The Community for Technology Leaders
RSS Icon
Subscribe
Issue No.03 - March (2014 vol.26)
pp: 577-594
Massimiliano Albanese , George Mason University, Fairfax
Cristian Molinaro , Università della Calabria
Fabio Persia , Universita di Napoli, Napoli
Antonio Picariello , Universita di Napoli, Napoli
V.S. Subrahmanian , University of Maryland, College Park
ABSTRACT
There are numerous applications where we wish to discover unexpected activities in a sequence of time-stamped observation data--for instance, we may want to detect inexplicable events in transactions at a website or in video of an airport tarmac. In this paper, we start with a known set $({\cal A})$ of activities (both innocuous and dangerous) that we wish to monitor. However, in addition, we wish to identify "unexplained" subsequences in an observation sequence that are poorly explained (e.g., because they may contain occurrences of activities that have never been seen or anticipated before, i.e., they are not in $({\cal A})$). We formally define the probability that a sequence of observations is unexplained (totally or partially) w.r.t. $({\cal A})$. We develop efficient algorithms to identify the top-$(k)$ Totally and partially unexplained sequences w.r.t. $({\cal A})$. These algorithms leverage theorems that enable us to speed up the search for totally/partially unexplained sequences. We describe experiments using real-world video and cyber-security data sets showing that our approach works well in practice in terms of both running time and accuracy.
INDEX TERMS
computing methodologies, Knowledge representation formalisms and methods, artificial intelligence, computing methodologies, knowledge base management, knowledge representation formalisms and methods, artificial intelligence,
CITATION
Massimiliano Albanese, Cristian Molinaro, Fabio Persia, Antonio Picariello, V.S. Subrahmanian, "Discovering the Top-k Unexplained Sequences in Time-Stamped Observation Data", IEEE Transactions on Knowledge & Data Engineering, vol.26, no. 3, pp. 577-594, March 2014, doi:10.1109/TKDE.2013.33
REFERENCES
[1] M. Albanese, V. Moscato, A. Picariello, V.S. Subrahmanian, and O. Udrea, "Detecting Stochastically Scheduled Activities in Video," Proc. 20th Int'l Joint Conf. Artificial Intelligence, pp. 1802-1807, 2007.
[2] S. Hongeng and R. Nevatia, "Multi-Agent Event Recognition," Proc. Int'l Conf. Computer Vision (ICCV), pp. 84-93, 2001.
[3] N. Vaswani, A.K.R. Chowdhury, and R. Chellappa, "'Shape Activity': A Continuous-State HMM for Moving/Deforming Shapes with Application to Abnormal Activity Detection," IEEE Trans. Image Processing, vol. 14, no. 10, pp. 1603-1616, Oct. 2005.
[4] M. Brand, N. Oliver, and A. Pentland, "Coupled Hidden Markov Models for Complex Action Recognition," Proc. IEEECS Conf. Computer Vision and Pattern Recognition (CVPR), pp. 994-999, 1997.
[5] N. Oliver, E. Horvitz, and A. Garg, "Layered Representations for Human Activity Recognition," Proc. IEEE Fourth Int'l Conf. Multimodal Interfaces (ICMI), pp. 3-8, 2002.
[6] R. Hamid, Y. Huang, and I. Essa, "Argmode - Activity Recognition Using Graphical Models," Proc. Computer Vision and Pattern Recognition Workshop (CVPRW), pp. 38-43, 2003.
[7] N.P. Cuntoor, B. Yegnanarayana, and R. Chellappa, "Activity Modeling Using Event Probability Sequences," IEEE Trans. Image Processing, vol. 17, no. 4, pp. 594-607, Apr. 2008.
[8] D. Zhang, D. Gatica-Perez, S. Bengio, and I. McCowan, "Semi-Supervised Adapted HMMs for Unusual Event Detection," Proc. IEEECS Conf. Computer Vision and Pattern Recognition (CVPR), pp. 611-618, 2005.
[9] M.T. Chan, A. Hoogs, J. Schmiederer, and M. Petersen, "Detecting Rare Events in Video Using Semantic Primitives with HMM," Proc. 17th Int'l Conf. Pattern Recognition (ICPR), pp. 150-154, 2004.
[10] T. Xiang and S. Gong, "Video Behavior Profiling for Anomaly Detection," IEEE Trans. Pattern Analysis and Machine Intelligence, vol. 30, no. 5, pp. 893-908, May 2008.
[11] J. Kim and K. Grauman, "Observe Locally, Infer Globally: A Space-Time MRF for Detecting Abnormal Activities with Incremental Updates," Proc. Conf. Computer Vision and Pattern Recognition (CVPR), 2009.
[12] J. Yin, Q. Yang, and J.J. Pan, "Sensor-Based Abnormal Human-Activity Detection," IEEE Trans. Knowledge and Data Eng., vol. 20, no. 8, pp. 1082-1090, June 2008.
[13] D.H. Hu, X.-X. Zhang, J. Yin, V.W. Zheng, and Q. Yang, "Abnormal Activity Recognition Based on Hdp-HMM Models," Proc. Int'l Joint Conf. Artificial Intelligence, pp. 1715-1720, 2009.
[14] X.-X. Zhang, H. Liu, Y. Gao, and D.H. Hu, "Detecting Abnormal Events via Hierarchical Dirichlet Processes," Proc. 13th Pacific-Asia Conf. Advances in Knowledge Discovery and Data Mining (PAKDD), pp. 278-289, 2009.
[15] D. Mahajan, N. Kwatra, S. Jain, P. Kalra, and S. Banerjee, "A Framework for Activity Recognition and Detection of Unusual Activities," Proc. Indian Conf. Computer Vision, Graphics & Image Processing (ICVGIP), 2004.
[16] F. Jiang, Y. Wu, and A.K. Katsaggelos, "Detecting Contextual Anomalies of Crowd Motion in Surveillance Video," Proc. IEEE 16th Int'l Conf. Image Processing (ICIP), pp. 1117-1120, 2009.
[17] H. Zhong, J. Shi, and M. Visontai, "Detecting Unusual Activity in Video," Proc. IEEECS Conf. Computer Vision and Pattern Recognition (CVPR), pp. 819-826, 2004.
[18] C.E. Au, S. Skaff, and J.J. Clark, "Anomaly Detection for Video Surveillance Applications," Proc. 17th Int'l Conf. Pattern Recognition (ICPR), pp. 888-891, 2006.
[19] Y. Zhou, S. Yan, and T.S. Huang, "Detecting Anomaly in Videos from Trajectory Similarity Analysis," Proc. IEEE Int'l Conf. Multimedia and Expo (ICME), pp. 1087-1090, 2007.
[20] A. Mecocci and M. Pannozzo, "A Completely Autonomous System That Learns Anomalous Movements in Advanced Videosurveillance Applications," Proc. IEEE Int'l Conf. Image Processing (ICIP), pp. 586-589, 2005.
[21] L. Brun, A. Saggese, and M. Vento, "A Clustering Algorithm of Trajectories for Behaviour Understanding Based on String Kernels," Proc. Eighth Int'l Conf. Signal Image Technology and Internet Based Systems (SITIS), pp. 267-274, 2012.
[22] J. Wang, Z. Cheng, M. Zhang, Y. Zhou, and L. Jing, "Design of a Situation-Aware System for Abnormal Activity Detection of Elderly People," Proc. Eighth Int'l Conf. Active Media Technology (AMT), pp. 561-571, 2012.
[23] B.T. Morris and M.M. Trivedi, "Trajectory Learning for Activity Understanding: Unsupervised, Multilevel, and Long-Term Adaptive Approach," IEEE Trans. Pattern Analysis and Machine Intelligence, vol. 33, no. 11, pp. 2287-2301, Apr. 2011.
[24] A. Adam, E. Rivlin, I. Shimshoni, and D. Reinitz, "Robust Real-Time Unusual Event Detection Using Multiple Fixed-Location Monitors," IEEE Trans. Pattern Analysis and Machine Intelligence, vol. 30, no. 3, pp. 555-560, Jan. 2008.
[25] F. Jiang, J. Yuan, S.A. Tsaftaris, and A.K. Katsaggelos, "Video Anomaly Detection in Spatiotemporal Context," Proc. IEEE Int'l Conf. Image Processing (ICIP), pp. 705-708, 2010.
[26] A. Gupta, P. Srinivasan, J. Shi, and L.S. Davis, "Understanding Videos, Constructing Plots Learning a Visually Grounded Storyline Model from Annotated Videos," Proc. IEEECS Conf. Computer Vision and Pattern Recognition (CVPR), pp. 2012-2019, 2009.
[27] M. Albanese, C. Molinaro, F. Persia, A. Picariello, and V.S. Subrahmanian, "Finding "Unexplained" Activities in Video," Proc. 20th Int'l Joint Conf. Artificial Intelligence, pp. 1628-1634, July 2011.
[28] B. Mukherjee, L.T. Heberlein, and K.N. Levitt, "Network Intrusion Detection," IEEE Network, vol. 8, no. 3, pp. 26-41, May 1994.
[29] P. García-Teodoro, J. Díaz-Verdejo, G. Maciá-Fernández, and E. Vázquez, "Anomaly-Based Network Intrusion Detection: Techniques, Systems and Challenges," Computers and Security, vol. 28, nos. 1/2, pp. 18-28, Feb./Mar 2009.
[30] A. Jones and S. Li, "Temporal Signatures for Intrusion Detection," Proc. 17th Ann. Computer Security Applications Conf. (ACSAC), pp. 252-261, Dec. 2001.
[31] L. Wang, A. Liu, and S. Jajodia, "Using Attack Graphs for Correlating, Hypothesizing, and Predicting Intrusion Alerts," Computer Comm., vol. 29, no. 15, pp. 2917-2933, Sept. 2006.
[32] S. Noel, E. Robertson, and S. Jajodia, "Correlating Intrusion Events and Building Attack Scenarios through Attack Graph Distances," Proc. Ann. Computer Security Applications Conf. (ACSAC), pp. 350-359, Dec. 2004.
[33] H. Debar and A. Wespi, "Aggregation and Correlation of Intrusion-Detection Alerts," Proc. Fourth Int'l Symp. Recent Advances in Intrusion Detection (RAID), pp. 85-103, Oct. 2001.
[34] P. Ning, Y. Cui, and D.S. Reeves, "Constructing Attack Scenarios through Correlation of Intrusion Alerts," Proc. Ninth ACM Conf. Computer and Comm. Security (CCS), pp. 245-254, Nov. 2002.
[35] S.O. Al-Mamory and H. Zhang, "IDS Alerts Correlation Using Grammar-Based Approach," J. Computer Virology, vol. 5, no. 4, pp. 271-282, Nov. 2009.
[36] M. Albanese, S. Jajodia, A. Pugliese, and V.S. Subrahmanian, "Scalable Analysis of Attack Scenarios," Proc. 16th European Conf. Research in Computer Security (ESORICS), pp. 416-433, Sept. 2011.
[37] X. Qin and W. Lee, "Statistical Causality Analysis of INFOSEC Alert Data," Proc. Int'l Symp. Recent Advances in Intrusion Detection (RAID), pp. 73-93, Sept. 2003.
[38] X. Qin, "A Probabilistic-Based Framework for INFOSEC Alert Correlation," PhD thesis, Georgia Inst. of Tech nology, Aug. 2005.
[39] A.J. Oliner, A.V. Kulkarni, and A. Aiken, "Community Epidemic Detection Using Time-Correlated Anomalies," Proc. Int'l Symp. Recent Advances in Intrusion Detection (RAID), pp. 360-381, Sept. 2010.
[40] S. Tsukiyama, M. Ide, H. Ariyoshi, and I. Shirakawa, "A New Algorithm for Generating All the Maximal Independent Sets," SIAM J. Computing, vol. 6, no. 3, pp. 505-517, 1977.
[41] "Ninth IEEE International Workshop Performance Evaluation of Tracking and Surveillance (PETS 2006) Benchmark Data," http://www.cvg.rdg.ac.uk/PETS2006data.html , 2006.
39 ms
(Ver 2.0)

Marketing Automation Platform Marketing Automation Tool