Igor Nikiforov

Detection of abrupt changes: theory and application

This book is downloadable from http://www.irisa.fr/sisthem/kniga/. Many monitoring problems can be stated as the problem of detecting a change in the parameters of a static or dynamic stochastic system. The main goal of this book is to describe a unified framework for the design and the performance analysis of the algorithms for solving these change detection problems. Also the book contains the key mathematical background necessary for this purpose. Finally links with the analytical redundancy approach to fault detection in linear systems are established. We call abrupt change any change in the parameters of the system that occurs either instantaneously or at least very fast with respect to the sampling period of the measurements. Abrupt changes by no means refer to changes with large magnitude; on the contrary, in most applications the main problem is to detect small changes. Moreover, in some applications, the early warning of small - and not necessarily fast - changes is of crucial interest in order to avoid the economic or even catastrophic consequences that can result from an accumulation of such small changes. For example, small faults arising in the sensors of a navigation system can result, through the underlying integration, in serious errors in the estimated position of the plane. Another example is the early warning of small deviations from the normal operating conditions of an industrial process. The early detection of slight changes in the state of the process allows to plan in a more adequate manner the periods during which the process should be inspected and possibly repaired, and thus to reduce the exploitation costs.

Fault isolation for diagnosis: nuisance rejection and multiple hypotheses testing

Fault detection, fault isolation and fault diagnosis are addressed within a statistical framework. The corresponding inference problems are stated. Several statistical tools for solving these inference problems are described. Particular emphasis is put on dealing with nuisance parameters and deciding between multiple hypotheses. How to use these tools for solvingFDI problems is discussed. An example illustrates some of the proposed methods.

Non-Bayesian Detection and Detectability of Anomalies From a Few Noisy Tomographic Projections

The detection of an anomaly from a few noisy tomographic projections is addressed from the statistical point of view. An unknown scene is composed of a background, considered as a deterministic nuisance parameter, with a possibly hidden anomaly. Because the full pixel-by-pixel reconstruction is impossible, a parametric non-Bayesian approach is proposed to fill up the gap in the missing data. An optimal statistical test which eliminates the background and detects the anomaly is designed. The potential advantage of such an approach is its capacity to detect an anomaly/target hidden in background designed by an adversary to mask the anomaly. A key issue in the non-Bayesian anomaly detection, i.e., the problem of anomaly detectability, is stated and solved in this paper. In the case of a bivariate polynomial background defined on an unknown rectangular support, the size of detectable anomaly reaches its maximum defined by the number of elementary cells of X-ray detector and degree of the polynomial function

Anomaly detection/detectability for a linear model with a bounded nuisance parameter

Abstract Anomaly detection is addressed within a statistical framework. Often the statistical model is composed of two types of parameters: the informative parameters and the nuisance ones. The nuisance parameters are of no interest for detection but they are necessary to complete the model. In the case of unknown, non-random and non-bounded nuisance parameters, their elimination is unavoidable. Some approaches based on the assumption that the nuisance parameters belonging to a subspace interfere with the informative ones in a linear manner, use the theory of invariance to reject the nuisance. Unfortunately, this can lead to a serious degradation of the detector capacity because some anomalies are masked by nuisance parameters. Nevertheless, in many cases the physical nature of nuisance parameters is (partially) known, and this a priori knowledge permits to define lower and upper bounds for the nuisance parameters. The goal of this paper is to study the statistical performances of the constrained generalized likelihood ratio test used to detect an additive anomaly in the case of bounded nuisance parameters. An example of the integrity monitoring of GNSS train positioning illustrates the relevance of the proposed method.

A statistical method for detecting cyber/physical attacks on SCADA systems

This paper addresses the problem of detecting cyber/physical attacks on Supervisory Control And Data Acquisition (SCADA) systems. The detection of cyber/physical attacks is formulated as the problem of detecting transient changes in stochastic-dynamical systems in the presence of unknown system states (often regarded as the nuisance parameter). The Variable Threshold Window Limited CUmulative SUM (VTWL CUSUM) test is adapted to the detection of transient changes of known profiles in the presence of nuisance parameter. Taking into account the performance criterion of the transient change detection problem, which minimizes the worst-case probability of missed detection for a given value of the worst-case probability of false alarm, the thresholds are tuned for optimizing the VTWL CUSUM algorithm. The optimal choice of thresholds leads to the simple Finite Moving Average (FMA) algorithm. The proposed algorithms are utilized for detecting the covert attack on a simple water distribution system, targeting at stealing water from the reservoir without being detected.

Handling nuisance parameters in systems monitoring

Dealing with nuisance parameters is an important issue in monitoring safety-critical complex systems and detecting events that affect their functioning. Several tools for solving statistical inference problems in the presence of nuisance parameters are described. The application of these tools to (off-line) hypotheses testing and (on-line) change detection is discussed. The usefulness of some of the proposed methods is illustrated on a couple of monitoring problems.

Sensitivity analysis of the sequential test for detecting cyber-physical attacks

This paper deals with the problem of detecting cyber-physical attacks on Supervisory Control And Data Acquisition (SCADA) systems. The discrete-time state space model is used to describe the systems. The attacks are modeled as additive signals of short duration on both state evolution and sensor measurement equations. The steady-state Kalman filter is employed to generate the sequence of innovations. Next, these independent random variables are used as entries of the Variable Threshold Window Limited CUmulative SUM (VTWL CUSUM) test. It has been shown that the optimal choice of thresholds with respect to (w.r.t.) the transient change detection criterion leads to the Finite Moving Average (FMA) test. The main contribution of this paper is a sensitivity analysis of the FMA test. This analysis is based on a numerical calculation of the probabilities of wrong decision under the variation of operational parameters. Theoretical results are applied to the detection of an attack scenario on a SCADA water network.

Bayesian Test for Multiple Hypothesis Testing Problem with Quadratic Loss

The Bayesian test with 0—1 loss function is a standard solution to solve a multiple hypothesis testing problem in the Bayesian framework. For a large number of applications (like the intrusion detection, the anomaly detection,…) the alternative hypotheses have quite different importance and 0—1 loss function does not reflect the reality. The quadratic loss function can be more appropriate to distinguish the concurrent hypotheses. The main contribution of the paper is the design of the Bayesian test with a quadratic loss function and its asymptotic study. When the signal-to-noise ratio tends to infinity, it is theoretically established that the error probabilities of the proposed test coincide with the error probabilities of the standard one associated to the 0—1 loss function. In the non-asymptotic case, the numerical experiments show that the proposed test outperforms the Bayesian test associated to the 0—1 loss function when compared by using the quadratic loss function.

Statistical detection of abnormal ozone measurements based on Constrained Generalized Likelihood Ratio test

Monitoring ozone concentrations is an essential requirement due to the adverse environmental and health effects of abnormal ozone pollution. The objective of this paper is twofold: first, to model ground level ozone concentrations, and second, to detect abnormal ozone measurements. Towards this end, a multidimensional Seasonal AutoRegressive Moving Average with eXogenous variable (SARMAX) model has been developed to describe ground level ozone concentrations. The database used to fit the models consists of two data sets collected from Upper Normandy region, France, via the network of air quality monitoring stations. A good description of the ambient ozone pollution may be a tool for facilitating detection of abnormalities in ozone measurements. The overarching goal of this paper is to detect abnormal pollution measurements caused by air pollution anomalies or malfunctioning sensors in the framework of regional ozone surveillance network. The proposed Constrained Generalized Likelihood Ratio (CGLR) anomaly detection scheme is successfully applied to collected data. The detection results of the proposed method are compared to that declared by Air Normand air monitoring association.

Statistical fault detection with linear or non-linear nuisance parameters

Abstract The monitoring problems pertaining to Fault Detection and Identification (FDI) often have to take into account the interference of nuisance parameters in the elaboration of decision processes. There are many works addressing cases in which nuisance parameters interfere in a linear or additive way within the system to be monitored, most of them in a deterministic framework. We first suggest a fully statistical methodology for dealing with linear nuisance parameters, and then we adapt some aspects of this methodology to the non-linear interference of nuisance parameters. These methods can be applied to the monitoring of radio-navigation systems such as the GPS.