Anomaly Detection in Environmental Monitoring Networks [Application ...

Application Notes

James C. Bezdek, Sutharshan Rajasegarar, Masud Moshtaghi, Chris Leckie, Marimuthu Palaniswami University of Melbourne, AUSTRALIA Timothy C. Havens University of Missouri, USA

Anomaly Detection in Environmental Monitoring Networks

I. Introduction

Abstract We apply a recently developed model for anomaly detection to sensor data collected from a single node in the Heron Island wireless sensor network, which in turn is part of the Great Barrier Reef Ocean Observation System. The collection period spanned six hours each day from February 21 to March 22, 2009. Cyclone Hamish occurred on March 9, 2009, roughly in the middle of the collection period. Our system converts sensor measurements to elliptical summaries. Then a dissimilarity image of the data is built from a measure of focal distance between pairs of ellipses. Dark blocks along the diagonal of the image suggest clusters of ellipses. Finally, the single linkage algorithm extracts clusters from the dissimilarity data. We illustrate the model with three two-dimensional subsets of the three dimensional measurements of (air) pressure, temperature and humidity. Our examples show that iVAT images of focal distance are a reliable basis for estimating cluster structures in sets of ellipses, and that single linkage can successfully extract the indicated clusters. In particular, we are able to clearly isolate the cyclone Hamish event with this method, which demonstrates the ability of our model to detect anomalies in environmental monitoring networks. Digital Object Identifier 10.1109/MCI.2011.940751 Date of publication: 13 April 2011

52

U

nderstanding the behavior of complex ecosystems requires analysis of detailed observations of an environment under a range of different conditions. Wireless Sensor Networks (WSNs) provide a flexible platform to collect data for environmental modeling. A WSN comprises a set of low-powered nodes, each with its own sensors, power supply, CPU and radio transceiver, which can self-organize into a network for collecting and reporting sensor measurements. While WSNs provide raw data from the monitored environment, an open challenge is how to build and utilize models of “normal” behavior and “interesting” events from that data. In this paper we examine the use of hyperellipsoidal models for detecting anomalies in a WSN. Our aim is to test the ability of our model to characterize normal and unusual (anomalous) behavior in a particular marine ecosystem, but the methodology itself is applicable to many other types of environmental monitoring networks. Hyperellipsoids (more simply, ellipsoids) occur in many areas of applied mathematics. For example, level sets of Gaussian probability densities are ellipsoids [1]. Ellipsoids appear often in clustering [2-4] and classifier design [1, 5-7]. Please be careful to distinguish the present work, wherein the input data objects are ellipsoids, to

IEEE COMPUTATIONAL INTELLIGENCE MAGAZINE | MAY 2011

clustering algorithms such as that of Dave and Patel [4], where the output of clustering input sets of object vectors in p-space results in ellipsoidal prototypes. Ellipsoids have been used for anomaly detection in WSNs [8-13] and motifbased patterned fabric defect detection [14]. In particular, the authors of [10] model the data collected at individual sensor nodes by sample-based ellipsoids; in [11, 12] they develop several methods for cluster ing sets of ellipsoids in this context; and in [13, 15] visual tendency of assessment is used to establish the possible presence of clusters of ellipsoids. The focus of this study is environmental monitoring data collected by the Great Barrier Reef Ocean Observing System [(GBROOS), 16-18], which compr ises a set of seven stations deployed along the Great Barrier Reef of Australia. Two sites are located in the southern GBROOS; one at Heron Island and one near by at One Tree Island. The Australian Institute of Marine Science (AIMS) [17] deploys and maintains the sensor networks in the Great Barrier Reef region on these islands. At each site, a range of sensors have been deployed to monitor the general lagoon water conditions. They are complimented by deeper water moorings located outside the reef that give information about the deeper water characteristics. The Heron Island network is shown in Figure (1a). The

1556-603X/11/$26.00©2011IEEE

Base Station

Buoy Pole

(a)

(c)

(b)

(d)

(e)

FIGURE 1 The Heron Island wireless sensor network. (a) Heron Island WSN; (b) track of Cyclone Hamish; (c) pole; (d) Buoy; (e) Base station.

network is a two tiered, hierarchical topological network with heterogeneous sensor nodes in each level [19, 20]. Nodes in the first tier are called poles [Figure (1c)] and the nodes [Figure (1d)] in the second tier are called buoys. There are 5 buoys and 6 poles deployed in the lagoon area of the Great Barrier Reef approximately 2 km apart. The buoys communicate with the poles via a single hop, and the poles communicate to the base station via multiple hops. All the poles and buoys are equipped with temperature probes that measure temperatures below the ocean surface. The base station, shown in Figure (1e), transmits the collected data to the mainland 75 km away. One of the poles is equipped with a weather station which measures air temperature, pressure, humidity, rain, air speed and direction. The weather mea-

surements are collected at 10 min intervals. We use part of the weather station’s data, available at http://data.aims.gov. au/gbroos/. The known anomaly in the data is the onset of Cyclone Hamish on March 9. The track of Hamish in the vicinity of Heron Island on March 9, 2009 is shown in Figure (1b). Figure 2 illustrates the architecture of our Elliptical Summaries Anomaly Detection (ESAD) system. First, measurement data are collected at individual sensors, shown in view (2a). Then the collection of samples at each node is converted to an elliptical summary as in view (2b). Figure (2c) depicts the construction of a dissimilarity image of the data with the focal distance measure. In view (2d) clusters of ellipses are suggested by dark blocks along the diagonal of a reordered dissimilarity image (RDI) built with the recursive iVAT algorithm. This image assesses clustering

tendency amongst the set of ellipses; and also suggests how many clusters to seek in the data. Finally, the single linkage algorithm extracts clusters from the dissimilarity data. The three clusters found this way from the data in (2c) are shown in (2e). Remark: Figure (2a) shows the ESAD model for the general case where many nodes contribute ellipsoids in (2b) for aggregation. But in this study, we construct 30 ellipses from data collected at a single node (the weather station) over the course of 30 days. In this context, cyclone Hamish may appear as an internal node anomaly, called a first order anomaly in [10, 13, 15]. The remainder of this paper is organized as follows. Section II describes the measure of similarity on pairs of ellipses we call focal distance. Section III discusses the recursive iVAT algorithm for displaying reordered dissimilarity images.

MAY 2011 | IEEE COMPUTATIONAL INTELLIGENCE MAGAZINE

53

Ellipses: E30 Data

35

Feature 2

30 25 20

5 0

5

(b)

10 15 20 25 30 35 40 45 Feature 1 (c)

45 40 35 30 25 20 15 10 5 0

5 10 15 20 25 30 5

10

15 20 (d)

25

Focal Similarity

0

30

5 10 15 20 25 30 35 40 45 (e)

FIGURE 2 The ESAD architecture for detecting anomalies in wireless sensor networks.

Geometrically, E 1 A, m; t 2 is the (surface of the) hyper-ellipsoid in p-space induced by A, all of whose points are the constant A-distance (t) from its center m. Sometimes t is called the “effective radius” of E 1 A, m; t 2 . When A = Ip, E 1 A, m; t 2 is the surface of a hyper-sphere with radius t. In this paper p = 2 for the numerical examples, so the hyperellipsoids are really ellipses, but for completeness, we present the model for the general case. Suppose we have two ellipsoids in p - s p a c e , Ei 5 E 1 Ai, mi; ti 2 a n d Ej 5 E 1 Aj, mj; tj 2 . We want a measure of similarity between Ei and Ej. Let s (Ei, Ej) denote the similarity between Ei and Ej. There are many definitions of similarity functions in the literature. We use the following properties:

Section IV presents iVAT images for the three data sets we use to illustrate our method. Section V discusses clustering in the dissimilarity data produced by each measure with the single linkage clustering algorithm. Section VI offers our conclusions, and some ideas for future research. II. Similarity Measures for Pairs of Ellipsoids

Let vector s x, m [ Rp, and let A [ Rp3p be positive definite. The quadratic form Q 1 x 2 5 xTAx is positive definite. For m [ Rp, the level set of Q 1 x 2 m 2 5 1 x 2 m 2 TA 1 x 2 m 2 5 7 1 x 2 m 2 7 2A, for scalar t2 > 0, is E 1 A, m; t 2 5 5 x [ Rp|7 x 2 m7 2A 5 t2 6 . (1)

q (t )

p (t ) f1

m

t

f2

FIGURE 3 Focal points f1 and f2 and focal segment f12 of E(A, m; t).

54

(2a)

s 1 Ei, Ej 2 5 1 3 Ei 5 Ej;

(2b)

s 1 Ei, Ej 2 5 s 1 Ej, Ei 2 4 i 2 j;

(3)

s 1 Ei, Ej 2 . 0 4 i, j.

(4)

15 10

(a)

s 1 Ei, Ei 2 5 1 4 i;

IEEE COMPUTATIONAL INTELLIGENCE MAGAZINE | MAY 2011

Span (uM)

Functions that satisfy (2a), (3) and (4) are weak similarity measures. Functions that satisfy (2b), (3) and (4) are strong similarity measures. Strong similarity measures are also weak, and are simply called similarity measures. Weak similarity measures correspond to pseudometric dissimilarities. The measure of (dis)similarity we use is a weak similarity measure, which is discussed at length in [15], and briefly reviewed here. Every plane ellipse E(A, m; t) can be constructed by tracing the curve whose distance from a pair of foci f1 and f 2 is a positive constant, c(t) = p(t)+ q(t) as shown in Figure 3. The foci always lie on the major axis of the ellipse. If 5 am, aM 6 are the minimum and maximum eigenvalues of A with corresponding orthogonal eigenvect o r s 5 um, uM 6 , t h e f o c i a r e f1, 2 5 m 6 1/2 " 1 aM 2 am 2 / 1 aMam 2 3 uM We call the line segment with endpoints f1 and f2 by f12 the focal segment of E(A, m; t). We define the focal similarity between a pair of ellipses E1 and E2 as the average of a set of four distances. Each component in the average is a distance to one of the focal elements e12 of E1 or f12 of E2. Let d 1 x, y 2 5 7 x 2 y7 be the Euclidean distance between vectors in x, y [ Rp. We have two focal segments, e12 with endpoints e1 and e2, and f12 with endpoints f1 and f2. We compute four default distances: d1 5 min 5 d 1 e1, f1 2 , d 1 e1, f2 2 6 ;

(5)

d2 5 min 5 d 1 e2, f1 2 , d 1 e2, f2 2 6 ;

(6)

d3 5 min 5 d 1 f1, e1 2 , d 1 f1, e2 2 6 ;

(7)

d4 5 min 5 d 1 f2, e1 2 , d 1 f2, e2 2 6 ;

(8)

One or more of the values in (5)– (8) may be replaced using the following heuristic. For each foci “f ”, if the orthogonal projection of “f ” falls on the opposing focal segment, then we

d1 1 d2 1 d3 1 d4 ; (9) 4 We won’t need the multidimensional (p > 2) version of (9) in this paper, but for completeness we discuss the general case. Let E1(A1, m1; t1) and E2(A2, m2; t2) be non-degenerate ellipsoids in Rp. L e t a 5 5 a1 # a2 # c# ap 6 a n d b 5 5 b1 # b2 # c# bp 6 b e t h e eigenvalues of A 1 and A 2 . Adjust the eigenvalues to a* 5 1 1/ !a1, c, 1/ !ap 2 T a n d b* 5 11/ !b1, c, 1/ !bp 2 T. There are p(p21)/2 focal elements for the two-dimensional ellipses spanned by each pair of eigenvectors of E1 and E2. Thus, there are (p21) “ordered” focal distances between pairs of focal segments of the two ellipsoids. We define the generalized focal distance between E1 and E2 as the average of the (p21) plane focal distances of successive, ordered pairs of focal segments: 5

p21

a dis 1 ej, j11, fj, j11 2

j51

1p 2 12

Input: D i s s i m i l a r i t i e s Dn3n f o r O = {o1,…,on} Step 1. K = { 1 , … , n } ; s e l e c t 1 i, j 2 [ argmax 5 Dpq 6 ;

When p 5 2, (10) reduces to (9). See [15] for a proof that the generalized focal distance dgfd is a pseudometric on pairs of ellipsoids. III. Tendency Assessment with iVAT

Clustering is the partitioning of a set of unlabeled objects O = {o1,…, on} into

d

a c b e1

e12

t

s e2

FIGURE 4 Basis of the focal distance between ellipses with focal segments e12 and f12.

2.5 2 1.5 1 0.5 0 –0.5 –1 –1.5 –2

0 0.5 1 1.5 2 2.5 3 3.5 (a)

(b)

(c)

p[K, q[K

Set P(1) = i; I = {i}; and J = K – {i}. Step 2. Fo r t = 2 , … , n : s e l e c t 1 i, j 2 [ argmax 5 Dpq 6 ; P(t) = j; p[I, q[J

(10)

f2

f12

VAT/recursive iVAT: Visual Assessment of Tendency [24]

I d I h {j} and J d J – {j}. Step 3. Form the ordered dissimilarity matrices [VAT]: Dp: d*ij 5 dP 1i2 P 1j2, for 1 # i, j # n. [iVAT]: Dr* 5 3 0 4 n3n; for r = 2; … ; n do j 5 argmin 5 D*rk 6 d

dgfd 1 E1, E2 2 5

f1

k 5 1, c,r 2 1

FIGURE 5 The VAT and iVAT RDIs of the data in view (5a). (a) c = 5 irregular clusters; (b) VAT image I(D*); (c) iVAT image I(D9*).

Drrc* 5 D*rc, c 5 j Drrc* 5 max 5 D*rj, Drjc* 6 , c 5 1, c, r 2 1, c 2 j For 2 # < j , n; i < j:Drji* 5 Drij* Step 4. Display I(Dp) and I(D9p), scaled so that max 5 dij* 6 , max 5 dijr * 6 = 1 # i, j # n

e

dfd 1 E1, E2 2 5 dis 1 e12, f12 2

groups of similar objects [21]. When relational values between pairs of objects are available, we have relational data. Any relation ρ on O 3 O is representable by a square matrix Rn3n 5 [rij], where rij 5 ρ(oi,oj) is the relationship between oi and oj, 1 # i, j # n. We use the focal distance to build a square dissimilarity matrix D = [dfd(Ei, Ej)]. This is the input data to VAT. VAT [22] reorders an input dissimilarity matrix D → Dp and displays a grayscale image I(Dp) whose ij-th element is a scaled dissimilarity value between objects oi and oj. Each element on the diagonal of the VAT image is zero. Off the diagonal, the values range from 0 to 1. If an object is a member of a cluster, then it also should be part of a submatrix of “small” values, whose diagonal is superimposed on the diagonal of the image matrix. The iVAT method [23] transforms D → D9 using a pathbased distance and then VAT is applied to D9 to get D9p, resulting in an iVAT image I(D9p). Constructing the iVAT matrix D9matrix as in [23] can be computationally expensive (O(n 3)). The recursive computation of D9p given here and in [24] is O(n2). Recursive iVAT builds D9p more efficiently than iVAT by first applying VAT to (D) → Dp, and then recursively using Dp to build D9p.

e

replace the appropriate default distance by this distance; otherwise we retain the minimum distance between “f ” and the two opposing foci and use it in one of equations (5)–(8). Figure 4 depicts the general idea for this heuristic using a simplified notation for the distances in equations (5)–(8). In Figure 4 we have d1 5 min 5 a, b 6 , d2 5 min 5 s, t 6 , and since both focal points f1 and f2 project onto focal segment e 12, the orthogonal projection replacements d3 5 c d min 5 a, s 6 and d4 5 d d min 5 b, t 6 . The focal distance between the ellipsoids E1 and E2 is the average of these four distances:

1 # i, j # n

white and 0 = black. Figure (5a) is a scatterplot of a “boxes and stripe” data set similar to that used in [24] to demonstrate iVAT. This two

MAY 2011 | IEEE COMPUTATIONAL INTELLIGENCE MAGAZINE

55

1,015

1,015

1,010 1,005 1,000

1,010 1,005 1,000

995 20 30 40 50 60 70 80 90 100 Humidity (a)

Ellipses: HI30TH Data 100 90 80 70 60 50 40 30 20 22 23 24 25 26 27 28 29 30 31 Temperature (c)

Humidity

Ellipses: HI30TP Data 1,020 Pressure

Pressure

Ellipses: HI30HP Data 1,020

995 22 23 24 25 26 27 28 29 30 31 Temperature (b)

HI30TH: Focal Similarity

HI30TP: Focal Similarity

HI30HP: Focal Similarity 5

5

5

10

10

10

15

15

15

20

20

20

25

25

25

30

30 5

10

15 20 (d)

25

30

30 5

10

15 20 (e)

25

30

5

10

15 (f)

20

25

30

FIGURE 6 The Heron Island Data Sets and their iVAT images, (a) HI30HP: ellipse 17 represents March 9, (b) HI30TP: ellipse 17 represents March 9, (c) HI30TH: ellipse 13 represents March 5 (d) iVAT image of HI30HP, (e) iVAT image of HI30TP, (f) iVAT image of HI30TH.

dimensional data has two round clusters, two rectangular clusters, and one elongated curvilinear cluster. Most would agree that there are c = 5 clusters in this data. These object data were converted to D 5 3 dij 4 5 3 7 xi 2 xj 7 4 using the Euclidean norm. The c = 5 visually apparent clusters in Figure (5c) are quite clearly suggested by the 5 distinct dark diagonal blocks in Figure (5c), I(D9p), which is the iVAT RDI of the data. Compare this to view (5b), which is the VAT image I(Dp) of these data. I(Dp) does not present any evidence about substructure in the data; I(D9p) is a significant improvement. Next we turn to the use of iVAT for assessment of clusters in sets of ellipsoids. IV. iVAT Images of the Heron Island Data

Let E denote n ellipsoids in 2-space, E = 5 E1,E2, c,En 6 . For 1 Ei, Ej 2 [ E 3 E. We compute the focal distance dfd 1 E1, E2 2 at (9) for each ellipse pair, and array these n2 values as the n 3 n dissimilarity relation matrix D. Applying the iVAT algorithm to D will yield an

56

image, I(D9p), that can be used to assess clustering tendencies of the ellipsoids in E 3 E. We will do this after we discuss the data sets that are the basis for our examples. The data used in our examples were collected from the Heron Island weather station: (http://data.aims.gov.au/gbroos/ rtdsviewer.jsp#params?platform=1547 &channel=AirTemp&range=7d& aggPeriod=raw&aggFunc=raw). We constructed three data sets of elliptical summaries from measurements taken from this Web site. There are 30 ellipses in each of the three data sets shown in Figures (6a), (6b) and (6c). The names of the data sets indicate which two of the three measurements are used to build the ellipses. (6a): HI30HP uses (H, P) = (air humidity, air pressure) (6b): HI30TP uses (T, P) = (air temperature, air pressure) (6c): HI30TH uses (T, H) = (air temperature, air humidity) The data were collected every 10 minutes from 9.00 am to 3.00 pm each day for the 30 days beginning February 21, 2009 and ending March 22, 2009. So,

IEEE COMPUTATIONAL INTELLIGENCE MAGAZINE | MAY 2011

each ellipse is built from 37 two-dimensional vectors. The ellipses are numbered chronologically, so ellipse #1 is February 21, ellipse #2 is February 22, and so on. Cyclone Hamish occurred on March 9, which corresponds to ellipse 17 in each of the three data sets. Visual inspection of the data shows that the “Hamish ellipse” #17 stands well apart from the remaining 29 data summaries in two of the three views, viz., Figures (6a) and (6b), both of which, not surprisingly, involve the variable air pressure. The third data set, Figure (6c), contains ellipses built from (T, H) measurements. This set also contains one visually apparent ellipse that is quite distinct from the remaining 29, namely, ellipse #13, corresponding to March 5. These three data sets are consistent with our physical intuition – that air pressure will be radically altered during a cyclonic event. And in turn, this deviation from the pressure norm apparently causes the anomalous “Hamish ellipse”. Lastly, note that the iVAT images in views (6d), (6e) and (6f) of the focal dissimilarity matrix D for each of the three sets shown in

1

2

3

4 5 6 7 Rank (a)

8

9 10

5 4.5 4 3.5 3 2.5 2 1.5 1 0.5 0

Using Focal Similarity: Cluster: 2

Using Focal Similarity: Cluster: 2

Eigenvalue

Using Focal Similarity: Cluster: 2

Eigenvalue

Eigenvalue

5 4.5 4 3.5 3 2.5 2 1.5 1 0.5 0

1

2

3

4

5 6 Rank (b)

7

8

9 10

5 4.5 4 3.5 3 2.5 2 1.5 1 0.5 0

1

2

3

4

5 6 Rank (c)

7

8

9 10

FIGURE 7 The largest 10 ordered eigenvalues for each focal dissimilarity matrix D. (a) HI30HP; (b) HI30TP; (c) HI30TH.

Input Data

1,015

1,015 Feature 2

1,010 1,005 1,000

1,010 1,005 1,000

995 995 20 30 40 50 60 70 80 90 100 20 30 40 50 60 70 80 90 100 Humidity Feature 1 HI30HP

V. Finding Clusters in Sets of Ellipsoids

100 90 80 70 60 50 40 30 20 22 23 24 25 26 27 28 29 30 31 Temperature HI30TH Feature 2

Humidity

Ellipses: HI30TH Data

Clustered Ellipses (SL) for HI30TH. Number of Clusters: 2 100 90 80 70 60 50 40 30 20 22 23 24 25 26 27 28 29 30 31 Feature 1

1,020

Clustered Ellipses (SL) for HI30TP. Number of Clusters: 2 1,020

1,015

1,015

1,010 1,005 1,000

Feature 2

Ellipses: HI30TP Data

Pressure

There are several non-visual ways to estimate the number of clusters (c) prior to clustering. The analytic pre-clustering approach tested here is based on the eigenvalues of D. Ferenc proved in [25] that a non-symmetric n 3 n matrix consisting of c blocks has c large eigenvalues of order c while the other characteristic values remain of order !n as n tends to infinity. Fallah et al. [26] recently showed that Ferenc’s theorem could be used to as a pre-clustering guide to choosing the best SL clusters, by looking for a “big jump” in a plot of the set of ordered eigenvalues (OEVs) {l1 $ l2 $ c $ ln} of D. Figure 7 shows plots of the (square roots of the) first 10 ordered eigenvalues of D for our three data sets. The big jumps in Figure 7 are pretty easy to see, and all clearly indicate that the preferred choice is c = 2 (that is, the fi rst two eigenvalues are large compared to the remaining ones). This

1,020

Optimal SL partition, c = 2 Clustered Ellipses (SL) for HI30HP. Number of Clusters: 2 1,020

Ellipses: HI30HP Data

Pressure

Figures (6a), (6b) and (6c) show the corresponding singleton ellipse in its own cluster quite nicely. The singleton pixel in each image corresponds to an anomalous ellipse for that data set. Each of these unusual ellipses constitutes what is called a first order internal node anomaly in [10, 15]. Now we are ready for the final phase of our ESAD model, step (2e) in Figure 2 – extracting the clusters suggested by iVAT imagery.

1,010 1,005 1,000

995 995 22 23 24 25 26 27 28 29 30 31 22 23 24 25 26 27 28 29 30 31 Temperature Feature 1 HI30TP FIGURE 8 Optimal single linkage partitions of the Heron Island Data.

MAY 2011 | IEEE COMPUTATIONAL INTELLIGENCE MAGAZINE

57

assessment is in complete agreement with the value suggested by each iVAT image in Figure 6. Finally, we complete the analysis of the data by applying the well-known single linkage (SL) algorithm [21] to each focal dissimilarity matrix. Figure 8 repeats each of the three data sets in the left hand view, and shows the (optimal) single linkage partition of each set in the accompanying right hand view. As you can see, there is perfect agreement between the clusters obtained by single linkage and the visually apparent clusters in the data. VI. Conclusions and Discussion

We described our ESAD system for detecting anomalies in WSN data. Measurement data are collected at individual sensors. Then, the collection of samples at each node is converted to an elliptical summary. A focal dissimilarity matrix is built from ellipse pairs, and becomes the basis for tendency assessment with iVAT images. The images suggest (but do not find) clusters of ellipses, represented by dark blocks along the diagonal of the image. Finally, the single linkage algorithm extracts clusters from the dissimilarity data. We applied the ESAD model to three sets of data collected at a single node of the Heron Island sensor network. The collection period spanned the 30 days from February 21 to March 22, 2009. (37) measurement triples of three variables: (air) temperature T, (air) pressure P, and (air) humidity H were collected for each day. Each pair of variables were used to build a set of 30 two-dimensional sample-based ellipses that summarize the daily data. Cyclone Hamish occurred in the middle of this period on March 9. The three examples presented support the following assertions: (i) for these data sets, the focal distance matrix D captures substructure in sets of ellipses quite effectively; (ii) the iVAT image of D provides accurate visual estimates that agree with the ordered

58

eigenvalues of D for clusters of ellipses; (iii) single linkage reliably extracts the clusters of ellipses suggested by preclustering analysis. Most importantly, we are able to correctly isolate the Hamish cyclone event as an anomalous day using air pressure with either of the other two measured variables. This demonstrates that our model delivers as advertised: it can detect first order anomalies in environmental WSN data. In common with all pattern recognition models, there will be instances where our model fails, but we think that our examples show that the ESAD model has enough merit to warrant further study. What’s next? We have not tested this scheme for ellipsoids in higher dimensions (p > 2). But there are WSNs (including the Heron Island network discussed here) that collect p 5 3, 4, and 5 measurements at each station [10, 16]. Our intuition is that for p much larger than 3 or 4, focal distance will not capture enough reliable clustering information to get results comparable to the ones presented here unless n, the number of ellipsoids, is many thousands. If this is the case, some way to supplement the similarity measure in higher dimensions will be required. This will include a study using other measures of similarity and dissimilarity, such as the transformation energy and compound normalized similarities, and the Bhattacharya distance [13, 15]. References [1] R. A. Johnson and D. A. Wichern, Applied Multivariate Statistical Analysis, 6th ed. Englewood Cliffs, NJ: Prentice-Hall, 2007. [2] P. M. Kelly, D. R. Hush, and J. M. White, “An adaptive algorithm for modifying hyperellipsoidal decision surfaces,” J. Artif. Neural Netw., vol. 1, no. 4, pp. 459–480, 1994. [3] P. M. Kelley, “An algorithm for merging hyperellipsoidal clusters,” Los Alamos National Lab., Los Alamos, NM, TR LA-UR-94-3306, 1994. [4] R. N. Davé and K. J. Patel, “Fuzzy ellipsoidal-shell clustering algorithm and detection of elliptical shapes,” in Proc. SPIE Intelligent Robots and Computer Vision IX, D. P. Casasent, Ed., 1607, pp. 320–333. [5] Y. Nakamori and M. Ryoke, “Identification of fuzzy prediction models through hyperellipsoidal clustering,” IEEE Trans. Syst. Man Cybern, vol. 24, no. 8, pp. 1153–1173, 1994. [6] J. Dickerson and B. Kosko, “Fuzzy function learning with covariance ellipsoids,” in Proc. IEEE Int. Conf.

IEEE COMPUTATIONAL INTELLIGENCE MAGAZINE | MAY 2011

Neural Networks. Piscataway, NJ: IEEE Press, 1993, pp. 1162–1167. [7] R. Duda and P. Hart, Pattern Classification and Scene Analysis. New York: Wiley Interscience, 1973. [8] S. Rajasegarar, C. Leckie, and M. Palaniswami, “CESVM: Centered hyperellipsoidal support vector machine based anomaly detection,” in Proc. IEEE ICC 2008, pp. 1610–1614. [9] S. Rajasegarar, J. C. Bezdek, C. A. Leckie, and M. Palaniswami, “Analysis of anomalies in IBRL data from a wireless sensor network deployment,” in Proc. Int. Conf. Sensor Technologies and Apps, 2007, pp. 158–163. [10] S. Rajasegarar, J. C. Bezdek, C. A. Leckie, and M. Palaniswami, “Elliptical anomalies in wireless sensor networks,” ACM Trans. Sensor Netw., vol. 6, no. 1, pp. 1550–1579, 2009. [11] M. Moshtaghi, S. Rajasegarar, C. A. Leckie, and S. Karunasekera, “Anomaly detection by clustering ellipsoids in wireless sensor networks,” in Proc. 5th Int. Conf. Intelligent Sensors, Sensor Networks and Information Processing, 2009, pp. 7–10. [12] S. Rajasegarar, C. A. Leckie, J. C. Bezdek, and M. Palaniswami, “Centered hyperspherical and hyperellipsoidal one-class support vector machines for anomaly detection in sensor networks,” IEEE Trans. Inform. Forens. Security, vol. 5, no. 3, pp. 518-533. [13] J. C. Bezdek, T. C. Havens, J. M. Keller, C. A. Leckie, L. Park, M. Palaniswami, and S. Rajasegarar, “Clustering elliptical anomalies in sensor networks,” in Proc. FUZZ-IEEE 2010. Piscataway, NJ: IEEE Press, pp. 909–916. [14] H. Y. T. Ngan, G. K. H. Pang, and N. H. C. Yung, “Ellipsoidal decision regions for motif-based patterned fabric defect detection,” Pattern Recognit., vol. 43, pp. 2132–2144, 2010. [15] M. Moshtaghi, T. C. Havens, L. Park, J. C. Bezdek, S. Rajasegarar, C. A. Leckie, M. Palaniswami, and J. M. Keller, “Clustering hyperellipsoids,” Pattern Recognit., vol. 44, pp. 55–69, 2011. [16] IMOS 2010 [Online]. Available: http://imos.org.au/ [17] AIMS 2010 [Online]. Available: http://www.aims. gov.au/ [18] ISSNIP 2010 [Online]. Available: http://www. issnip.unimelb.edu.au/research_program/sensor_networks/environmental_monitoring/gbroos [19] S. Rajasegarar, J. Gubbi, O. Bondarenko, S. Kininmonth, S. Marusic, S. J. Bainbridge, I. Atkinson, and M. Palaniswami, “Sensor network implementation challenges in The Great Barrier Reef marine environment,” in Proc. ICT Mobile Summit (SENSEI-ISSNIP Workshop), 2008, pp. 1–9. [20] S. J. Bainbridge, G. Feather, and D. C. Eggeling, “The use of sensor networks to monitor and manage the Great Barrier Reef,” in Proc. Challenges in Environmental Science and Engineering (CESE-2009). [21] S. Theodoridis and K. Koutroumbas, Pattern Recognition, 5th ed. New York: Academic Press, 2010. [22] J. C. Bezdek and R. J. Hathaway, “VAT: A tool for visual assessment of (cluster) tendency,” in Proc. 2002 Int. Joint Conf. Neural Networks, 2002, pp. 2225–2230. [23] L. Wang, T. Nguyen, J. C. Bezdek, C. A. Leckie, and K. Ramamohanarao, “iVAT and aVAT: Enhanced visual analysis for cluster tendency assessment,” in Proc. PAKDD, Hyderabad, India, June 2010, vol. 1, pp. 16–27. [24] T. C. Havens and J. C. Bezdek, “An efficient formulation of the improved visual assessment of cluster tendency (iVAT) algorithm,” in Proc. IEEE TKDE, Feb. 2011. [25] J. Ferenc, “On the characteristic values of non-symmetric block random matrices,” J. Theor. Prob., vol. 3, no. 2, pp. 199–205, 1990. [26] S. Fallah, D. Tritchler, and J. Beyene, “Estimating number of clusters based on a general similarity matrix with application to microarray data,” Stat. App. Genet. Mol. Biol., vol. 7, no. 1, pp. 1–23, 2008.