Impact of Data Fusion on Real-Time Detection in Sensor ... - MSU CSE

Impact of Data Fusion on Real-Time Detection in Sensor Networks Rui Tan1 Guoliang Xing2 Benyuan Liu3 Jianping Wang1 2 University of Hong Kong, HKSAR Michigan State University, USA 3 University of Massachusetts Lowell, USA

I. I NTRODUCTION Wireless sensor networks (WSNs) are increasingly available for mission-critical applications such as battlefield monitoring and security surveillance. A fundamental objective of these applications is real-time intrusion detection that requires any unknown intruders to be detected by the network within tight deadlines. Many intrusion detection scenarios involve a large number of sensors distributed in a vast geographical area. Moreover, sensor nodes are often not accessible after deployment due to the constraints of physical environments (e.g., battlefields). Therefore, it is crucial to analyze and understand the expected real-time performance of WSNs before the actual deployment. However, we face several key challenges in analyzing the real-time performance of sensor networks for intrusion detection. First, the real-time detection performance of a sensor network is inherently affected by the uncertainties in network deployment and sensor measurement. For instance, unpredictable environmental noises can easily trigger false alarms of low-cost sensors, resulting probabilistic detection performance. Although false alarms can be suppressed by making sensors more conservative, it inevitably jeopardizes

1 0.8

0.10 t = 0.01 t = 0.05

0.6 0.4 0.2 0 50 100 150 200 Distance from the vehicle (meters)

Figure 1. Detection probability vs. the distance from the vehicle.

False alarm rate PF

Abstract—Real-time detection is an important requirement of many mission-critical wireless sensor network applications such as battlefield monitoring and security surveillance. Due to the high network deployment cost, it is crucial to understand and predict the real-time detection capability of a sensor network. However, most existing real-time analyses are based on overly simplistic sensing models (e.g., the disc model) that do not capture the stochastic nature of detection. In practice, data fusion has been adopted in a number of sensor systems to deal with sensing uncertainty and enable the collaboration among sensors. However, real-time performance analysis of sensor networks designed based on data fusion has received little attention. In this paper, we bridge this gap by investigating the fundamental real-time detection performance of largescale sensor networks under stochastic sensing models. Our results show that data fusion is effective in achieving stringent performance requirements such as short detection delay and low false alarm rates, especially in the scenarios with low signalto-noise ratios (SNRs). Compared with the disc model, data fusion can reduce the network density by about 60% while the false alarm rate is lower than 1% and any intruder can be detected within one detection period. The disc model is only suitable when the SNR is sufficiently high. Our results help understand the impact of data fusion and provide important guidelines for the design of real-time wireless sensor networks for intrusion detection.

Detection probability PD

1 City

0.08 0.06 0.04 0.02 0 0.01

0.05 0.10 0.15 Detection threshold t

Figure 2. False alarm rate vs. detection threshold.

the timeliness of detection. There exist fundamental tradeoffs between real-time and other detection performance metrics of a sensor network. Second, the adoption of advanced signal processing algorithms often significantly complicates the modeling and analysis of system real-time performance. Collaborative signal processing techniques such as data fusion [1] are widely employed by current sensor systems to enable the cooperation among multiple sensors with limited sensing capability. For instance, reliable intrusion detection in noisy environments requires the aggregation of readings from multiple sensors. However, such requirements often have complex impacts on the system real-time performance. Recently, several sensor networks have been developed for real-time detection [2], [3]. However, the real-time performance of such systems are often analyzed based on overly simplistic sensing models [2]–[9]. In particular, the sensing region of a sensor is modeled as a disc with radius r centered at the position of the sensor, where r is referred to as the sensing range. A sensor deterministically detects the targets within its sensing range. As the simplistic disc model allows a geometric treatment to the detection problem, it has been widely adopted in the design and analysis of surveillance sensor networks. However, a key shortcoming of the disc model is that it fails to capture the stochastic nature of sensing, such as probabilistic delay and detectability caused by noise. Moreover, most studies based on the disc model do not exploit the collaboration among sensors. To illustrate the inaccuracy of the disc model, we plot the sensing performance of an acoustic sensor in Fig. 1 and 2 using the data traces collected in a vehicle detection experiment [10]. In the experiment, the sensor detects moving vehicles by comparing its signal energy measurement against a threshold (denoted by t). Fig. 1 plots the probability that the sensor detects a vehicle (denoted by PD ) versus the distance from the vehicle. No clear cut-off boundary between

2

successful and unsuccessful sensing of the target can be seen in Fig. 1. Similar result is observed for the sensor’s false alarm rate (denoted by PF ) shown in Fig. 2. In this work, we develop an analytical framework to study the real-time surveillance performance of large-scale WSNs that are designed based on collaborative data fusion algorithms. To quantify the fundamental trade-off between detection delay and false alarm rate, we propose a new realtime metric called α-delay that is defined as the delay of detecting an intruder subject to the false alarm rate bound α. The main focus of this paper is to establish the correlation between network density and α-delay in intrusion detection. We first propose a probabilistic disc model that extends the classical disc model to the context of stochastic detection. Moreover, we study the impact of data fusion on real-time detection through the comparison between the disc- and fusion-based sensing models. We show that the ratio of network densities to achieve the minimum α-delay under the SNR 1 two models has a tight bound of Θ( Q−1 (α) ) . To the best of our knowledge, this work is the first to study the real-time performance of large-scale WSNs based on collaborative sensing models. Our findings have several key implications for the design of real-time sensor systems for intrusion detection. First, data fusion is effective in achieving stringent performance requirements such as short detection delay and low false alarm rates, especially in the scenarios with low SNRs. Our simulations with realistic settings show that data fusion can reduce the network density by about 60% while the false alarm rate is lower than 1% and any intruder can be detected within one detection period. Second, the disc model is suitable only when the SNR is sufficiently high. These results lay a foundation for understanding the limitation of the existing real-time analyses based on simplistic sensing models, and provide key insights into the design of fusionbased real-time surveillance WSNs. The rest of this paper is organized as follows. Section II reviews related work. Section III introduces the preliminaries and problem definition. In Section IV and V, we derive the α-delay under the disc and fusion models, respectively. In Section VI, we study the impact of data fusion on realtime detection through performance comparison between the two models. Section VII presents simulation results and Section VIII concludes this paper.

[5]. The length of free path that a target travels undetected is derived in [6]. However, the disc model adopted by these works fails to capture the stochastic characteristics of realworld intrusion detection, such as probabilistic detectability and false alarms. In this paper, we study the relationship between the performance of real-time stochastic detection and network density. We propose a probabilistic disc model that naturally extends the existing analytical results [8] based on the classical disc model to the context of stochastic detection. Moreover, we study the impact of data fusion on network density and compare with the results under the probabilistic disc model. Many sensor network systems have incorporated various data fusion schemes to improve the system performance [10]–[17]. In the surveillance system based on MICA2 motes developed in [12], the system false alarm rate is reduced by fusing the detection decisions made by multiple neighboring sensors. In the DARPA/IXOs SensIT project, advanced data fusion techniques have been employed in a number of algorithms and protocols designed for target detection [11], [13], [14], localization [15], [16], and classification [10], [17]. However, the performance analysis of large-scale fusionbased WSNs has received little attention. There is vast literature on stochastic signal detection based on multi-sensor data fusion. Early work [1] focuses on small-scale powerful sensor networks (e.g., a handful of radars). Recent studies on data fusion [13], [14], [18] have considered the specific properties of WSNs such as sensors’ spatial distribution and limited sensing capability. However, these works focus on analyzing the optimal fusion strategies that maximize the system detection performance of a given network. In contrast, this paper studies the impact of data fusion on the detection delay with respect to network density. III. P RELIMINARIES

AND

P ROBLEM D EFINITION

In this section, we first describe the preliminaries of our work, which include the target energy and sensor measurement models. We then introduce the problem definition. A. Sensor Measurement Model

Most existing real-time analyses of target detection [4]– [6] and sensing coverage [7]–[9] in WSNs are based on the simplistic disc model. The delay of detecting a moving target with randomly deployed sensors has been analyzed in [4],

Sensors perform detection by measuring the energy of signals emitted by the target2 . The energy of most physical signals (e.g., acoustic and electromagnetic signals) attenuates with the distance from the signal source. Suppose sensor i is di meters away from the target that emits a signal of energy S. The attenuated signal energy si at the position of sensor i is given by si = S · w(di ), where w(·) is a decreasing function satisfying w(0) = 1 and w(∞) = 0. In this paper, we assume w(d) = 1/(1 + d2 ). Extension of our results to the general form of w(d) can be found in Appendix J.

1 Q−1 (·) is the inverse function of the complementary cumulative distribution function of the standard normal distribution. f (x) = Θ(g(x)) represents g(x) is the asymptotic tight bound of f (x), i.e., ∃c1 , ∃c2 , and ∃x0 such that c1 g(x) ≤ f (x) ≤ c2 g(x) for x ≥ x0 .

2 Several types of sensors (e.g., acoustic sensor) only sample signal intensity at a given sampling rate. The signal energy can be obtained by preprocessing the time series during a period, which has been commonly adopted to avoid the transmission of raw data [10], [13]–[16].

II. R ELATED W ORK

3 1.0

300

sampling interval

0.8

250 200

CDF

Measurement (×10−4 )

350

150

T

0.6

Figure 5. Temporal view of a single sensor’s operation. The sensor outputs an energy measurement after each sampling interval.

0.4

100 0.2

50 0

0

noise CDF 0.0 0.002 0.004 0.006 0.008 0.01 -2 -1 0 1 2 3 4 5 1/d2 Noise energy (×10−3 )

time

T

Table I S UMMARY OF N OTATION 6

Figure 3. Energy measurement vs. Figure 4. The CDF of noise en1/d2 (d is the distance from the ergy. The dashed line is the CDF of target, in the unit of meters). N (0.001, 0.0012 ).

The measurements of sensors are contaminated by additive random noises from sensor hardware or environment. Depending on the hypothesis that the target is absent (H0 ) or present (H1 ), the measurement of sensor i, denoted by yi , is given by H0 : y i = n i , H1 : y i = s i + n i , where ni is the energy of noise experienced by sensor i. We assume that the noise ni at each sensor i follows the normal distribution, i.e., ni ∼ N (µ, σ 2 ), where µ and σ 2 are the mean and variance of ni , respectively. We assume that the noises, {ni |∀i}, are spatially independent across sensors. Therefore, the noises at sensors are independent and identically distributed (i.i.d.) Gaussian noises. In the presence of target, the measurement of sensor i follows the normal distribution, i.e., yi |H1 ∼ N (si + µ, σ 2 ). Due to the independence of noises, the sensors’ measurements, {yi |∀i, H1 }, are spatially independent but not identically distributed as sensors receive different signal energies from the target. We define the SNR as δ = S/σ which quantifies the noise level. The above signal decay and sensor measurement models have been widely assumed in the literature of signal detection [1], [15] and also have been empirically verified [16], [19]. Fig. 3 and Fig. 4 plot the energy of signal from driving vehicles and noise measured by an acoustic sensor in the SensIT experiments [10]. From Fig. 3, we can see that the signal energy increases linearly with 1/d2 , which indicates that w(d) has an order of 1/d2 . This is consistent with the signal decay model adopted in this paper. Fig. 4 plots the cumulative distribution function (CDF) of noise energy, which matches the CDF of the normal distribution N (0.001, 0.0012). We assume that a sensor executes detection task every T seconds. T is referred to as the detection period. In each detection period, a sensor gathers the signal energy during the sampling interval for the detection made in the current period. The temporal view of a single sensor’s operation is illustrated in Fig. 5. We note that such an intermittent measurement scheme is consistent with several wireless

Symbol S µ, σ2 δ di w(·)

Definition original energy emitted by the target mean and variance of noise energy signal-to-noise ratio (SNR), δ = S/σ distance from the target signal decay function, in this paper, w(d) =

1 1+d2

si attenuated signal energy, si = S · w(di ) ni noise energy, ni ∼ N (µ, σ2 ) H0 / H1 hypothesis that the target is absent / present yi energy measurement, yi |H0 = ni , yi |H1 = si + ni α upper bound of false alarm rate ρ network density F(P ) the set of sensors within fusion range of point P N (P ) the number of sensors in F(P ) ∗ The symbols with subscript i refer to the notation of sensor i.

sensor systems for target detection and tracking [10], [12], [13]. For instance [10], a sensor may wake up every 5 seconds and sample acoustic energy for 0.05 seconds, where T is 5 s and the sampling interval is 0.05 s. We assume that the sampling interval is much shorter than the detection period. Table I summarizes the notation used in this paper. B. Network and Target Models We consider a network deployed in a vast twodimensional geographical region. Several recent projects have demonstrated the deployment of large-scale sensor networks. In the ExScal project [3], [20], about 1200 nodes are distributed in an area of 1.3 km by 300 m. We assume that the positions of sensors are uniformly and independently distributed in the deployment region. Such a deployment scenario can be modeled as a stationary two-dimensional Poisson point process. Let ρ denote the density of the underlying Poisson point process. We note that such a deployment model has been widely assumed to analyze the performance of large-scale sensor networks [4]–[8]. Adopting this model thus allows us to directly compare our results with the existing results. We assume that the target may appear at any location in the deployment region and move freely. Moreover, the target is blind to the network, i.e., the target does not know the sensors’ positions, and hence it cannot choose a moving scheme to reduce the probability of being detected. The sensors synchronously detect the target, and we refer to the target detection in one detection period as the unit detection. The process of detecting a target consists of a series of unit

4

detections. As the sampling interval is much shorter than the detection period, we ignore the target’s movement during the sampling interval. C. Problem Definition In this paper, we study the delay of stochastic intrusion detection in large-scale sensor networks. As the process of detecting a target is inherently stochastic, the detection delay is closely related to two system performance metrics, namely, the false alarm rate (denoted by PF ) and detection probability (denoted by PD ). PF is the probability of making a positive decision when no target is present, and PD is the probability that a present target is correctly detected. In stochastic detection, positive detection decisions may be false alarms caused by the noise in sensor measurements. Note that the false alarm rate does not depend on the property of target as it is the probability of making positive decision when no target is present. Although detection delay can be reduced by setting lower detection thresholds, the fidelity of detection results may be unacceptable because of high false alarm rates. Therefore, studying detection delay alone without the consideration of false alarm is meaningless. We now introduce a concept called α-delay that quantifies the delay of detection under bounded false alarm rate. Definition 1. α-delay is the average number of detection periods before a target is first detected subject to that the false alarm rate of the network is no greater than α, i.e., PF ≤ α, where α ∈ (0, 1). In practice, mission-critical surveillance applications require a low false alarm rate (α < 5%) [12], [21], as false alarms not only reduce the fidelity of detection results but also waste energy in responsive operations such as wakening asleep sensors. The focus of this paper is to study the relationship between the α-delay and network density. Network density directly determines the cost of constructing and deploying a network. Thus, our results will allow the network designer to achieve desirable trade-offs between cost, false alarm rate, and detection delay. Moreover, many sensor networks reduce energy consumption by only activating a subset of nodes while scheduling others to sleep [12]. Our results can be applied to reduce the density of active nodes while achieving the required detection delay. As the detection delay often dominates the communication delay in stochastic intrusion detection, we ignore the communication delay in this paper. For instance, the delay of aggregating the readings of a group of nodes is within 5 milliseconds [2] while the detection period can be several seconds. We address the following problems in this paper: 1) Are the analytical results on detection delay [4]–[9] derived under the classical disc model still applicable under the definition of α-delay? We propose a probabilistic disc model such that the existing results

can be naturally extended to the context of stochastic detection (Section IV). 2) How to quantify the α-delay when sensors can collaborate through data fusion? Answering this question enables us to evaluate the timeliness of a fusion-based network and to deploy or turn on the fewest sensors for achieving a given α-delay (Section V). 3) What is the impact of data fusion on network density when the α-delay is minimized? Many mission-critical real-time applications require detection delay to be as short as possible [12], [21]. We analytically compare the network densities under the disc and fusion models when the α-delay is minimized. The result provides important insights into understanding the limitation of the disc model and the impact of data fusion on the design of real-time WSNs (Section VI). IV. α-D ELAY UNDER P ROBABILISTIC D ISC M ODEL In the classical disc model, each sensor has deterministic sensing capability within its sensing range. If the target is within at least one sensor’s sensing range, the target is regarded to be detected by the network. Such a model is not consistent with the stochastic nature of signal detection. As a result, although a number of studies [4]–[9] have been conducted on intrusion detection based on the disc model, they cannot be readily used to analyze the performance or guide the design of real-world intrusion detection systems. In this section, we extend the classical disc model based on the stochastic detection theory [1] to capture several realistic sensing characteristics and study the α-delay under the extended model. The result lays a foundation for understanding the limitation of disc model on quantifying the delay of intrusion detection. A. Probabilistic Disc Model In the probabilistic disc model, we choose sensing range r such that 1) the probability of detecting any target within r meters from it is no lower than β, and 2) the false alarm rate is no greater than α, where α and β are parameters specified by user. Note that α and β are both within (0, 1). As we ignore the detection probability outside the sensing range of a sensor, the detection capability of sensor under this model is lower than in reality. However, this model preserves the boundary of sensing region defined in the classical disc model. Accordingly, the existing analytical results based on the classical model [4]–[9] can be naturally extended to the context of stochastic detection. In Section IV-B, we will discuss how to extend the coverage probability derived under the classical model [8] to study the α-delay of stochastic intrusion detection. We now discuss how to choose the sensing range r under the probabilistic disc model. The optimal Bayesian detection rule for a single sensor i is to compare its measurement yi against a detection threshold t [1]. If yi exceeds t, sensor

5

i decides H1 ; otherwise, it decides H0 . As both yi |H0 and yi |H1 follow the normal distributions, i.e., yi |H0 = ni ∼ N (µ, σ 2 ) and yi |H1 = si + ni ∼ N (µ + si , σ 2 ), the false alarm rate and detection probability of sensor i are given by   t−µ PF = P(yi ≥ t|H0 ) = Q , (1) σ   t − µ − si , (2) PD = P(yi ≥ t|H1 ) = Q σ where Q(·) is the complementary CDF Rof the standard 2 ∞ normal distribution, formally, Q(x) = √12π x e−t /2 dt. To derive the sensing range, we let PF = α and PD = β. The detection threshold t can then be solved from (1) as t = µ + σQ−1 (α), where Q−1 (·) is the inverse function of Q(·). Moreover, by replacing si = S · w(r) in (2), we have s δ r= − 1. (3) −1 Q (α) − Q−1 (β) For instance, the sensing range r is 3.8 m if α = 0.05, β = 0.95 and δ = 50 (i.e., 17 dB)3 . Moreover, we can see from (3) that r increases with the SNR δ. This conforms to the intuition that a sensor can detect a farther target if the noise level is lower (i.e., a greater δ). As Q−1 (·) is a decreasing function, r will decrease if a lower false alarm rate is required (i.e., a smaller α). B. α-Delay under Probabilistic Disc Model The intrusion detection under the probabilistic disc model works as follows. The network periodically detects the target as described in Section III-C. In each unit detection, if the target is within at least one sensor’s sensing range, the target is detected with a probability no lower than β. We let β be sufficiently close to 1 (e.g., β = 0.99) such that the target is detected almost surely if it is within any one sensor’s sensing range. Such a setting enables the sensors to exhibit similar deterministic property as under the classical disc model. We refer to the circular region with radius of r centered at the target as the target disc. Hence, the target is detected if there is at least one sensor within the target disc. We have the following lemma. Lemma 1. If there is no overlap between any two target discs, the α-delay under the probabilistic disc model is τ = 2 1/(1 − e−ρπr ). Proof: As shown in [8], when the sensors are deployed according to the Poisson process, the probability that there 2 is at least one sensor in a target disc is p = 1 − e−ρπr . Suppose the target is detected in the J th (J ≥ 1) detection period. As there is no overlap between any two target discs, the unit detections are independent from each other. Therefore, J follows the geometric distribution with 3 The SNR is set to be 17 dB according to the measurements in the vehicle detection experiments based on MICA2 [22] and ExScal [20] motes.

a success probability of p in each Bernoulli trial (i.e., each unit detection). Moreover, according to the definition of r in (3), the false alarm rate in each unit detection is no greater than α. According to Definition 1, the α-delay is given by 1 τ = E[J] = 1p = 1−e−ρπr 2 . We can see from Lemma 1 that the α-delay decreases with network density ρ and sensing range r. Note that r is given by (3) under the probabilistic disc model. In this paper, we focus on the case where there is no overlap among target discs. This condition can easily hold in practice. For instance, if the sensing range r is 3.8 m as mentioned in Section IV-A and the target moves at a constant speed of 5 m/s (i.e., 18 km/h) [10], the target disc will not overlap as long as the detection period T is greater than 2 s. If the target discs may overlap, the α-delay is lower bounded by 1 (the proof can be found in Appendix H) and the 1−e−ρπr2 main result of this paper can be easily extended to such a case. V. α-D ELAY UNDER DATA F USION M ODEL Although the probabilistic disc model discussed in Section IV captures the stochastic nature of sensing, it does not exploit the possible collaboration among sensors. In this section, we first propose a data fusion model that enhances detection performance by jointly considering the noisy measurements of multiple sensors. We then derive the α-delay under this model. A. Intrusion Detection under Data Fusion Model Data fusion [1] can improve the performance of detection systems by jointly considering the noisy measurements of multiple sensors. There exist two basic data fusion schemes, namely, decision fusion and value fusion. In decision fusion [18], each sensor makes a local decision based on its measurement and sends its decision to the cluster head, which makes a system decision according to the local decisions. In value fusion [14], each sensor sends its energy measurements to the cluster head, which makes a decision based on the measurements. In this paper, we focus on value fusion and the extension of our results to decision fusion can be found in Appendix G. As proved in Appendix C, the optimal value fusion P si rule is to compare the weighted sum of measurements, i σ ·yi , against a threshold. However, as the measurements contain both noise and signal energy, the weight sσi , i.e., the received SNR of sensor i, is often unknown in practice. A practical solution is to adopt equal constant weights for all sensors’ measurements [14], [18]. Since the measurements from different sensors are treated equally, the sensors far away from the target should be excluded from data fusion as their measurements suffer low received SNRs. Therefore, we adopt a fusion scheme as follows. For any physical point P , the sensors within a distance of R meters from P participate in the data fusion to detect whether a target is present at P . R is referred to as the

6

of the j th unit detection is given by R

Figure 6. Intrusion detection under data fusion model. The void circles represent randomly deployed sensors; the solid circles represent the target in different sampling intervals, and a unit detection is performed in each sampling interval; the dashed discs represent the fusion ranges.

fusion range and F(P ) denotes the set of sensors within the fusion range of P . The number of sensors in F(P ) is represented by N (P ). For conciseness, we use F for F(P ) and N for N (P ) when the point of interest is clear. Due to the Poisson process deployment, for a random point P , N follows the Poisson distribution with mean of ρπR2 , i.e., N ∼ Poi(ρπR2 ). In each detection period, a cluster head is elected to make the detection decision by comparing the sum of measurements reported by member sensors within the fusion range against a detection thresholdPη. Let Y denote the sum of measurements, i.e., Y = i∈F yi . If Y ≥ η, the cluster head decides H1 ; otherwise, it decides H0 . Fig. 6 illustrates the intrusion detection under the data fusion model. We assume that the system can obtain the position of a possible target through a localization service in the network [15], [16]. In Appendix D, our analysis based on a simple localization algorithm shows that the localization error decreases with network density and becomes insignificant when the network density is high enough. Under such an assumption, the localization error can be safely ignored in our analysis that is focused on the detection delay when the network density is high. We also evaluate the impact of localization error through simulations in Section VII. In each detection period, a cluster is formed by the sensors within the fusion range centered at the possible target to make a detection decision. The cluster formation may be initiated by the sensor that has the maximum measurement. Such a scheme can be implemented by several dynamic clustering algorithms [23]. The fusion range R can be used as an input parameter of the clustering algorithm. B. Performance Modeling of Fusion-based Detection In this section, we derive the false alarm rate and detection probability in a unit detection. The results will be used in Section V-C to analyze the α-delay under the fusion model. When no target is present, each sensor measures i.i.d. noise as discussed in Section III-A. Denote Fj as the set of sensors within the fusion range in the j th unit detection. Suppose there are Nj sensors in Fj . The sum of energy measurements follows the normal distribution, i.e., Y |H0 = P 2 i∈Fj ni ∼ N (Nj µ, Nj σ ). Therefore, the false alarm rate

PF j = P(Y ≥ η|H0 ) = Q

η − Nj µ p Nj σ

!

,

where η is the detection threshold. As PD is a nondecreasing function of PF [1], it is maximized when PF is set to be the upper bound α. Such a scheme is referred to as the constant false alarm rate detector [1]. Let PF j = α, thep optimal detection threshold can be derived as η ∗ = Nj µ + Nj σQ−1 (α). When the target is present, the sum of energy P measurements in the j th unit detection is Y |H1 = i∈Fj si + P n . The attenuated signal energies {s |i ∈ Fj } are i i i∈Fj i.i.d. and we denote µs and σs2 as the mean and variance of si , respectively. The proof for the independence of {si |i ∈ Fj } and the derivation of µs and σs2 can be found in Appendix A. Note that both µs and σs2 are determined by the target energy S, the signal decay P function w(d) and fusion range R. If Nj is large enough, i∈Fj si approaches the normal central limit theorem, P distribution according to the 2 s ∼ N (N µ , N σ ). As the sum of two i.e., j s j s i∈Fj i independent Gaussians is also Gaussian, Y |H1 follows the normal distribution, i.e., Y |H1 ∼ N (Nj µs + Nj µ, Nj σs2 + Nj σ 2 ). Hence, the detection probability in the j th unit detection is given by ! η − Nj µs − Nj µ p PDj = P(Y ≥ η|H1 ) ≃ Q p . Nj · σs2 + σ 2 By replacing η with the optimal detection threshold η ∗ , ! p µs σ −1 · Q (α)− p · Nj . (4) PDj ≃ Q p σs2 +σ 2 σs2 +σ 2

C. α-Delay of Fusion-based Detection

As discussed in Section III-C, the process of detecting a target consists of a series of unit detections. Based on the performance modeling of each unit detection in Section V-B, we now derive the α-delay under the data fusion model. We assume that there is no common sensor between any two fusion ranges (as shown in Fig. 6) such that the sensor sets {Fj |j ≥ 1} are independent. If the target moves along a straight line at a constant speed of v, the condition for this case can be derived as vT ≥ 2R. We note that this condition can easily hold in practice. For instance, if the fusion range R is set to be 10 m and the target moves at a constant speed of 5 m/s (i.e., 18 km/h) [10], no two fusion ranges will overlap as long as the detection period T is greater than 4 s. Our results have also been extended to the case where fusion ranges may overlap. The details can be found in Appendix H. From (4), PDj is a function of Nj . When the sensor sets {Fj |j ≥ 1} are independent, {PDj |j ≥ 1} are i.i.d. as the numbers of sensors involved in each unit detection (i.e.,

7 1.0

1.0 δ = 10 δ = 50 δ = 100

0.8

δ = 10 δ = 50 δ = 100

0.8 E[PD ]

E[PD ]

0.6

0.6

0.4

0.4

0.2

0.2 0

0.02 0.04 0.06 0.08 Network density ρ

0.1

Figure 7. Mean detection probability vs. network density (R = 25 m).

0

50 100 150 200 Fusion range R (m)

250

Figure 8. Mean detection probability vs. fusion range (ρ = 0.03).

{Nj |j ≥ 1}) are i.i.d. due to the Poisson process. We denote E[PD ] as the mean of PDj for any j, i.e., E[PD ] = E[PDj ], ∀j. Intuitively, the intrusion detection can be viewed as a series of infinite Bernoulli trials and the success probability of each Bernoulli trial is E[PD ]. Accordingly, the number of unit detections before (and including) the first successful unit detection follows the geometric distribution with a mean of 1/E[PD ]. Hence the α-delay is given by the following theorem (the formal proof can be found in Appendix E). Theorem 1. The α-delay of fusion-based detection is τ = 1/E[PD ], where E[PD ] is the average detection probability in any unit detection. We now discuss how to compute E[PD ] in Theorem 1. As PDj is a function of Nj and Nj follows the Poisson distribution, i.e., Nj ∼ Poi(ρπR2 ), E[PD ] is given by E[PD ] =

∞ X

Nj =0

PDj · fPoi (Nj |ρπR2 ),

(5)

where fPoi (k|λ) is the probability density function (PDF) of the Poisson distribution Poi(λ). Specifically, fPoi (k|λ) = λk e−λ /k!. Note that PDj in (5) is computed using (4). Fig. 7 and Fig. 8 plot E[PD ] versus network density ρ and fusion range R, respectively. From Fig. 7, we can see that E[PD ] increases with ρ. Moreover, for a certain ρ, E[PD ] increases with the SNR. From Fig. 8, we can see that E[PD ] is a concave function of fusion range R and there exists an optimal R that maximizes E[PD ]. Intuitively, as the fusion range initially increases, more sensors contribute to the data fusion resulting in better sensing quality. However, as the fusion range becomes very large, the aggregate noise starts to cancel out the benefit because the target signal decreases rapidly with the distance from the target. In other words, the measurements of sensors far away from the target contain low-quality information and hence fusing them lowers detection performance. In practice, we can choose the optimal fusion range according to numerical results. VI. I MPACT

OF

DATA F USION D ETECTION

ON

R EAL -T IME

Many mission-critical real-time applications require detection delay to be as small as possible [12], [21]. As

an asymptotic case, the α-delay approaches one, i.e., any intruder can be detected almost surely in the first detection period after its appearance, which is referred to as the instant detection. As a smaller detection delay always requires more sensors, the network density for achieving instant detection is an important cost metric for mission-critical real-time sensor networks. In this section, we investigate the required network density for achieving instant detection under both the disc and fusion models. According to Lemma 1 and Theorem 1, the network density under both models approaches infinity4 when the αdelay reduces to one. However, the speed that the network density increases is different. In this section, we study the ratio of network densities for instant detection under the two models, which characterize the relative cost of the two models when detection delay is minimized. The result provides important insights into understanding the limitation of the disc model and the impact of data fusion on the performance of real-time WSNs for intrusion detection. A. Network Density for Achieving Instant Detection We abuse the symbols a bit to use N instead of Nj and PD instead of PDj as we are not interested in the index of unit detection. As ρ → ∞, N √ → ∞ almost surely. In (4), the second item − √ µ2s 2 · N dominates when ρ → ∞, σs +σ σ ·Q−1 (α) σs2 +σ2

since the first item √

is a constant. Therefore, √ it’s safe to use PD = Q(k N ) to approximate (4), where k = − √ µ2s 2 . We have the following lemma. σs +σ

Lemma 2. Let ρf and ρd denote the network densities for achieving α-delay of τ under the fusion and disc models, respectively. There exists ξ ∈ (0, 1) such that ρf 2 2 · r2 ≤ lim+ ≤ 2 2 · r2 . (6) 2 2 k R ξk R τ →1 ρd The proof can be found in Appendix B. Note that ξ is a function of k (given by (10)). According to Lemma 2, limτ →1+ ρf /ρd is largely affected by the sensing range of a single sensor. According to (3), the sensing range r is determined by the requirements on false alarm rate and detection probability (i.e., α and β), as well as the SNR δ. As discussed in Section IV-B, β is a constant close to one. Accordingly, we only analyze the impacts of α and δ on the network density for achieving instant detection. We have the following theorem. Theorem 2. The ratio of network densities for instant detection under the fusion and disc models has a tight bound of   ρf δ lim . (7) =Θ Q−1 (α) τ →1+ ρd 4 Numerically, the network density ρ will not be very large when the α-delay approaches one. For instance, according to Lemma 1, suppose the sensing range r is 5 m, the α-delay under the disc model is 1 + 10−5 when ρ = 0.15.

8

0

1 δ2

,

σ02

where µ0 and (both defined in Appendix A) are constants for a given R. Moreover, ξ is a function of k (given by (10)). Accordingly, k and ξ are both constants when δ is fixed or approaches infinity. Hence, according to Lemma 2, the tight bound of the density ratio is limτ →1+ ρf /ρd = Θ(r2 ). From (3), for fixed β, r2 = Θ(δ/Q−1 (α)). Therefore, we have (7). Theorem 2 suggests that the relative cost for instant detection between the fusion and disc models depends on the required false alarm rate α and SNR δ. Specifically, for a fixed SNR, when α → 0, Q−1 (α) → ∞ and hence limτ →1+ ρf /ρd → 0. This suggests that the data fusion model can significantly reduce the network density when a small false alarm rate is required. Moreover, for a fixed false alarm rate, limτ →1+ ρf /ρd increases with δ. That is, the advantage of data fusion diminishes as the SNR increases. B. Application of Results In this section, we use two realistic examples to illustrate the implications of Theorem 2. They also provide several important insights into understanding the applicability of the disc model and the data fusion model in various application scenarios. 1) Data fusion reduces network density: As discussed in Section VI-A, limτ →1+ ρf /ρd decreases to zero when α → 0. If a small α is required, ρf < ρd for instant detection, i.e., the fusion model requires lower network density than the disc model. In other words, data fusion is effective in reducing detection delay and false alarms. Fig. 9 plots the lower and upper bounds of the density ratio given by Lemma 2. We set the SNR δ to be 50 (i.e., 17 dB) according to the measurements in the vehicle detection experiments based on MICA2 [22] and ExScal [20] motes. The fusion range R is optimized to be 37 m. From the figure, we can see that if α < 0.2, the fusion model will outperform the disc model. In practice, most missioncritical surveillance systems require a small α. For example, in the vehicle detection system [12] and the acoustic shooter localization system [21], the false alarm rates are tuned to be near zero. 2) Disc model suffices for high-SNR detection: As discussed in Section VI-A, for a fixed α, limτ →1+ ρf /ρd increases with δ. If the SNR is high enough so that limτ →1+ ρf /ρd > 1, the disc model is superior to the fusion model in achieving instant detection. This implies that the disc model suffices when the SNR is high. Fig. 10 plots the bounds of density ratio given by Lemma 2. We set α to be 0.01. The fusion range R is optimized for each δ. From the figure, we can see that if the SNR is higher than 21 dB,

limτ →1+ ρf /ρd

µs Sµ0 µ0 k = −p = −p = −q 2 2 2 2 σs2 + σ 2 S σ0 + σ σ +

1.2 1 0.8 0.6 0.4 0.2 0

upper bound lower bound 0 0.1 0.2 0.3 0.4 0.5 Required false alarm rate α

limτ →1+ ρf /ρd

1.4

Proof: In Lemma 2, k depends on the SNR δ, i.e.,

1.6 1.4 1.2 1 0.8 0.6 0.4 0.2 0

upper bound lower bound 19 20 21 22 23 10 log10 δ (dB)

24

Figure 9. Density ratio vs. required Figure 10. Density ratio vs. SNR false alarm rate (δ = 50, R = 37 m). (α = 0.01).

the disc model outperforms the fusion model. Intuitively, by taking advantage of collaborative sensing, the fusion model is effective when the SNR is low to moderate. However, when the SNR is high, the detection performance of a single sensor is satisfactory and the collaboration among multiple sensors may be unnecessary. In real systems, the noise experienced by a sensor has various sources, e.g., the random disturbances in the environment and the electronic noise in the sensor’s circuit. Thus the SNR depends on the characteristics of targets, the environment, and the sensor device. In the vehicle detection experiments based on low-power motes, e.g., MICA2 [22] and ExScal [20], the SNRs are usually low to moderate (≤ 17 dB). In such a case, data fusion can effectively reduce the network density required to achieve short detection delay and low false alarm rate. VII. P ERFORMANCE E VALUATION In this section, we conduct simulations to evaluate the theoretical results in previous sections. We first describe the simulation settings and methodology in Section VII-A, then present the simulation results in Section VII-B. A. Simulation Settings and Methodology Both the mean and variance of the noise (i.e., µ and σ 2 ) are set to be 1. The SNR δ is set to be 50 (i.e., 17 dB) according to the measurements in the vehicle detection experiments based on motes [20], [22]. The fusion range R is set to be 25 m. The sensors are deployed uniformly into a large field and periodically detect the target. The target initially appears at the origin, and moves along the X-axis at a speed of 2R per detection period. In the simulations, we consider the target localization error as follows. Suppose the real target position is at P (x, y) when sensors take measurements, while the target position localized by the network is at P ′ (x+ǫ cos θ, y+ǫ sin θ), where ǫ is a specified constant and θ is picked uniformly from [0, 2π). Sensors within the fusion range centered at P ′ fuse their measurements and make the detection decision. We conduct 500 runs with different random sensor deployments. The α-delay is computed as the average number of detection periods before the target is first detected in each run.

9 8

0.42

4 3

0.4 0.38

2 1 0

ρf /ρd

5

ρf /ρd

6 α-delay

0.44

analytical SIM(ǫ = 0) SIM(ǫ = 20 m) SIM(ǫ = 25 m)

7

α = 0.05 α = 0.01 α = 0.002

0.36 0

0.01

0.02 0.03 Network density ρ

0.04

Figure 11. α-delay vs. network density under data fusion model.

0.05

1

1.005

1.01

1.015 1.02 α-delay

1.025

Figure 12. Density ratio vs. α-delay given different required false alarm rate.

For the disc model, the sensing range r is computed according to (3). Once the target enters the sensing range of a sensor, the sensor makes a detection decision by comparing its measurement against the detection threshold t derived in Section IV-A. B. Simulation Results We first evaluate the analytical result on the α-delay of fusion-based detection. Fig. 11 plots the α-delay versus the network density. The curve labeled with “analytical” plots the α-delay computed according to Theorem 1 and Eq. (5). The data points labeled with “SIM(ǫ)” represent the simulation results with a constant localization error ǫ. From the figure, we can see that the α-delay decreases with the network density. The simulation result without localization error (i.e., ǫ = 0) confirms the analytical result when the network density is greater than 0.01. When ρ is smaller than 0.01, the simulation result starts to deviate from the analytical result. This is due to the approximation made in the derivation of PD in Section V-B. However, we can see that the maximum error between the analytical and simulation results falls within one detection period. Fig. 11 also shows that the impact of localization error is small. The simulation result has a considerable deviation from the analytical result only when the localization error is equal to the fusion range (25 m). In such a case, the target falls completely outside of the fusion range. Moreover, the impact of localization error diminishes as the network density increases. This result demonstrates the robustness of our analysis with respect to localization error, especially in achieving instant detection. Fig. 12 plots the ratio of network densities required by the fusion and disc models (i.e., ρf and ρd ) to achieve the same α-delay, given different required false alarm rates. For instance, if the required false alarm rate is 0.05, the density ratio ρf /ρd is about 0.42 when the α-delay approaches one. This means that the disc model requires more than twice sensors for instant detection, compared with the fusion model. We can also see that limτ →1+ ρf /ρd decreases if a lower false alarm rate is required. This is consistent with our analysis in Section VI-A. Fig. 13 plots the density ratio versus α-delay given

1.03

1.4 1.3 1.2 1.1 1 0.9 0.8 0.7 0.6 0.5 0.4

δ = 20 (13 dB) δ = 60 (17.8 dB) δ = 100 (20 dB)

1

1.05

1.1

1.15 α-delay

1.2

1.25

1.3

Figure 13. Density ratio vs. α-delay given different SNRs (α = 0.05).

different SNRs. We can see from the figure that the density ratio increases with the SNR. For instance, if the SNR δ is 20, the density ratio ρf /ρd is about 0.5 when the α-delay reduces to one. However, if δ increases to 100, ρf /ρd is about 1.4, which means that the disc model requires less sensors than the fusion model. This is consistent with our analysis in Section VI-A. VIII. C ONCLUSION In this paper, we study the impact of data fusion on real-time detection in WSNs through the performance comparison between the disc model and data fusion model. Our results show that data fusion is effective in achieving stringent performance requirements such as short detection delay and low false alarm rate, especially in the severe scenarios with low SNRs. However, the disc model may suffice when the SNR is sufficiently high. Our results help understand the applicability of the disc and data fusion models, and hence provide important guidelines for the design of real-time WSNs for intrusion detection. R EFERENCES [1] P. Varshney, Distributed Detection and Data Fusion. Spinger, 1996. [2] T. He, P. A. Vicaire, T. Yan, L. Luo, L. Gu, G. Zhou, R. Stoleru, Q. Cao, J. A. Stankovic, and T. Abdelzaher, “Achieving real-time target tracking using wireless sensor networks,” in RTAS, 2006. [3] S. Bapat, V. Kulathumani, and A. Arora, “Analyzing the yield of ExScal, a large-scale wireless sensor network experiment,” in ICNP, 2005. [4] Q. Cao, T. Yan, J. Stankovic, and T. Abdelzaher, “Analysis of target detection performance for wireless sensor networks,” in DCOSS, 2005. [5] O. Dousse, C. Tavoularis, and P. Thiran, “Delay of intrusion detection in wireless sensor networks,” in MobiHoc, 2006. [6] L. Lazos, R. Poovendran, and J. A. Ritcey, “Probabilistic detection of mobile targets in heterogeneous sensor networks,” in IPSN, 2007. [7] N. Bisnik, A. Abouzeid, and V. Isler, “Stochastic event capture using mobile sensors subject to a quality metric,” in MobiCom, 2006. [8] B. Liu and D. Towsley, “A study of the coverage of largescale sensor networks,” in MASS, 2004. [9] P. Brass, “Bounds on coverage and target detection capabilities for models of networks of mobile sensors,” ACM Trans. Sen. Netw., vol. 3(2), 2007.

10

[10] M. F. Duarte and Y.-H. Hu, “Vehicle classification in distributed sensor networks,” J. Parallel and Distributed Computing, vol. 64(7), 2004. [11] D. Li, K. Wong, Y.-H. Hu, and A. Sayeed, “Detection, classification and tracking of targets in distributed sensor networks,” IEEE Signal Process. Mag., vol. 19(2), 2002. [12] T. He, S. Krishnamurthy, J. A. Stankovic, T. Abdelzaher, L. Luo, R. Stoleru, T. Yan, L. Gu, J. Hui, and B. Krogh, “Energy-efficient surveillance system using wireless sensor networks,” in MobiSys, 2004. [13] M. Duarte and Y.-H. Hu, “Distance based decision fusion in a distributed wireless sensor network,” in IPSN, 2003. [14] T. Clouqueur, K. K. Saluja, and P. Ramanathan, “Fault tolerance in collaborative sensor networks for target detection,” IEEE Trans. Comput., vol. 53(3), 2004. [15] X. Sheng and Y.-H. Hu, “Maximum likelihood multiplesource localization using acoustic energy measurements with wireless sensor networks,” IEEE Trans. Signal Process., vol. 53(1), 2005. [16] D. Li and Y.-H. Hu, “Energy based collaborative source localization using acoustic micro-sensor array,” EUROSIP J. Applied Signal Processing, no. 4, 2003. [17] J. Kotecha, V. Ramachandran, and A. Sayeed, “Distributed Multitarget Classification in Wireless Sensor Networks,” IEEE J-SAC on Self-Organizing Distributed Collaborative Sensor Networks, vol. 23(4), 2005. [18] R. Niu and P. K. Varshney, “Distributed detection and fusion in a large wireless sensor network of random size,” EURASIP J. Wireless Communication and Networking, vol. 4, 2005. [19] M. Hata, “Empirical formula for propagation loss in land mobile radio services,” IEEE Trans. Veh. Technol., vol. 29, 1980. [20] L. Gu, D. Jia, P. Vicaire, T. Yan, L. Luo, A. Tirumala, Q. Cao, T. He, J. Stankovic, T. Abdelzaher, and H. Bruce, “Lightweight detection and classification for wireless sensor networks in realistic environments,” in SenSys, 2005. [21] P. Volgyesi, G. Balogh, A. Nadas, C. Nash, and A. Ledeczi, “Shooter Localization and Weapon Classification with Soldier-Wearable Networked Sensors,” in MobiSys, 2007. [22] B. P. Flanagan and K. W. Parker, “Robust distributed detection using low power acoustic sensors,” The MITRE Corporation, Tech. Rep., 2005. [23] W.-P. Chen, J. C. Hou, and L. Sha, “Dynamic clustering for acoustic target tracking in wireless sensor networks,” IEEE Trans. Mobile Comput., vol. 3(3), 2004.

D ERIVING

THE

A PPENDIX A. M EAN A ND VARIANCE

OF si

We first prove that {si |i ∈ Fj } are i.i.d. for any target position P . As sensors are deployed uniformly and independently, {di |i ∈ Fj } are i.i.d. for any P , where di is the distance between sensor i and point P . Therefore, {si |i ∈ Fj } are i.i.d. for any P , as si is a function of di , i.e., si = S · w(di ).

We then derive the mean and variance of si , i.e., µs and σs2 . Let (xp , yp ) and (xi , yi ) denote the coordinates of point P and sensor 1 i, respectively. The posterior PDF of (xi , yi ) is f (xi , yi ) = πR 2 2 2 2 where (xi − xp ) + (yi − yp ) ≤ R . Hence, the posterior CDF R 2π Rd 1 d2 i of di is given by F (di ) = 0 dθ 0 i πR 2 · xdx = R2 , where

di ∈ [0, R]. Therefore, Z Z R 2S R w(di )di ddi , µs = Sw(di )dF (di ) = 2 R 0 0 Z R Z 2S 2 R 2 σs2 = S 2 w2 (di )dF (di ) − µ2s = 2 w (di )di ddi − µ2s . R 0 0 RR RR By letting µ0 = R22 0 w(di )di ddi and σ02 = R22 0 w2 (di )di ddi− µ20 , we have µs = Sµ0 and σs2 = S 2 σ02 .

A PPENDIX B. P ROOF OF L EMMA 2 Proof: From Lemma 1 and Theorem 1, if the same α-delay of τ is achieved under the two models, we have 2

E[PD ] = 1 − e−ρd πr .

(8)

We first √ prove the lower bound in (6). It is easy to verify that PD = Q(k N ) is a concave function. According p p to Jensen’s inequality, we have E[PD ] ≤ Q(k E[N ]) = Q(k ρf πR2 ). From p 2 d πr = E[P ] ≤ Q(k ρf πR2 ). Accordingly, (8), we have 1−e−ρ√ D √ 1 ρd ≤ − πr2 ln Φ(k πR · ρf ), where Φ(x) = 1 − Q(x). Hence, the density ratio satisfies lim

τ →1+

ρf ρf 2 √ ≥ −πr 2 · lim = 2 2 · r2 . √ ρf →∞ ln Φ(k πR · ρd k R ρf ) x√ x→∞ ln Φ(ϑ x)

In the above derivation, we use the equality lim − ϑ22 ,

=

which can be verified via L’Hˆopital’s Rule (the proof can be found in Appendix F). We now prove the upper bound in (6). As PD > 0, according to Markov’s inequality, for any given number c, we have E[PD ] ≥ c · P(PD ≥ c).

(9)

We define ξ and c as follows: √ p k2 + 2 − k4 + 4k2 ξ= , c = Q(k ξρf πR2 ). (10) 2 It’s easy to verify that ξ ∈ (0, 1). Therefore, ” “ √ p P(PD ≥ c) = P Q(k N ) ≥ Q(k ξρf πR2 ) = P(N ≥ ξρf πR2 ).

As N ∼ Poi(ρf πR2 ) and the Poisson distribution approaches the normal distribution N (ρf πR2 , ρf πR2 ) when ρf → ∞, we have ! ” “ p ξρf πR2 − ρf πR2 p P(PD ≥ c) = Q = Q (ξ − 1) ρf πR2 . 2 ρf πR

By replacing c and P(PD ≥ c) in (9), we have ” “ ” “ p p E[PD ] ≥ Q k ξρf πR2 · Q (ξ − 1) ρf πR2 . √ It is easy to verify that k ξ = ξ − 1. Thus the√above inequality √ 2 reduces to E[PD ] ≥ Q (h ρf ), where h = k ξπR. From (8), √ −ρd πr 2 we have 1 − e = E[PD ] ≥ Q2 (h ρf ). Accordingly, ρd ≥ √ √ 1 − πr2 · (ln(1 + Q(h ρf )) + ln Φ(h ρf )). Hence, we have ρf ρf lim ≤ −πr 2 lim √ √ ρf →∞ ln(1 + Q(h ρf )) + ln Φ(h ρf ) τ →1+ ρd 2 ρf = 2 2 · r2 . (11) = −πr 2 lim √ ρf →∞ ln Φ(h ρf ) ξk R √ √ Note that h = k ξπR < 0 and ln(1 + Q(h ρf )) = ln 2 when ρf → ∞. We also use the aforementioned equality x√ lim ln Φ(ϑ = − ϑ22 to derive (11). x) x→∞

11

¯ is given by of X

A PPENDIX C. O PTIMAL DATA F USION RULE

# " n 1X ¯ Xi E[X] = E n i=1

Suppose there are N sensors taking part in the data fusion. The optimal decision rule that minimizes the average cost (i.e., Bayesian decision) is given by the likelihood ratio test:

=

p(y1 , . . . , yN |H1 ) H1 P0 (C10 − C00 ) ≷ . p(y1 , . . . , yN |H0 ) H0 P1 (C01 − C11 )

=

where P0 = P(H0 ), P1 = P(H1 ), and Cij is the cost that we decide Hi when the ground truth is Hj . The left-hand side is the likelihood ratio and the right-hand side is the optimal Bayes threshold. As the sensors’ measurements are independent Gaussians assumed in Section III-A, we have N Y

PN p(yi |H1 ) p(y1 , . . . , yN |H1 ) = = e i=1 p(y1 , . . . , yN |H0 ) p(yi |H0 ) i=1

2si yi −2µsi −s2 i σ2

.

n 1X E[Xi ] n i=1

n 1X E[X0 + di · cos θi ] n i=1

= X0 + = X0 +

Similarly, we have

Therefore, fusion statistics for Bayesian decision is PN si the optimal si i=1 σ · yi where σ is the received SNR of sensor i.

A PPENDIX D. A SYMPTOTIC L OCALIZATION P ERFORMANCE In this section, we propose a simple target localization approach and evaluate its performance. In particular, we find that the localization error becomes insignificant when the number of the sensors taking part in the localization is large enough.

=

A. Target Localization

n X ¯ = 1 Xi , X n i=1

n 1X Y¯ = Yi n i=1

B. Localization Error We now analyze the localization error of such a approach. Suppose the distance between sensor i and target is di , and the angle of di with respect to X-axis is θi . Due to the Poisson process, θi follows the uniform distribution, i.e., θi ∼ U(0, 2π). The mean

(12)

¯ = X0 E[X]

(13)

E[Y¯ ] = Y0

(14)

Eq.(13) and (14) show that the approach outputs unbiased estimate of the target position. Hence, the localization error can be charac¯ is given terized by the variance of the estimate. The variance of X by " # n X 1 ¯ = Var Var[X] Xi n i=1 # " n 1X di · cos θi = Var X0 + n " n i=1 # X 1 di · cos θi = 2 · Var n i=1

= Each sensor first decides whether it should take part in the localization by comparing its reading with a threshold ζ. Note that ζ is different from the detection threshold η in Section V-A. If its reading exceeds ζ, it decides to take part in the localization; otherwise, it remains silent. Suppose the target appears at point P (X0 , Y0 ), and there are n sensors take part in the localization. The coordinates of sensor i taking part in the localization are (Xi , Yi ). The target is localized at the centroid of these n sensors ¯ Y¯ ), where which is denoted by P ′ (X,

n 1X E[di ] · E[cos θi ] n i=1

Note that (12) because di and θi are independent. As R 2π follows 1 cos θi dθi = 0, we have E[cos θi ] = 0 2π

Accordingly, the likelihood ratio test becomes N N H1 X si σ P0 (C10 − C00 ) 1 X 2µsi + s2i · yi ≷ + ln . σ σ 2 P1 (C01 − C11 ) H0 2 i=1 i=1

n 1X E[di · cos θi ] n i=1

=

n 1 X · Var[di · cos θi ] 2 n i=1

(15)

n ´ 1 X` 2 · E[di · cos2 θi ] − E2 [di · cos θi ] n2 i=1 n 1 X E[d2i ] · E[cos2 θi ] · n2 i=1

where E[cos2 θi ] =

Z

2π 0

(16)

1 1 cos2 θi dθi = 2π 2

Note that (15) holds as sensors are mutually independent. In the S presence of target, the measurement of sensor i, yi = 1+d 2 + ni , i and yi ≥ ζ. Accordingly, » – » – S S E[d2i ] = E −1 ≤E −1 (17) yi − ni ζ − ni According to (16) and (17), we have – » n X 1 S ¯ ≤ 1 · − 1 · E Var[X] n2 i=1 ζ − ni 2 i h S −1 E ζ−n i = 2n

12

Define constant c = E

h

S ζ−ni

i − 1 , we have

¯ ≤ Var[X]

the target motion model. Accordingly, the α-delay of fusion-based detection, τ , is given by

c 2n

(18)

According to Chebyshev’s inequality, for any constant ǫ, ¯ − X0 | ≥ ǫ) ≤ P(|X

¯ Var[X] c ≤ 2 2 ǫ 2ǫ n

(19)

Hence, we have ¯ − X0 | ≥ ǫ) = 0 lim P(|X

n→∞

τ = E[E[J]] where E[E[J]] is the average value of E[J] taken over all possible targets. As stated in Section V-C, if fusion ranges do not overlap such that the detection probabilities in each unit detection (i.e., PDk , ∀k) are i.i.d., we have # " j ∞ Y X (1 − PDk ) E τ = E[E[J]] = 1 + j=1

This limit means that when the number of sensors taking part in the localization is large enough, the localization error becomes insignificant. Furthermore, we can calculate the average localization ¯ − X0 |. According to (19), error. Define localization error ǫX = |X we have  p c ; 1, if ǫ ≤ 2n P(ǫX ≥ ǫ) ≤ c , otherwise. 2 2ǫ n

=1+ =1+

j=1

We can see that E[ǫX ] → 0 when n → ∞. Note that the above derivations also hold for Y -coordinate.

A PPENDIX E. T HE P ROOF OF T HEOREM 1 Proof: Denote Aj as the event that the target is not detected in the j th unit detection. Thus, the probability of Aj is P(Aj ) = 1 − PDj . Suppose the target is detected in the J th unit detection5 . The mean of J is give by ! j−1 ∞ \ \ X ¯ ¯ Ak Aj (20) j·P E[J] = 1 · P(A1 ) + = 1 − P(A1 ) + =1+

=1+

∞ X

j=2

j \

P

j·

Ak

!

P

\

k=1

Ak

!

−P

j \

k=1

lim

x→∞

z2 x √ = lim z→∞ ln Φ(ϑz) ln Φ(ϑ x) 2z = lim 1 z→∞ φ(ϑz)ϑ Φ(ϑz)

Ak

(21)

k=1

j ∞ Y X

P(Ak )

(22)

(1 − PDk )

(23)

j ∞ Y X

j=1 k=1

T T ¯ Note that the j−1 Aj in (20) represents the event that the k=1 Ak target is not detected from the first to the (j − 1)th unit detection but detected in the j th unit detection. As the measurements in different sampling intervals are mutually independent, Aj : j ≥ 1 are mutually independent. Hence, Eq. (22) follows. For a random target, PDk in (23) is a RV. Hence, E[J] is a RV which depends on 5 The intrusion detection is a series of infinite Bernoulli trials, but J does not follow the Geometric distribution because the success probability of each Bernoulli trial (i.e., PDj ) is a random variable (RV) rather than a constant.

L EMMA 2

(*)

Φ(ϑz)z 2 lim ϑ z→∞ φ(ϑz) 2 φ(ϑz)ϑz + Φ(ϑz) = lim (*) ϑ z→∞ −ϑ2 zφ(ϑz) „ « Φ(ϑz) 2 = − 3 ϑ + lim z→∞ zφ(ϑz) ϑ „ « φ(ϑz)ϑ 2 = − 3 ϑ + lim (*) z→∞ φ(ϑz) − ϑ2 z 2 φ(ϑz) ϑ „ « 2 ϑ = − 3 ϑ + lim z→∞ 1 − ϑ2 z 2 ϑ 2 =− 2 ϑ

!!

j=1

OF

=

j=1 k=1

=1+

(1 − E[PD ])j

Let φ(x) and Φ(x) represent the PDF and CDF of the standard 2 normal distribution, formally, φ(x) = √12π e−x /2 , and Φ(x) = Rx ′ ′ φ(t)dt. Note that Φ (x) = φ(x) and φ (x) = −xφ(x). −∞ The limits used in Lemma 2 is derived as

k=1

j−1

E[1 − PDk ]

A PPENDIX F. T HE L IMITS U SED IN THE P ROOFS

2n

∞ X

j=1 k=1 ∞ X

1 = E[PD ]

Accordingly, the average localization error satisfies r Z ∞ Z √c 2n 2c c dǫ = dǫ + √ E[ǫX ] ≤ 2n c 2ǫ n 0

j=2

k=1

j ∞ Y X

where x = z 2 and the steps marked by (*) follow from the L’Hˆopital’s Rule6 . Note that ϑ < 0, limz→∞ Φ(ϑz)z = 0, and limz→∞ zφ(ϑz) = 0.

A PPENDIX G. E XTENSION : I NTRUSION D ETECTION UNDER D ECISION F USION M ODEL In this section, we first describe a decision fusion model and derive its detection performance. We then discuss how to extend our results to the decision fusion model. 6 L’Hˆ opital’s

f ′ (x) f (x) = lim g′ (x) if lim f (x) g(x) ′ f (x) lim g′ (x) has a finite value.

Rule says that lim

lim g(x) are both 0 or ±∞ and

and

13

A. Decision Fusion Model We adopt a decision fusion model as follows. Member sensor i in the detection cluster makes a local detection decision Ii by comparing its measurement yi against a local detection threshold λ. We assume all sensors use the same local detection threshold λ. If yi ≥ λ, sensor i decides 1 (i.e., Ii = 1); otherwise, it decides 0 (i.e., Ii = 0). Let Λ denote theP number of sensors which report positive local decisions, i.e., Λ = N i=1 Ii . The cluster head makes the system decision by the majority rule. Specifically, if Λ ≥ N/2, the cluster head decides 1; otherwise, it decides 0. More generally, we consider a extended majority rule, i.e., given a real number θ ∈ (0, 1), if Λ ≥ θN , the cluster head decides 1; otherwise, it decides 0. Under such a decision fusion model, the local false alarm rate i (denoted by PFi ) and local detection probability (denoted by PD ) at sensor i are given by PFi = P(yi ≥ λ|H0 ),

i PD = P(yi ≥ λ|H1 )

The system false alarm rate and system detection probability are given by PF = P(Λ ≥ θN |H0 ),

In the presence of target, the local decision of sensor i, Ii |H1 , i as the probability of follows a Bernoulli distribution with PD i success, where PD is given by « „ ∗ λ − µ − si i (27) PD =Q σ As I1 , . . . , INj |H1 are mutually independent, the mean and variance of Λ|H1 are given by E[Λ|H1 ] =

i=1

Var[Λ|H1 ] =

B. Performance Modeling of Decision Fusion In the absence of target, the measurement of sensor i within the fusion range follows a normal distribution, i.e., yi |H0 = ni ∼ N (µ, σ 2 ). Thus PFi is given by « „ λ−µ (24) PFi = P(yi ≥ λ|H0 ) = Q σ Note that all sensors have same local false alarm rate and denote PFi = α0 . In the j th detection period, the number of positive local decisions, Λ|H0 , follows a Binomial distribution, formally, Λ|H0 ∼ Bin(Nj , α0 ). Therefore, the system false alarm rate in the j th detection period can be calculated by ! Nj X Nj Nj −Λ αΛ PF j = 0 (1 − α0 ) Λ Λ=⌈θNj ⌉

According to de Moivre-Laplace Theorem, the Binomial distribution Bin(Nj , α0 ) is approximately a normal distribution with mean of Nj α0 and variance of Nj α0 − Nj α20 if Nj is large enough. Therefore, PF j can be approximated by ! ! p θNj − Nj α0 θ − α0 PF j ≃ Q p Nj · p =Q Nj α0 − Nj α20 α0 − α20

λ = µ + σQ

(α0 )

Nj X

i PD

i=1

Var[Ii |H1 ] =

Nj X i=1

i PD −

Nj X

i 2 (PD )

i=1

i However, I1 , . . . , INj |H1 are not identically distributed, as PD depends on the distance between the sensor and the target. The following lemma proves the condition for Lyapunov’s central limit theorem (CLT).

Proof: As Ii is a Bernoulli random variable, we denote qi as its probability of success, i.e., P(Ii = 1) = qi and P(Ii = 0) = 1−qi . Furthermore, we denote µi , σi2 and ri3 as the mean, the variance, and the third central moment of Ii , respectively. The Lyapunov condition is formally stated as follows: for any i, ri3 is finite and the following limitation holds ´1 `Pn 3 3 i=1 ri (28) lim ´1 = 0 n→∞ `Pn 2 2 i=1 σi

As Ii is a Bernoulli random variable with qi as its probability of success, its mean and variance are µi = qi and σi2 = qi (1 − qi ), respectively. The third central moment of Ii is ri3 = E[|Ii − µi |3 ] = (1 − qi )3 qi + qi3 (1 − qi ). Obviously, for any i, ri3 is finite. Furthermore, as 0 ≤ qi ≤ 1, ri3 ≥ 0. Accordingly, `Pn ´1 3 3 i=1 ri (29) ´1 ≥ 0 `Pn 2 2 σ i=1 i

Moreover,

n X

ri3 =

i=1

(26)

Note that λ∗ depends on the number of sensors involved in the decision fusion (i.e., Nj ). After each dynamical clustering, the cluster head broadcasts Nj .

n X i=1

=

n X i=1

(25)

where a = (Q−1 (α))2 /Nj . There are always two distinct roots of Eq. (25). Note that the valid range of α0 is (0, 1). To simplify i our discussion, we choose the greater one because PD is a nondecreasing function of PFi . If the greater root of Eq. (25) is invalid, we choose the smaller one. According to (24), the optimal local detection threshold is −1

Nj X i=1

Let PF j = α and then we have the following equation,

∗

E[Ii |H1 ] =

Lemma 3. Let {Ii : i = 1, . . . , n} be a sequence of mutually independent Bernoulli random variables, the Lyapunov condition holds for this sequence.

PD = P(Λ ≥ θN |H1 )

(1 + a)α20 − (2θ + a)α0 + θ2 = 0

Nj X

≤

n X i=1

(1 − qi )3 qi + qi3 (1 − qi ) (qi − qi2 ) − 2 (qi − qi2 ) =

n X i=1

n X

qi2 (qi − 1)2

σi2

i=1

Therefore, `Pn

i=1

ri3

i=1

σi

lim n→∞ `Pn

´1

3

`Pn

i=1

σi2

i=1

σi

lim `P ´ 1 ≤ n→∞ n 2 2

´1

3

´1 = 0 2

(30)

2

According to (29) and (30), (28) holds. Hence, Lyapunov condition is satisfied. According to Lemma 3 and Lyapunov’s CLT, the distribution of Λ|H1 approaches a normal distribution when Nj is large enough.

14

Therefore, the system detection probability in the j th unit detection can be calculated by 0

PDj ≃ Q @ q

PNj

i i=1 PD

E

1

θNj − A PNj i PNj i 2 P − (P ) i=1 D i=1 D

(31)

i As discussed in Section V-B, si for all i are i.i.d., hence PD for all i are i.i.d. according to (27). According to the CLT, both PNj i PNj i 2 We i=1 PD and i=1 (PD ) follow the normal distributions. PNj i approximate them using their means respectively, i.e., i=1 PD ≃ PNj i i 2 i 2 Nj E[PD ] and i=1 (PD ) ≃ Nj E[(PD ) ]. In Appendix A, we have obtained the CDF of di , i.e., F (di ). By replacing si = S · i i 2 w(di ) in (27), E[PD ] and E[(PD ) ] are given by

Z

R

„

∗

Q

0

PDj ≃ Q

!

n Y

i=1

2

≤ E4 2

= E4

≤ ···

#

2

xi ≤ E 4 n−2 Y i=1

n−2 Y i=1

1

n−1 Y i=1

xi

n−1 n 3 ! n−1 n

5

1

n · E [xn n]

n−2 n−1 n

n · n−1 3 n−1 · ! n−1 n−2 5 xi

»

n · n−1 n−1 1

E xn−1

–

1 · n−1 n−1 n

n−2 n 3 ! n−2 n 1 n 1 5 n · E [x ] n · E [xn xi n−1 ] n 1

1

(32)

1

n n n n n · E[x ] n · · · · · E[x ] n = (E[x ] n ) ≤ E[xn = E[xn ] 1] 2 n

Proof: According to (4) and (32), both under the value fusion and decision models, PDj s are identically distributed as Nj are identically distributed due to the Poisson process. By applying Lemma 4, we have # " j ∞ Y X (1 − PDk ) E τ = E[E[J]] = 1 + j=1

≤1+

C. α-Delay under Decision Fusion Model From (32), PDj depends on Nj . Therefore, the analysis in Section V-C and Theorem 1 also hold for the decision fusion model. i We note that in (32), θ − E[PD ] < 0, otherwise PDj would be always lower than 0.5. Accordingly, Eq. (32) has an identical form as the value√ fusion in the asymptotic case of p instant detection, i.e., i i i 2 ])/ E[PD ] − E[(PD ) ] PD = Q(k N ) where k = (θ − E[PD for decision fusion. Therefore, both Lemma 2 and Theorem 2 holds for the decision fusion model. This shows that the impact of value fusion and decision fusion on intrusion detection are similar.

"

j=1

=E 1+ =E

»

k=1

∞ X

E[(1 − PD )j ]

∞ X j=1

1 PD

(1 − PD )

j

#

–

where PD can be any one of PDj . Note that E[1/PD ] can be numerically computed by » – ∞ X 1 1 E = · fPoi (Nj |ρπR2 ) PD P Dj N =0 j

A PPENDIX H. E XTENSION : α-D ELAY UNDER C ORRELATED C ASE A. Upper Bound of α-Delay under Data Fusion Models In Section V, we assume that there is no common sensors between any two fusion ranges so that the unit detections are mutually independent. In this section, we derive the upper bound of α-delay no matter whether fusion ranges overlap or not. We first present the following lemma. Lemma 4. Let identically distributed positive Qx1 , x2 , . . . , xn be n RVs. Then E[ n i=1 xi ] ≤ E [x ] where x can be any one of x1 , x2 , . . . , x n . Proof: We first introduce H¨older’s inequality: If x1 and x2 are any RVs, for r > 1, s > 1, and 1 1 one has E[|x1 x2 |] ≤ (E[|x1 |r ]) r · (E[|x2 |s ]) s .

1 r

+

1 s

= 1,

B. Lower Bound of α-Delay under Disc Model Under the disc model, we refer to the circular region with radius of sensing range r centered at the target as the target disc. Lemma 1 gives the α-delay when target discs do not overlap. In this section, we derive the lower bound of α-delay no matter whether the target discs overlap or not. Lemma 5. The α-delay under disc model satisfies τ≥

1

n E [xn n]

Theorem 3. The α-delay of fusion-based detection satisfies τ ≤ E[1/PD ].

Therefore, Eq. (31) is approximated by i p θ − E[PD ] p · Nj i i 2 E[PD ] − E[(PD ) ]

"

n Note that as xi s are identically distributed, E[xn i ] = E[x ]. The upper bound of α-delay is given by the following theorem.

«

λ − µ − S · w(di ) dF (di ) σ ««2 Z R„ „ ∗ λ − µ − S · w(di ) i 2 E[(PD ) ]= Q dF (di ) σ 0 i E[PD ]=

By iteratively applying H¨older’s inequality, we have

1 1 − e−ρπr2

Proof: Let Aj denote the event that the target is not detected in the j th detection period after its appearance. Let Cj denote the target disc in the j th detection period, and #(Cj ) represent the number of sensors within Cj . Under the disc model, the target is not detected in the j th detection period if there is no sensor within Cj , i.e., #(Cj ) = 0. Suppose the target is detected in the J th detection period. Similar to the derivation of (21), we have

k=1

k=1

l=1

Tk−1

Note that Ak | l=1 Al in (33) represents the event that there is no sensor within the kth target disc provided that there is no sensor within the first to the (k − 1)th target discs. Denote C as the common area between the kth target disc and the union S of the first to the (k − 1)th target discs, formally, C = Ck ∩ ( k−1 l=1 Cl ). Accordingly, C ≥ 0 and there is no sensor within C. Therefore, the conditional probability in (33) satisfies ˛k−1 ! ˛\ 2 2 ˛ P Ak ˛ Al = P(#(Ck − C) = 0) = e−ρ(πr −C) ≥ e−ρπr ˛ l=1

and then (33) becomes P( τ = E[J] ≥ 1 +

Tj

k=1

∞ “ ” X 2 j e−ρπr = j=1

2

Ak ) ≥ (e−ρπr )j . Accordingly, 1 1 − e−ρπr2

A PPENDIX I. E XTENSION : BARRIER C OVERAGE OF S TRIP N ETWORKS A strip network is a long, narrow region. Such type of networks are often deployed for building a barrier against intruders, e.g., the surveillance of international borders. In this work, the strip can have any shape, but the two edges are parallel. Specifically, for any point P on a edge of the strip, the shortest distance between P and the other edge is a constant W0 . Sensors are deployed into the strip region according to the two-dimensional Poisson process with density of ρ. Other aspects of the network model is same as in Section III. A target is initially outside of the network, and going to cross the strip with a constant speed of v. The strip network model is illustrated in Fig. 14. For the strip network, the probability that a crossing target is detected before it moves out of the strip (denoted by P) is naturally concerned. For instance, based on the probability, we can predict the fraction of intrusions that can be detected if a number of intruders are going to trespass. So our problem is how much the average detection probability (denoted by E[P]) is for random targets while the false alarm rate of the network is upper bounded by α, i.e., PF ≤ α. If we consider two guard bands on the two edges of the strip network respectively and the width of each guard band is R, the edge effects can be eliminated for the middle strip network with width of W = W0 − 2R. We only focus on the middle strip. We have the following lemma describing the optimal motion strategy of the intruders. Lemma 6. Crossing the strip straightly, perpendicularly, and as fast as possible, can minimize the probability of being detected. Proof: Obviously, the minimum length of the target trajectory covered by the strip is W if and only if the target trajectory is straight and perpendicular to the strip. Denote m as the number of unit detections when the target is within the strip. The probability that Q the target is detected before it moves out of the strip is P = 1− m j=1 (1 − PDj ) where PDj is the detection probability of the j th unit detection. From (4) and (32), under both the value and decision fusion models, PDj for all j are identically distributed RVs. Thus, P is a RV. The objective Q of this lemma is to minimize the probability P(P ≥ β) = P( m j=1 (1 − PDj ) ≤ 1 − β) for

W0

guard band

“T ” P j E[J] = 1 + ∞ j=1 P k=1 Ak . According to the definition of conditional probability, we have ˛k−1 ! ! j j ˛\ \ Y ˛ Ak = P P Ak ˛ Al (33) ˛

guard band

15

Figure 14. Strip network model. The edges of the long strip region are parallel curves with constant distance W0 between them. The void circles represent randomly deployed sensors; the solid circles represent the target in different sampling intervals; the dashed discs represent the fusion ranges.

any given β. As PDj for all j are identically distributed and (1 − PDj ) < 1, the minimum ¨ W ˝ m can minimize the probability. The minimum m is m = vT + 1 if and only if the target trajectory is straight and perpendicular to the strip region. And the minimum m decreases with the speed v. Therefore, the intruder should cross the strip straightly, perpendicularly, and as fast as possible. Under the optimal motion strategy given by Lemma 6, it’s easy to calculate the average detection probability as follows, # "m Y (1 − PDj ) = 1 − (1 − E[PD ])m (34) E[P] = 1 − E j=1

where m = ⌊W/(vT )⌋ + 1 and E[PD ] can be computed using (5). Note that (34) gives the lower bound of average detection probability if the targets don’t follow the optimal motion strategy. Now we discuss the barrier coverage under the disc model. As derived in the proof of Lemma 1, under the disc model, the probability that the target is not detected in any unit detection is 2 e−ρb πr . Accordingly, the average detection probability under the disc model is “ ” 2 m (35) E[P] = 1 − e−ρb πr

As wise targets will trespass as fast as possible, the asymptotic scenario is v → ∞ and hence m → 1. And another asymptotic scenario is that we deploy a very thin strip network such that W → 0 and hence m → 1. Accordingly, if the same average detection probability is predicted by the two models under the asymptotic scenarios (i.e., m → 1), we let (34) and (35) be the 2 same and thus have E[PD ] = 1 − e−ρb πr . This condition is same as the condition (8) in the proof of Lemma 2. Therefore, both Lemma 2 and Theorem 2 also apply for the currently addressed barrier coverage problem.

A PPENDIX J. E XTENSION : G ENERAL S IGNAL ATTENUATION M ODEL In previous sections, we adopt a specific signal decay model, i.e., w(d) = 1/(1 + d2 ). Under a general decay model w(d) satisfying“w(0) = 1 and” w(∞) = 0, the sensing range is −1 −1 (β) r = w−1 Q (α)−Q , where w−1 (·) is the inverse function δ −1 of w(·). Note that w (·) is also a decreasing function. The monotonicity of sensing range r (i.e., r versus α, and r versus δ) is the same as in previous sections. Accordingly, the trend that the density ratio varies with α and δ analyzed in Section VI-A also applies for general signal attenuation model.