Rikard Laxhammar

Online Learning and Sequential Anomaly Detection in Trajectories

Detection of anomalous trajectories is an important problem in the surveillance domain. Various algorithms based on learning of normal trajectory patterns have been proposed for this problem. Yet, these algorithms typically suffer from one or more limitations: They are not designed for sequential analysis of incomplete trajectories or online learning based on an incrementally updated training set. Moreover, they typically involve tuning of many parameters, including ad-hoc anomaly thresholds, and may therefore suffer from overfitting and poorly-calibrated alarm rates. In this article, we propose and investigate the Sequential Hausdorff Nearest-Neighbor Conformal Anomaly Detector (SHNN-CAD) for online learning and sequential anomaly detection in trajectories. This is a parameter-light algorithm that offers a well-founded approach to the calibration of the anomaly threshold. The discords algorithm, originally proposed by Keogh et al. , is another parameter-light anomaly detection algorithm that has previously been shown to have good classification performance on a wide range of time-series datasets, including trajectory data. We implement and investigate the performance of SHNN-CAD and the discords algorithm on four different labeled trajectory datasets. The results show that SHNN-CAD achieves competitive classification performance with minimum parameter tuning during unsupervised online learning and sequential anomaly detection in trajectories.

Conformal prediction for distribution-independent anomaly detection in streaming vessel data

This paper presents a novel application of the theory of conformal prediction for distribution-independent on-line learning and anomaly detection. We exploit the fact that conformal predictors give valid prediction sets at specified confidence levels under the relatively weak assumption that the (normal) training data together with (normal) observations to be predicted have been generated from the same distribution. If the actual observation is not included in the possibly empty prediction set, it is classified as anomalous at the corresponding significance level. Interpreting the significance level as an upper bound of the probability that a normal observation is mistakenly classified as anomalous, we can conveniently adjust the sensitivity to anomalies while controlling the rate of false alarms without having to find any application specific thresholds. The proposed method has been evaluated in the domain of sea surveillance using recorded data assumed to be normal. The validity of the prediction sets is justified by the empirical error rate which is just below the significance level. In addition, experiments with simulated anomalous data indicate that anomaly detection sensitivity is superior to that of two previously proposed methods.

Inductive conformal anomaly detection for sequential detection of anomalous sub-trajectories

Detection of anomalous trajectories is an important problem for which many algorithms based on learning of normal trajectory patterns have been proposed. Yet, these algorithms are typically designed for offline anomaly detection in databases and are insensitive to local sub-trajectory anomalies. Generally, previous anomaly detection algorithms often require tuning of many parameters, including ad-hoc anomaly thresholds, which may result in overfitting and high alarm rates. The main contributions of this paper are two-fold: The first is the proposal and analysis of the Inductive Conformal Anomaly Detector (ICAD), which is a general and parameter-light anomaly detection algorithm that has well-calibrated alarm rate. ICAD is a generalisation of the previously proposed Conformal Anomaly Detector (CAD) based on the concept of Inductive Conformal Predictors. The main advantage of ICAD compared to CAD is the improved computational efficiency. The only design parameter of ICAD is the Non-Conformity Measure (NCM). The second contribution of this paper concerns the proposal and investigation of the Sub-Sequence Local Outlier (SSLO) NCM, which is designed for sequential detection of anomalous sub-trajectories in the framework of ICAD. SSLO-NCM is based on Local Outlier Factor (LOF) and is therefore sensitive to local sub-trajectory anomalies. The results from the empirical investigations on an unlabelled set of vessel trajectories illustrate the most anomalous trajectories detected for different parameter values of SSLO-NCM, and confirm that the empirical alarm rate is indeed well-calibrated.

Online Detection of Anomalous Sub-trajectories: A Sliding Window Approach Based on Conformal Anomaly Detection and Local Outlier Factor

Automated detection of anomalous trajectories is an important problem in the surveillance domain. Various algorithms based on learning of normal trajectory patterns have been proposed for this problem. Yet, these algorithms suffer from one or more of the following limitations: First, they are essentially designed for offline anomaly detection in databases. Second, they are insensitive to local sub-trajectory anomalies. Third, they involve tuning of many parameters and may suffer from high false alarm rates. The main contribution of this paper is the proposal and discussion of the Sliding Window Local Outlier Conformal Anomaly Detector (SWLO-CAD), which is an algorithm for online detection of local sub-trajectory anomalies. It is an instance of the previously proposed Conformal anomaly detector and, hence, operates online with well-calibrated false alarm rate. Moreover, SWLO-CAD is based on Local outlier factor, which is a previously proposed outlier measure that is sensitive to local anomalies. Thus, SWLO-CAD has a unique set of properties that address the issues above.

Chapter 4 : Anomaly Detection

This chapter presents an extension of conformal prediction for anomaly detection applications. It includes the presentation and discussion of the Conformal Anomaly Detector (CAD) and the computationally more efficient Inductive Conformal Anomaly Detector (ICAD), which are general algorithms for unsupervised or semi-supervised and offline or online anomaly detection. One of the key properties of CAD and ICAD is that the rate of detected anomalies is well calibrated in the online setting under the randomness assumption. Similar to conformal prediction, the choice of Nonconformity Measure (NCM) is of central importance for the classification performance of CAD and ICAD. A novel NCM for examples that are represented as sets of points is presented. One of the key properties of this NCM, which is known as the directed Hausdorff kk-nearest neighbors (DH-kNN) NCM, is that the p-value for an incomplete test example monotonically decreases as more data points are observed. An instance of CAD based on DH-kNN NCM, known as the sequential Hausdorff nearest neighbor conformal anomaly detector (SHNN-CAD), is presented and discussed for sequential anomaly detection applications. We also investigate classification performance results for the unsupervised online SHNN-CAD on a public dataset of labeled trajectories.