PaperlayerView exact revision on arXiv

Source-linked AI summary

Distributed Anomaly Detection using Autoencoder Neural Networks in WSN for IoT

Tie Luo, Sai G. Nagarajan

arXiv:1812.04872v1cs.NIcs.LG

TL;DR

Anomaly detection in WSNs is important but difficult because resource-constrained sensors face elusive anomalies and changing environments. The paper introduces a distributed autoencoder approach that detects anomalies locally while the cloud handles training, achieving high accuracy, low false alarms, and adaptation to new changes on real testbed data.

  • Problem

    Anomaly detection must identify faults, environmental changes, and attacks in WSN data, but resource constraints, elusive anomalies, and volatile environments limit existing approaches.

  • Method

    A two-part autoencoder algorithm performs fully distributed detection on sensors and lower-frequency, computation-intensive model training in the IoT cloud.

  • Results

    Experiments using four months of indoor WSN testbed data achieve high detection accuracy and low false alarm rates, jointly characterized by AUC.

  • Takeaways & Limitations

    Unsupervised learning and configurable training enable adaptation to unforeseeable changes in non-stationary environments.

Abstract

from arXiv · show

Wireless sensor networks (WSN) are fundamental to the Internet of Things (IoT) by bridging the gap between the physical and the cyber worlds. Anomaly detection is a critical task in this context as it is responsible for identifying various events of interests such as equipment faults and undiscovered phenomena. However, this task is challenging because of the elusive nature of anomalies and the volatility of the ambient environments. In a resource-scarce setting like WSN, this challenge is further elevated and weakens the suitability of many existing solutions. In this paper, for the first time, we introduce autoencoder neural networks into WSN to solve the anomaly detection problem. We design a two-part algorithm that resides on sensors and the IoT cloud respectively, such that (i) anomalies can be detected at sensors in a fully distributed manner without the need for communicating with any other sensors or the cloud, and (ii) the relatively more computation-intensive learning task can be handled by the cloud with a much lower (and configurable) frequency. In addition to the minimal communication overhead, the computational load on sensors is also very low (of polynomial complexity) and readily affordable by most COTS sensors. Using a real WSN indoor testbed and sensor data collected over 4 consecutive months, we demonstrate via experiments that our proposed autoencoder-based anomaly detection mechanism achieves high detection accuracy and low false alarm rate. It is also able to adapt to unforeseeable and new changes in a non-stationary environment, thanks to the unsupervised learning feature of our chosen autoencoder neural networks.

I. INTRODUCTION

Anomaly detection matters in IoT because WSN data can contain events such as faults, environmental changes, and attacks, yet centralized processing wastes scarce resources. The paper addresses this challenge with a distributed autoencoder design that keeps detection on sensors, shifts learning to the cloud, and supports adaptation to changing environments.

  • WSNs convert physical phenomena into digital signals for IoT analytics, but anomalies can interfere with downstream processing and indicate events of interest.
  • Centralized anomaly detection transmits large volumes of raw data even though only a small fraction is anomalous, increasing interference, delay, and energy consumption.
  • Resource-limited sensors make anomaly detection difficult because anomalies are elusive and ambient physical conditions are volatile.
  • The proposed two-part algorithm detects anomalies independently at sensors while the cloud performs computation-intensive model training at a lower configurable frequency.
  • Experiments on four months of indoor WSN data show high detection accuracy, low false alarm rate, and adaptation to unforeseeable changes.
  • Autoencoders provide unsupervised learning, reducing reliance on labeled anomaly data that supervised models may lack.

II. RELATED WORK

Prior anomaly-detection methods trade off modeling assumptions, computational cost, and communication overhead in resource-constrained WSNs. The paper positions autoencoders as a lower-complexity distributed alternative that avoids sensor-to-sensor communication and extends autoencoder use to dynamic networked settings.

  • Parametric anomaly detectors can suffer model mismatch when real-world data violate assumed normal-data distributions.
  • The k-nearest-neighbors approach has complexity O(2^M−1), making it prohibitive when input dimension M is large.
  • Distributed methods reduce computation but require frequent, reliable sensor communication that consumes substantial power.
  • Hyper-ellipsoidal one-class SVM methods reduce communication overhead but use matrix inversions that are computationally unfriendly to sensors.
  • The proposed sensor algorithm uses a simple matrix dot product and eliminates communication between sensors, yielding lower computational complexity than existing solutions.
  • This work is presented as the first use of autoencoders for anomaly detection in a distributed, dynamic WSN context.

A. Preliminaries and Model

An autoencoder reconstructs its input to learn a condensed representation, using input and output layers of equal dimension plus hidden layers. Its training objective combines reconstruction error with regularization, and the model computes layer activations from weighted inputs and biases.

  • An autoencoder reconstructs its inputs rather than predicting target variables, thereby learning a condensed representation through encoding.
  • The input layer represents an M-dimensional signal vector, while the output has the same dimension and is trained by setting y = x.
  • Hidden layers learn essential input patterns with affordable information loss; in Fig. 2, the network has L = 3 layers and n(2) = 2 hidden nodes.
  • Each layer computes activations by applying f to a weighted previous-layer activation plus a bias term.
  • The cost function combines reconstruction error against the original inputs with a regularization term that prevents overfitting.

B. System Architecture and Two-Part Algorithm

The system splits anomaly detection between sensors and the IoT cloud: sensors detect anomalies locally, while the cloud periodically trains and redistributes autoencoder parameters. Residual statistics support anomaly decisions, with low sensor-side computational complexity and configurable operation frequencies.

  • Distributed sensor-cloud architecture: Each sensor runs an autoencoder, detects anomalies locally, and uploads training data to the cloud less frequently than sensing.The architecture avoids communication with other sensors during local detection; an example contrasts daily uploads with sensing every two minutes.
  • Distributed sensor-cloud architecture: The cloud trains the autoencoder using sensor-provided input-output pairs and sends updated parameters back to the sensors.The two-part design is represented by the DADA-S sensor algorithm and DADA-C cloud algorithm.
  • Residual-based detection: Sensors compute reconstruction residuals, upload daily residuals, and receive cloud-computed mean and variance for anomaly detection.The parameter p controls the residual threshold; p = 2 or p = 3 corresponds to 5% or 2.5% average anomaly classifications under Gaussian residuals.
  • Scalability: For large-scale WSNs, sensors can be organized into c clusters, with one autoencoder maintained for each cluster.This arrangement applies when nearby sensors monitor the same physical phenomenon and typically have similar readings without anomalies.
  • Efficiency and operating modes: The sensor algorithm can be modified for real-time detection, while higher cloud upload frequency may be needed in highly erratic environments for greater accuracy.The real-time modification need not increase communication overhead because sensors transmit anomaly indicators only sporadically.
  • Efficiency and operating modes: Sensor-side computation is O(M^2), dominated by an autoencoder matrix dot product, compared with O(2M−1) in the cited alternative.The paper characterizes this polynomial workload as readily affordable by most commercial off-the-shelf sensors.

A. WSN Testbed and Dataset

The evaluation uses an eight-node indoor WSN testbed monitoring temperature and relative humidity every two minutes over four consecutive months. Synthetic spike and burst anomalies are injected because sufficient real anomalies are difficult to obtain.

  • The indoor testbed contains S = 8 sensor nodes monitoring temperature and relative humidity every two minutes.This produces 720 daily readings from each sensor.
  • The dataset comprises sensor readings collected from September to December 2016.
  • Synthetic anomalies are generated because the dataset lacks sufficient real anomalies.
  • Spikes model a sharp rise followed immediately by a sharp decline in a sensor reading.Their magnitude v may be negative.
  • Bursts model a continuous, constant offset that persists for a finite period.The offset magnitude v may be negative.

B. Experimental setup

The experiment configures a compact autoencoder for 720-dimensional daily sensor inputs and evaluates anomaly detection with AUC, which summarizes ROC performance.

  • The autoencoder uses 720-node input and output layers and selects 504 hidden neurons through k-fold cross-validation.This configuration corresponds to a 30% compression ratio.
  • The model is initialized using a small anomaly-free portion of the WSN testbed dataset.
  • AUC summarizes the ROC curve’s true positive rate and false positive rate in one performance measure.AUC approaches 1 for a good classifier, equals 0.5 for random guessing, and approaches 0 for a bad classifier.

C. Results

Experiments show that the autoencoder reconstructs normal data accurately and maintains strong anomaly-detection performance across anomaly magnitudes and frequencies. Training-data strategies also support adaptation to non-stationary environments, with a tradeoff between detection and false-positive rates.

  • Reconstruction validation: The reconstructed data almost coincides with true data in anomaly-free cases, validating the trained autoencoder.
  • Varying anomaly magnitude: AUC exceeds 0.8 most of the time across anomaly magnitudes and variances.Lower AUC values between 0.5 and 0.8 occur when both |µv| and σ2_v are below 0.12.
  • Varying anomaly magnitude: The AUC is symmetric about µv because the model treats positive and negative deviations equivalently through the residual.
  • Varying anomaly frequency: The autoencoder maintains performance within a reasonable range of anomaly frequency K, despite increasing anomalies making detection harder in general.AUC increases slightly as K rises, but the authors draw a conservative robustness conclusion because AUC combines TPR and FPR.
  • Varying anomaly frequency: At K = 720, seven normal sensors on average still help screen out anomalous readings.
  • Adaptivity to non-stationary environment: The Random training scheme achieves up to 18% better TPR than Prioritized, while Prioritized reduces FPR by up to 60%.Random retains more historical data; Prioritized uses recent data mixed with historical data and is more responsive to changes.
  • Adaptivity to non-stationary environment: Prioritized is generally recommended because it offers a more balanced TPR–FPR tradeoff while the model adapts to unforeseeable changes.The residual variance increases after retraining, allowing more changes to be accepted without false alarms.

V. CONCLUSION

The paper makes autoencoder-based anomaly detection feasible for resource-limited WSN through a simple, distributed design with cloud-assisted training. Experiments show high accuracy, low false alarms, and adaptation to new changes, while future work targets large-scale networks.

  • Conclusion: The two-part algorithm allocates training to the IoT cloud while sensors perform distributed anomaly detection with zero inter-sensor communication.Cloud–sensor communication occurs at a much lower, configurable frequency.
  • Conclusion: A single-hidden-layer autoencoder keeps sensor computation at polynomial complexity O(M^2), making the approach suitable for resource-limited sensors.The sensor-side algorithm uses a simple matrix dot product operation.
  • Conclusion: Experiments on four-month indoor WSN data show high anomaly-detection accuracy, low false alarms, and adaptation to unforeseeable changes in non-stationary environments.Accuracy and false alarms are jointly characterized by AUC.
  • Conclusion: The authors plan to extend the model to large-scale sensor networks for large-scale IoT applications.
Loading 1812.04872v1…