biometric samples from each of the sensors. The number of samples collected from each of the sensors is optimized to minimize the probability of misclassification between multiple hypotheses at the fusion center. Using experimental data from our pilot study, we find equally allocating samples amongst sensors is normally suboptimal. A lower probability of error can be achieved by allocating a greater fraction of the samples to sensors which can better discriminate between certain activity-levels. As the number of samples is an integer, prior work employed an exhaustive search to determine the optimal allocation of integer samples. However, such a search is computationally expensive. To this end, an alternate continuous-valued vector optimization is derived which yields approximately optimal allocations which can be found with significantly lower complexity.