Quickest Detection of a Dynamic Anomaly in a Heterogeneous Sensor - - PowerPoint PPT Presentation

Quickest Detection of a Dynamic Anomaly in a Heterogeneous Sensor Network

Georgios Rovatsos, UIUC Venugopal V. Veeravalli, UIUC George V. Moustakides, Univ. of Patras June 21 – 26

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 1 / 15

Sensor Networks

In modern applications, many engineering systems are monitored by set of sensors

≈ ≈ ≈

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 2 / 15

Sensor Networks

In modern applications, many engineering systems are monitored by set of sensors

≈ ≈ ≈

1 2 3 4 5 6 7 8 9

Station Control Station Control

P1,V1 P2,V2 P3,V3

Data Concentrator Data Concentrator Control Center Data Concentrator Station Control

PMU8 PMU9 PMU7

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 2 / 15

Dynamic Anomaly in Sensor Networks

Anomaly affects different node at different time instants Goal: Frame dynamic anomaly detection problem theoretically and design tractable and optimal algorithms

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 3 / 15

General Setting

System monitored by a set of sensors denoted by [L] {1, . . . , L}

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 4 / 15

General Setting

System monitored by a set of sensors denoted by [L] {1, . . . , L} Observations given to centralized decision maker sequentially

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 4 / 15

General Setting

System monitored by a set of sensors denoted by [L] {1, . . . , L} Observations given to centralized decision maker sequentially After unknown but deterministic time instant event leads system to enter abnormal state

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 4 / 15

General Setting

System monitored by a set of sensors denoted by [L] {1, . . . , L} Observations given to centralized decision maker sequentially After unknown but deterministic time instant event leads system to enter abnormal state Detect emergence of dynamic anomaly as quickly as possible subject to false alarm constraints

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 4 / 15

Observation Model

Denote by ν ≥ 0 the unknown changepoint

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 5 / 15

Observation Model

Denote by ν ≥ 0 the unknown changepoint Denote by gℓ(x), fℓ(x) the non-anomalous and anomalous distributions at sensor ℓ

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 5 / 15

Observation Model

Denote by ν ≥ 0 the unknown changepoint Denote by gℓ(x), fℓ(x) the non-anomalous and anomalous distributions at sensor ℓ Anomalous node at time k: S[k] ∈ [L]

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 5 / 15

Observation Model

Denote by ν ≥ 0 the unknown changepoint Denote by gℓ(x), fℓ(x) the non-anomalous and anomalous distributions at sensor ℓ Anomalous node at time k: S[k] ∈ [L] For fixed ν, S {S[k]}∞

k=1, joint distribution of sensor observations

characterized by non-anomalous and anomalous pdfs:

X[k] ∼          g(x)

L

• ℓ=1

gℓ(xℓ) 1 ≤ k ≤ ν pS[k](x) fS[k](xS[k]) ·

• ℓ=S[k]

gℓ(xℓ)

• k > ν.
• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 5 / 15

Problem Statement

Delay metric: WADD(τ) = sup

S

sup

ν≥0

ess sup ES

ν [τ − ν|τ > ν, Fν]

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 6 / 15

Problem Statement

Delay metric: WADD(τ) = sup

S

sup

ν≥0

ess sup ES

ν [τ − ν|τ > ν, Fν]

Mean time to false alarm (MTFA): E∞[τ]

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 6 / 15

Problem Statement

Delay metric: WADD(τ) = sup

S

sup

ν≥0

ess sup ES

ν [τ − ν|τ > ν, Fν]

Mean time to false alarm (MTFA): E∞[τ] Optimization problem: min

τ

WADD(τ) s.t. τ ∈ Cγ where for γ > 0, Cγ {τ : E∞[τ] ≥ γ}

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 6 / 15

Mixture Statistical Model

Plays important role in intuitive explanation and theoretical analysis

• f proposed algorithms
• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 7 / 15

Mixture Statistical Model

Plays important role in intuitive explanation and theoretical analysis

• f proposed algorithms

Observation model that arises when at k, anomalous node chosen at random according to pmf α = {αℓ : ℓ ∈ [L]} ∈ A

X[k] ∼        g(x)

• L
• ℓ=1

g(xℓ), 1 ≤ k ≤ ν pα(x)

• L
• ℓ=1

αℓpℓ(x), k > ν

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 7 / 15

Mixture Statistical Model

Plays important role in intuitive explanation and theoretical analysis

• f proposed algorithms

Observation model that arises when at k, anomalous node chosen at random according to pmf α = {αℓ : ℓ ∈ [L]} ∈ A

X[k] ∼        g(x)

• L
• ℓ=1

g(xℓ), 1 ≤ k ≤ ν pα(x)

• L
• ℓ=1

αℓpℓ(x), k > ν

Corresponding detection delay: WADDα(τ) = sup

ν≥0

ess sup E

α ν [τ − ν|τ > ν, Fν]

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 7 / 15

Mixture Statistical Model

Plays important role in intuitive explanation and theoretical analysis

• f proposed algorithms

Observation model that arises when at k, anomalous node chosen at random according to pmf α = {αℓ : ℓ ∈ [L]} ∈ A

X[k] ∼        g(x)

• L
• ℓ=1

g(xℓ), 1 ≤ k ≤ ν pα(x)

• L
• ℓ=1

αℓpℓ(x), k > ν

Corresponding detection delay: WADDα(τ) = sup

ν≥0

ess sup E

α ν [τ − ν|τ > ν, Fν]

Effective KL number: Iα E

α

• log pα(X[1])

g(X[1])

• .
• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 7 / 15

Mixture-CUSUM Test

Proposed test is CUSUM test that detects transition from joint pre-change pdf to post-change model where anomalous node is picked randomly according to specific choice of α

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 8 / 15

Mixture-CUSUM Test

Proposed test is CUSUM test that detects transition from joint pre-change pdf to post-change model where anomalous node is picked randomly according to specific choice of α Test statistic: Wα[k] = (Wα[k − 1])+ + log pα(X[k]) g(X[k]) where Wα[0] 0

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 8 / 15

Mixture-CUSUM Test

Proposed test is CUSUM test that detects transition from joint pre-change pdf to post-change model where anomalous node is picked randomly according to specific choice of α Test statistic: Wα[k] = (Wα[k − 1])+ + log pα(X[k]) g(X[k]) where Wα[0] 0 Stopping time: τM(b, α) inf{k ≥ 1 : Wα[k] ≥ b}

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 8 / 15

Exact Optimality - Homogeneous Sensors 1

Theorem

Fix γ > 0. Assume that fℓ = fℓ′ and gℓ = gℓ′ for all ℓ, ℓ′ ∈ [L]. The M-CUSUM test with uniform weights αℓ = 1

L for all ℓ ∈ [L] and b chosen

such that E∞[τM] = γ is exactly optimal, i.e., WADD(τM) = inf

τ∈Cγ WADD(τ)

• 1G. Rovatsos, G. V. Moustakides, and V. V. Veeravalli, “Quickest detection of

a dynamic anomaly in a sensor network”

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 9 / 15

Asymptotic Optimality - Heterogeneous Sensors

Theorem

Choosing b = log γ implies that E∞[τM] ≥ γ and that as γ → ∞ inf

τ∈Cγ WADD(τ) ∼ WADD(τM) ∼ log γ

Iα∗ where α∗ arg min

α ∈ A

Iα

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 10 / 15

KL-Number Minimizer Slope Property

Lemma

Let α∗ arg min

α ∈ A

Iα We then have that α∗ is an interior point of A and that Epℓ

• log

pα∗(X) g(X)

• = Epℓ′
• log

pα∗(X) g(X)

• for all ℓ, ℓ′ ∈ [L], where Epℓ[·] denotes the expectation when ℓ is

anomalous

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 11 / 15

Asymptotic Optimality Proof Sketch

Universal lower bound: for any α ∈ A as γ → ∞ inf

τ∈Cγ WADD(τ) ≥ inf τ∈Cγ WADDα(τ) ∼ log γ

Iα

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 12 / 15

Asymptotic Optimality Proof Sketch

Universal lower bound: for any α ∈ A as γ → ∞ inf

τ∈Cγ WADD(τ) ≥ inf τ∈Cγ WADDα(τ) ∼ log γ

Iα M-CUSUM upper bound: for any b > 0 as b → ∞ WADD(τM(b, α∗)) ≤ b Iα∗ (1 + o(1))

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 12 / 15

Asymptotic Optimality Proof Sketch

Universal lower bound: for any α ∈ A as γ → ∞ inf

τ∈Cγ WADD(τ) ≥ inf τ∈Cγ WADDα(τ) ∼ log γ

Iα M-CUSUM upper bound: for any b > 0 as b → ∞ WADD(τM(b, α∗)) ≤ b Iα∗ (1 + o(1)) From the lower bound for α = α∗ and from the upper bound for b = log γ the asymptotic optimality is established

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 12 / 15

Numerical Results

L = 10, gℓ = N(0, 1), fℓ = N(µℓ, 1) post-change mean: µ = [1, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9]⊤

103 104

Mean Time to False Alarm (MTFA)

20 40 60 80 100 120 140

Expected Detection Delay Non-uniform slopes 1 Non-uniform slopes 2 Uniform slopes

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 13 / 15

Conclusion

Studied problem of worst-path dynamic anomaly detection Anomaly affects a single node at each time instant

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 14 / 15

Conclusion

Studied problem of worst-path dynamic anomaly detection Anomaly affects a single node at each time instant Location of anomalous node changes with time

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 14 / 15

Conclusion

Studied problem of worst-path dynamic anomaly detection Anomaly affects a single node at each time instant Location of anomalous node changes with time Evaluated candidate rule according to worst-path performance

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 14 / 15

Conclusion

Studied problem of worst-path dynamic anomaly detection Anomaly affects a single node at each time instant Location of anomalous node changes with time Evaluated candidate rule according to worst-path performance Established that CUSUM-type test is asymptotically optimal for heterogeneous sensors case

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 14 / 15

Thank you!

• G. Rovatsos - rovatso2@illinois.edu

ISIT 2020 June 21 – 26 15 / 15