Movatterモバイル変換

[0]ホーム
URL:

CN108682140B - An Enhanced Anomaly Detection Method Based on Compressed Sensing and Autoregressive Models - Google Patents

An Enhanced Anomaly Detection Method Based on Compressed Sensing and Autoregressive ModelsDownload PDF

Info

Publication number
CN108682140B
CN108682140BCN201810367791.XACN201810367791ACN108682140BCN 108682140 BCN108682140 BCN 108682140BCN 201810367791 ACN201810367791 ACN 201810367791ACN 108682140 BCN108682140 BCN 108682140B
Authority
CN
China
Prior art keywords
monitoring data
node
cluster
data
abnormal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
CN201810367791.XA
Other languages
Chinese (zh)
Other versions
CN108682140A (en
Inventor
李哲涛
王建辉
周仪璇
邓清勇
田淑娟
徐雁冰
张�杰
刘倩
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Xiangtan University
Original Assignee
Xiangtan University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Xiangtan UniversityfiledCriticalXiangtan University
Priority to CN201810367791.XApriorityCriticalpatent/CN108682140B/en
Publication of CN108682140ApublicationCriticalpatent/CN108682140A/en
Application grantedgrantedCritical
Publication of CN108682140BpublicationCriticalpatent/CN108682140B/en
Expired - Fee Relatedlegal-statusCriticalCurrent
Anticipated expirationlegal-statusCritical

Links

Images

Classifications

Landscapes

Abstract

The invention provides an enhanced anomaly detection method based on compressed sensing and an autoregressive model. Firstly, carrying out primary anomaly detection on monitoring data of sensor nodes in a cluster at a certain moment by utilizing compressed sensing by a cluster head; then, accurately detecting abnormal monitoring data of the sensor nodes at a certain moment by utilizing the time correlation of the monitoring data of the sensor nodes and combining an autoregressive model; and finally, the sink node judges whether the abnormal monitoring data is caused by abnormal events or measurement errors by utilizing the spatial correlation of the monitoring data of the nodes in each cluster, and positions the occurrence area of the abnormal events. The invention can improve the accuracy of abnormal event detection in the wireless sensor network, reduce the false alarm rate and the incidence rate of misjudgment events, and has wide applicability.

Description

Translated fromChinese
一种基于压缩感知和自回归模型的增强型异常检测方法An Enhanced Anomaly Detection Method Based on Compressed Sensing and Autoregressive Models

技术领域technical field

本发明主要涉及到无线传感器网络中的异常事件检测领域。The invention mainly relates to the field of abnormal event detection in wireless sensor networks.

背景技术Background technique

异常事件检测是无线传感器网络的一种重要应用。当异常事件(如化学物质泄漏、火灾等)发生后，传感器节点应能够尽快检测出事件可能发生的区域，并及时地向汇聚节点报告。Anomaly detection is an important application of wireless sensor networks. When an abnormal event (such as chemical leakage, fire, etc.) occurs, the sensor node should be able to detect the area where the event may occur as soon as possible, and report it to the sink node in time.

压缩感知为分布式感知网络的数据收集开辟了新的思路。首先对稀疏数据进行采样，然后对采样得到的数据进行压缩测量，得到测量值，最后由测量值对原始数据进行重构。该理论降低了信号的采样频率，还减少了数据存储空间和网络传输量。由于异常事件是小概率发生事件，因此压缩感知为无线传感器网络中异常事件的检测提供了思路。然而，单纯地通过压缩感知中的重构算法对节点数据进行重构，并直接通过重构结果来检测节点发送的数据是否异常，存在检测结果不精确、虚警率上升的缺点。此外，无线传感器网络在事件监测中所面临的主要问题是检测精度受环境噪声和设备不稳定性的影响，如果只根据一个单独节点某个时间点的感知数据对事件进行判断，则很容易造成无线传感器网络中误判事件的发生，而利用时间序列的方法来对各个节点每个时刻的监测数据进行检测，需要计算的量会很大。Compressed sensing opens up new ideas for data collection in distributed sensing networks. First, the sparse data is sampled, then the sampled data is compressed and measured to obtain the measured value, and finally the original data is reconstructed from the measured value. This theory reduces the sampling frequency of the signal, and also reduces the data storage space and the amount of network transmission. Since abnormal events are events with a small probability, compressed sensing provides an idea for the detection of abnormal events in wireless sensor networks. However, simply reconstructing the node data through the reconstruction algorithm in compressed sensing and directly detecting whether the data sent by the node is abnormal through the reconstruction result has the disadvantages of inaccurate detection results and increased false alarm rate. In addition, the main problem faced by wireless sensor networks in event monitoring is that the detection accuracy is affected by environmental noise and equipment instability. If the event is judged only based on the sensing data of a single node at a certain point in time, it is easy to cause The occurrence of misjudgment events in wireless sensor networks, and the use of time series methods to detect the monitoring data of each node at each moment, requires a large amount of calculation.

综上所述，在利用压缩感知对无线传感器网络节点中的异常事件进行初步检测的基础上，如何结合节点自回归模型来提高检测精度，以及如何利用簇内节点的空间相关性来对测量误差和异常事件进行识别、定位等，目前尚没有科学的解决方案。To sum up, based on the preliminary detection of abnormal events in wireless sensor network nodes using compressed sensing, how to combine the node autoregressive model to improve the detection accuracy, and how to use the spatial correlation of nodes in the cluster to detect measurement errors. There is no scientific solution for identifying and locating abnormal events.

发明内容SUMMARY OF THE INVENTION

针对上述问题，提出了在无线传感器网络中的一种基于压缩感知和自回归模型的增强型异常检测方法，具体步骤如下：Aiming at the above problems, an enhanced anomaly detection method based on compressed sensing and autoregressive models in wireless sensor networks is proposed. The specific steps are as follows:

步骤一、网络场景的布置以及网络的初始化处理：Step 1. The layout of the network scene and the initialization of the network:

1、在监测区域随机分布数量为N的传感器节点；所有传感器节点具有相同的初始能量以及传输速率；所有传感器节点可以通过GPS等定位方法获取自身地理位置信息；1. Randomly distribute N sensor nodes in the monitoring area; all sensor nodes have the same initial energy and transmission rate; all sensor nodes can obtain their own geographic location information through GPS and other positioning methods;

2、根据异常事件的分布，将整个无线传感器网络的监测区域划分为C个簇，并选取簇头和汇聚节点，组成分簇网络，第j个簇头监测的传感器节点数目为Nj，j＝1,2,...,C。2. According to the distribution of abnormal events, divide the monitoring area of the entire wireless sensor network into C clusters, and select cluster heads and sink nodes to form a clustered network. The number of sensor nodes monitored by the jth cluster head is Nj , j =1,2,...,C.

步骤二、基于历史正常数据，簇头为其监测区域中的每个传感器节点建立一个自回归模型：Step 2. Based on historical normal data, the cluster head establishes an autoregressive model for each sensor node in its monitoring area:

1、在一定时间范围内，每个传感器节点的监测数据是平稳的，即第i个节点t时刻的监测数据

Figure BDA0001637749440000021
与t+1时刻的监测数据
Figure BDA0001637749440000022
有相同的分布；1. Within a certain time range, the monitoring data of each sensor node is stable, that is, the monitoring data of the i-th node at time t
Figure BDA0001637749440000021
and monitoring data at time t+1
Figure BDA0001637749440000022
have the same distribution;

2、每个传感器节点的监测数据满足大数定律，即对于任意的T个时刻，每个传感器节点的监测数据值收敛于所有监测数据的期望值，期望值为：

Figure BDA0001637749440000023
2. The monitoring data of each sensor node satisfies the law of large numbers, that is, for any T time, the monitoring data value of each sensor node converges to the expected value of all monitoring data, and the expected value is:
Figure BDA0001637749440000023

3、以各节点监测到的正常的历史数据为先验信息，为第i个节点构造一个pi阶的自回归模型：3. Taking the normal historical data monitored by each node as the prior information, construct an autoregressive model of order pi for theith node:

Figure BDA0001637749440000024
Figure BDA0001637749440000024

其中，

Figure BDA0001637749440000025
为模型t时刻的残差，服从均值为μi，方差为
Figure BDA0001637749440000026
的正态分布，
Figure BDA0001637749440000027
分别表示第i个节点t时刻之前的pi个时刻的监测数据对当前t时刻监测数据的影响强度；in,
Figure BDA0001637749440000025
is the residual of the model at time t, obeying the mean μi , and the variance is
Figure BDA0001637749440000026
the normal distribution of ,
Figure BDA0001637749440000027
Respectively represent the influence intensity of the monitoring data at time pi before thei -th node at time t on the current monitoring data at time t;

步骤三、在t时刻，节点感知监测数据并对其进行二值化，根据预先设定的阈值θ，若

Figure BDA0001637749440000028
则
Figure BDA0001637749440000029
否则
Figure BDA00016377494400000210
得到二值化后的监测数据，此时第i个簇内的节点数据向量为
Figure BDA00016377494400000211
其中
Figure BDA00016377494400000212
的值为0或1；Step 3. At time t, the node perceives the monitoring data and binarizes it. According to the preset threshold θ, if
Figure BDA0001637749440000028
but
Figure BDA0001637749440000029
otherwise
Figure BDA00016377494400000210
The binarized monitoring data is obtained. At this time, the node data vector in the i-th cluster is
Figure BDA00016377494400000211
in
Figure BDA00016377494400000212
is 0 or 1;

步骤四、簇头对t时刻簇内的节点数据向量进行压缩采样，然后将采样所得数据路由至汇聚节点，汇聚节点对每个簇内的节点数据向量进行重构，得到初步检测结果，最后簇头对异常的监测数据进行收集：Step 4: The cluster head compresses and samples the node data vector in the cluster at time t, and then routes the sampled data to the sink node, and the sink node reconstructs the node data vector in each cluster to obtain the preliminary detection result. The head collects abnormal monitoring data:

1、根据第j个簇头产生随机观测矩阵

Figure BDA00016377494400000213
其中M为压缩感知得到的向量维数，Nj为第j个簇头监测的传感器节点数目，将其簇内节点的监测数据向量投影到观测矩阵
Figure BDA00016377494400000214
上，得到感知数据序列，并将感知数据序列路由到汇聚节点，第j个簇头路由的感知数据序列为
Figure BDA00016377494400000215
Figure BDA00016377494400000216
1. Generate a random observation matrix according to the jth cluster head
Figure BDA00016377494400000213
where M is the vector dimension obtained by compressed sensing, Nj is the number of sensor nodes monitored by the jth cluster head, and the monitoring data vector of the nodes in the cluster is projected to the observation matrix
Figure BDA00016377494400000214
, the sensing data sequence is obtained, and the sensing data sequence is routed to the sink node. The sensing data sequence routed by the jth cluster head is:
Figure BDA00016377494400000215
Figure BDA00016377494400000216

2、汇聚节点根据收到的感知数据序列，利用OMP算法对每个簇内的节点数据向量进行重构；2. The sink node uses the OMP algorithm to reconstruct the node data vector in each cluster according to the received sensing data sequence;

3、各个簇内重构得到的监测数据为非零的传感器节点将其原始监测数据发送给簇头，其中序号为i的传感器节点发送的原始监测数据为

Figure BDA00016377494400000217
3. The sensor nodes whose monitoring data reconstructed in each cluster is non-zero send their original monitoring data to the cluster head, and the original monitoring data sent by the sensor node with serial number i is:
Figure BDA00016377494400000217

步骤五、每个簇头根据簇内监测数据的时空相关性对t时刻各个簇内重构得到的监测数据为非零的传感器节点(以下简称为目标传感器节点)的监测结果进行识别：Step 5: Each cluster head identifies the monitoring results of the sensor nodes (hereinafter referred to as target sensor nodes) whose monitoring data reconstructed in each cluster at time t is non-zero according to the spatiotemporal correlation of the monitoring data in the cluster:

1、根据之前为每个传感器节点建立的自回归模型：1. According to the autoregressive model previously established for each sensor node:

Figure BDA0001637749440000031
Figure BDA0001637749440000031

由其t时刻的监测数据和其此前pi个时刻的历史数据，根据模型可计算出其t时刻的残差值

Figure BDA0001637749440000032
From the monitoring data at time t and the historical data at time pi before, the residual value at time t can be calculated according to the model
Figure BDA0001637749440000032

2、判断

Figure BDA0001637749440000033
的值是否落在区间[μi-3σi,μi+3σi]之内。若
Figure BDA0001637749440000034
的值落在[μi-3σi,μi+3σi]内，则说明序号为i的目标传感器节点t时刻的监测数据是正常的，否则说明序号为i的目标传感器节点t时刻的监测数据异常；2. Judgment
Figure BDA0001637749440000033
Whether the value of is within the interval [μi -3σi , μi +3σi ]. like
Figure BDA0001637749440000034
is within [μi -3σi , μi +3σi ], it means that the monitoring data of the target sensor node with serial number i at time t is normal, otherwise it means the monitoring data of the target sensor node with serial number i at time t abnormal data;

3、t时刻各个簇头接收到序号为i的目标传感器节点发送的异常监测数据

Figure BDA0001637749440000035
后，向簇内其他传感器节点发送传输数据请求，簇内其他传感器节点将其当前的监测数据发送给簇头；所有传感器节点的监测数据集合为
Figure BDA0001637749440000036
3. At time t, each cluster head receives the abnormal monitoring data sent by the target sensor node with serial number i
Figure BDA0001637749440000035
Then, send data transmission requests to other sensor nodes in the cluster, and other sensor nodes in the cluster send their current monitoring data to the cluster head; the monitoring data set of all sensor nodes is
Figure BDA0001637749440000036

4、簇头将簇内所有节点发送的监测数据进行排序，得到中值Me(若有偶数个监测数据，则取中间两数的均值)；各节点的监测数据与中值Me差值的集合为

Figure BDA0001637749440000037
均值
Figure BDA0001637749440000038
标准差
Figure BDA0001637749440000039
第i个节点的监测数据
Figure BDA00016377494400000310
的标准化值
Figure BDA00016377494400000311
4. The cluster head sorts the monitoring data sent by all nodes in the cluster to obtain the median Me (if there is an even number of monitoring data, the average of the two middle numbers is taken); the set of differences between the monitoring data of each node and the median Me for
Figure BDA0001637749440000037
mean
Figure BDA0001637749440000038
standard deviation
Figure BDA0001637749440000039
Monitoring data of the i-th node
Figure BDA00016377494400000310
normalized value of
Figure BDA00016377494400000311

5、当

Figure BDA00016377494400000312
大于预设门限α时，第i个节点发送的异常数据是由测量误差所导致的，否则，第i个节点所监测的区域发生异常情况，该节点向其所在簇内的簇头发送预警信号；各个簇头发送各自的检测结果至汇聚节点，即发送监测区域发生异常情况的节点编号至汇聚节点，最后得到一个全局的检测结果；5. When
Figure BDA00016377494400000312
When it is greater than the preset threshold α, the abnormal data sent by the i-th node is caused by the measurement error; otherwise, an abnormal situation occurs in the area monitored by the i-th node, and the node sends an early warning signal to the cluster head in its cluster. ; Each cluster head sends its own detection results to the aggregation node, that is, sends the node number of the abnormal situation in the monitoring area to the aggregation node, and finally obtains a global detection result;

综上所述，本发明的优点如下：To sum up, the advantages of the present invention are as follows:

1、在利用压缩感知理论对异常数据进行初步检测的基础上，通过建立自回归模型，充分利用传感器节点监测数据的时间相关性来对异常数据进行更精确的检测，降低了网络中的虚警率，使检测结果更可靠。1. Based on the preliminary detection of abnormal data by using compressed sensing theory, by establishing an autoregressive model, making full use of the time correlation of sensor node monitoring data to detect abnormal data more accurately, reducing false alarms in the network rate, making the detection results more reliable.

2、充分利用各个簇内传感器节点监测数据之间的空间相关性，将某传感器节点监测的异常数据与其所在簇内其他传感器节点监测到的数据进行对比，从而能识别异常数据是由于传感器节点所监测的区域发生了异常事件造成的还是由于测量误差造成的。2. Make full use of the spatial correlation between the monitoring data of sensor nodes in each cluster, and compare the abnormal data monitored by a sensor node with the data monitored by other sensor nodes in the cluster, so as to identify the abnormal data due to the sensor node. Whether an abnormal event occurs in the monitored area is also caused by measurement error.

附图说明Description of drawings

图1为本发明的流程图；Fig. 1 is the flow chart of the present invention;

图2为进一步对异常监测数据进行检测以及对异常监测数据进行识别的过程图；Fig. 2 is a process diagram of further detecting abnormal monitoring data and identifying abnormal monitoring data;

图3是本发明网络模型分簇示意图。FIG. 3 is a schematic diagram of the network model clustering of the present invention.

具体实施方法Specific implementation method

本发明设计了在无线传感器网络中的一种基于压缩感知和自回归模型的增强型异常检测方法，结合图1，异常事件检测的具体实施方法如下：The present invention designs an enhanced abnormality detection method based on compressive sensing and autoregressive models in wireless sensor networks. With reference to Figure 1, the specific implementation method of abnormal event detection is as follows:

步骤一、如图2所示，网络场景的布置以及网络的初始化处理：Step 1. As shown in Figure 2, the layout of the network scene and the initialization processing of the network:

1、在监测区域随机分布数量为N的传感器节点；所有传感器节点具有相同的初始能量以及传输速率；所有传感器节点可以通过GPS等定位方法获取自身地理位置信息；1. Randomly distribute N sensor nodes in the monitoring area; all sensor nodes have the same initial energy and transmission rate; all sensor nodes can obtain their own geographic location information through GPS and other positioning methods;

2、根据异常事件的分布，将整个无线传感器网络的监测区域划分为C个簇，并选取簇头和汇聚节点，组成分簇网络，第j个簇头监测的传感器节点数目为Nj，j＝1,2,...,C。2. According to the distribution of abnormal events, divide the monitoring area of the entire wireless sensor network into C clusters, and select cluster heads and sink nodes to form a clustered network. The number of sensor nodes monitored by the jth cluster head is Nj , j =1,2,...,C.

步骤二、基于历史正常数据，簇头为其监测区域中的每个传感器节点建立一个自回归模型：Step 2. Based on historical normal data, the cluster head establishes an autoregressive model for each sensor node in its monitoring area:

1、假设在一定时间范围内，每个传感器节点的监测数据是平稳的，即第i个节点t时刻的监测数据

Figure BDA0001637749440000041
与t+1时刻的监测数据
Figure BDA0001637749440000042
有相同的分布；1. Assume that the monitoring data of each sensor node is stable within a certain time range, that is, the monitoring data of the i-th node at time t
Figure BDA0001637749440000041
and monitoring data at time t+1
Figure BDA0001637749440000042
have the same distribution;

2、每个传感器节点的监测数据满足大数定律，即对于任意的T个时刻，每个传感器节点某时刻的监测数据值都收敛于所有监测数据值的期望值，期望值为：2. The monitoring data of each sensor node satisfies the law of large numbers, that is, for any T time, the monitoring data value of each sensor node at a certain time converges to the expected value of all monitoring data values, and the expected value is:

Figure BDA0001637749440000043
Figure BDA0001637749440000043

3、以各节点监测到的正常的历史数据为先验信息，为第i个节点构造一个pi阶的自回归模型：3. Taking the normal historical data monitored by each node as the prior information, construct an autoregressive model of order pi for theith node:

Figure BDA0001637749440000044
Figure BDA0001637749440000044

其中，

Figure BDA0001637749440000051
为模型t时刻的残差，服从均值为μi，方差为
Figure BDA0001637749440000052
的正态分布，
Figure BDA0001637749440000053
分别表示第i个节点t时刻之前的pi个时刻的监测数据对当前t时刻监测数据的影响强度；in,
Figure BDA0001637749440000051
is the residual of the model at time t, obeying the mean μi, and the variance is
Figure BDA0001637749440000052
the normal distribution of ,
Figure BDA0001637749440000053
Respectively represent the influence intensity of the monitoring data at time pi before thei -th node at time t on the current monitoring data at time t;

步骤三、在t时刻，节点感知监测数据并对其进行二值化，根据预先设定的阈值θ，若

Figure BDA0001637749440000054
则
Figure BDA0001637749440000055
否则
Figure BDA0001637749440000056
得到二值化后的监测数据，此时第i个簇内的节点数据向量为
Figure BDA0001637749440000057
其中
Figure BDA0001637749440000058
的值为0或1；Step 3. At time t, the node perceives the monitoring data and binarizes it. According to the preset threshold θ, if
Figure BDA0001637749440000054
but
Figure BDA0001637749440000055
otherwise
Figure BDA0001637749440000056
The binarized monitoring data is obtained. At this time, the node data vector in the i-th cluster is
Figure BDA0001637749440000057
in
Figure BDA0001637749440000058
is 0 or 1;

步骤四、簇头对t时刻簇内的节点数据向量进行压缩采样，然后将采样所得数据路由至汇聚节点，汇聚节点对每个簇内的节点数据向量进行重构操作，得到初步检测结果，最后簇头对异常的监测数据进行收集：Step 4: The cluster head compresses and samples the node data vector in the cluster at time t, and then routes the sampled data to the sink node, and the sink node reconstructs the node data vector in each cluster to obtain the preliminary detection result. The cluster head collects abnormal monitoring data:

1、根据第j个簇头产生随机观测矩阵

Figure BDA0001637749440000059
其中M为压缩感知得到的向量维数，Nj为第j个簇头监测的传感器节点数目，将其簇内节点的监测数据向量投影到观测矩阵
Figure BDA00016377494400000510
上，得到感知数据序列，并将感知数据序列路由到汇聚节点，第j个簇头路由的感知数据序列为
Figure BDA00016377494400000511
1. Generate a random observation matrix according to the jth cluster head
Figure BDA0001637749440000059
where M is the vector dimension obtained by compressed sensing, Nj is the number of sensor nodes monitored by the jth cluster head, and the monitoring data vector of the nodes in the cluster is projected to the observation matrix
Figure BDA00016377494400000510
, the sensing data sequence is obtained, and the sensing data sequence is routed to the sink node. The sensing data sequence routed by the jth cluster head is:
Figure BDA00016377494400000511

Figure BDA00016377494400000512
Figure BDA00016377494400000512

2、汇聚节点根据收到的感知数据序列，利用OMP算法对每个簇内的节点数据向量进行重构；2. The sink node uses the OMP algorithm to reconstruct the node data vector in each cluster according to the received sensing data sequence;

本发明中使用的OMP算法伪代码如下所示：The OMP algorithm pseudocode used in the present invention is as follows:

输入：字典矩阵Φ，原始信号y，稀疏度K，标识待重建信号中非零元素位置的索引集TInput: dictionary matrix Φ, original signal y, sparsity K, index set T identifying the positions of non-zero elements in the signal to be reconstructed

输出：重建信号xoutput: reconstructed signal x

初始化：x＝0,r0＝y，循环标识k＝0，索引集T0为空集Initialization: x=0, r0 =y, loop identifier k=0, index set T0 is an empty set

当没有满足结束条件时，循环执行步骤①～⑥When the end condition is not met, steps ①～⑥ are executed cyclically

①k＝k+1①k=k+1

②找出残差r与采样矩阵中最匹配原子的索引λk，即② Find the index λk of the most matching atom in the residual r and the sampling matrix, namely

λk＝argmaxj＝1,2,...,N{|<rk-1,φk>|}λk =argmaxj=1,2,...,N {|<rk-1 ,φk >|}

③更新索引集Tk＝Tk-1∪{λk}，并更新相应采样矩阵中的重建原子集合③Update the index set Tk =Tk-1 ∪{λk }, and update the reconstructed atom set in the corresponding sampling matrix

Figure BDA0001637749440000061
Figure BDA0001637749440000061

④由最小二乘法得到

Figure BDA0001637749440000062
④ Obtained by the least squares method
Figure BDA0001637749440000062

⑤更新残差：

Figure BDA0001637749440000063
⑤Update residuals:
Figure BDA0001637749440000063

⑥判断是否满足k＞K，若满足，则停止迭代，若不满足，则执行步骤①⑥ Judge whether k>K is satisfied, if so, stop the iteration, if not, execute step ①

3、各个簇内重构得到的监测数据为非零的传感器节点将其原始监测数据发送给簇头，其中序号为i的传感器节点发送的原始监测数据为

Figure BDA0001637749440000064
3. The sensor nodes whose monitoring data reconstructed in each cluster is non-zero send their original monitoring data to the cluster head, and the original monitoring data sent by the sensor node with serial number i is:
Figure BDA0001637749440000064

步骤五、簇头根据监测数据的时空相关性对t时刻各个簇内重构得到的监测数据为非零的传感器节点(以下简称为目标传感器节点)的监测结果进行识别：Step 5: The cluster head identifies the monitoring results of the sensor nodes (hereinafter referred to as target sensor nodes) whose monitoring data reconstructed in each cluster at time t is non-zero according to the spatiotemporal correlation of the monitoring data:

1、根据之前为每个传感器节点建立的自回归模型(2)：1. According to the autoregressive model (2) previously established for each sensor node:

由其t时刻的监测数据和其此前pi个时刻的历史数据，根据模型可计算出其t时刻的残差值

Figure BDA0001637749440000065
From the monitoring data at time t and the historical data at time pi before, the residual value at time t can be calculated according to the model
Figure BDA0001637749440000065

2、判断

Figure BDA0001637749440000066
的值是否落在区间[μi-3σi,μi+3σi]之内。若
Figure BDA0001637749440000067
的值落在[μi-3σi,μi+3σi]内，则说明序号为i的目标传感器节点t时刻的监测数据是正常的，否则说明序号为i的目标传感器节点t时刻的监测数据异常；2. Judgment
Figure BDA0001637749440000066
Whether the value of is within the interval [μi -3σi , μi +3σi ]. like
Figure BDA0001637749440000067
is within [μi -3σi , μi +3σi ], it means that the monitoring data of the target sensor node with serial number i at time t is normal, otherwise it means the monitoring data of the target sensor node with serial number i at time t abnormal data;

3、t时刻各个簇头接收到序号为i的目标传感器节点发送的异常监测数据

Figure BDA0001637749440000068
后，向簇内其他传感器节点发送传输数据请求，簇内其他传感器节点将其当前的监测数据发送给簇头；所有传感器节点的监测数据集合为
Figure BDA0001637749440000069
3. At time t, each cluster head receives the abnormal monitoring data sent by the target sensor node with serial number i
Figure BDA0001637749440000068
Then, send data transmission requests to other sensor nodes in the cluster, and other sensor nodes in the cluster send their current monitoring data to the cluster head; the monitoring data set of all sensor nodes is
Figure BDA0001637749440000069

4、簇头将簇内所有节点发送的监测数据进行排序，得到中值Me(若有偶数个监测数据，则取中间两数的均值)；各节点的监测数据与中值Me差值集合为

Figure BDA00016377494400000610
均值
Figure BDA00016377494400000611
标准差
Figure BDA00016377494400000612
Figure BDA00016377494400000613
的标准化值
Figure BDA00016377494400000614
簇头将簇内所有节点发送的监测数据进行排序，得到中值Me(若有偶数个监测数据，则取中间两数的均值)；各节点的监测数据与中值Me差值的集合为
Figure BDA00016377494400000615
均值
Figure BDA00016377494400000616
标准差
Figure BDA0001637749440000071
Figure BDA0001637749440000072
的标准化值
Figure BDA0001637749440000073
4. The cluster head sorts the monitoring data sent by all nodes in the cluster to obtain the median Me (if there is an even number of monitoring data, the average of the two middle numbers is taken); the set of differences between the monitoring data of each node and the median Me is:
Figure BDA00016377494400000610
mean
Figure BDA00016377494400000611
standard deviation
Figure BDA00016377494400000612
Figure BDA00016377494400000613
normalized value of
Figure BDA00016377494400000614
The cluster head sorts the monitoring data sent by all nodes in the cluster to obtain the median Me (if there is an even number of monitoring data, the average of the two middle numbers is taken); the set of differences between the monitoring data of each node and the median Me is
Figure BDA00016377494400000615
mean
Figure BDA00016377494400000616
standard deviation
Figure BDA0001637749440000071
Figure BDA0001637749440000072
normalized value of
Figure BDA0001637749440000073

5、当

Figure BDA0001637749440000074
大于预设门限α时，第i个节点发送的异常数据是由测量误差所导致的，否则，第i个节点所监测的区域发生异常情况，该节点向其所在簇内的簇头发送预警信号；各个簇头发送各自的检测结果至汇聚节点，即发送监测区域发生异常情况的节点编号至汇聚节点，最后得到一个全局的检测结果。5. When
Figure BDA0001637749440000074
When it is greater than the preset threshold α, the abnormal data sent by the i-th node is caused by the measurement error; otherwise, an abnormal situation occurs in the area monitored by the i-th node, and the node sends an early warning signal to the cluster head in its cluster. ; Each cluster head sends its own detection result to the sink node, that is, sends the node number of the abnormal situation in the monitoring area to the sink node, and finally obtains a global detection result.

Claims (2)

1. An enhanced anomaly detection method based on compressed sensing and autoregressive models, the method comprising the steps of:
step one, arrangement of a network scene and initialization processing of a network;
step two, using normal historical data monitored by each node as prior information, and establishing a p for each sensor node in a cluster by each cluster headiAutoregressive model of order:
Figure FDA0002538546520000011
wherein,
Figure FDA0002538546520000012
the residual error of the model at the moment t is subjected to mean value muiVariance is
Figure FDA0002538546520000013
Normal distribution of (2);
Figure FDA0002538546520000014
respectively representing the ith node at and p before time tiA moment of timeThe monitoring data of (2) is obtained,
Figure FDA0002538546520000015
respectively representing p before the ith node tiThe influence strength of the monitoring data at each moment on the monitoring data at the current t moment;
step three, at the moment t, the ith node senses monitoring data
Figure FDA0002538546520000016
And binarizing the image according to a preset threshold value theta if
Figure FDA0002538546520000017
Then
Figure FDA0002538546520000018
Otherwise
Figure FDA0002538546520000019
Obtaining binarized monitoring data; at this time, the vector formed by the binarization monitoring data of each node in the ith cluster is
Figure FDA00025385465200000110
Wherein
Figure FDA00025385465200000111
Representing the monitoring data after the k sensor node in the ith cluster is binarized at the time t,
Figure FDA00025385465200000112
is 0 or 1, NiIs the number of sensor nodes in the ith cluster;
step four, each cluster head conducts compressed sensing on vectors formed by the binarization monitoring data of each node in the cluster at the time t, then the sampled data are routed to a sink node, the sink node conducts reconstruction on the vectors formed by the binarization monitoring data in each cluster to obtain a preliminary detection result, and finally the cluster head collects abnormal monitoring data:
1) generating random observation matrix by jth cluster head
Figure FDA00025385465200000113
Where M is the vector dimension obtained by compressed sensing, NjProjecting the monitoring data vector of the node in the jth cluster to an observation matrix for the number of the sensor nodes monitored by the jth cluster head
Figure FDA00025385465200000114
Obtaining a sensing data sequence, and routing the sensing data sequence to a sink node, wherein the sensing data sequence of the jth cluster head route is
Figure FDA00025385465200000115
Figure FDA00025385465200000116
Wherein
Figure FDA00025385465200000117
A vector formed by the binarization monitoring data of all nodes in the jth cluster, wherein j is 1,2, …, and C is the number of cluster heads;
2) the sink node is based on the received compressed sensing sequence
Figure FDA0002538546520000021
Reconstructing the node data vector in each cluster by using an OMP algorithm;
3) the sensor nodes with non-zero monitoring data obtained by reconstruction in each cluster send the original detection data to the corresponding cluster heads, wherein the original monitoring data sent by the sensor node with the serial number i is
Figure FDA0002538546520000022
Step five, according to the section for sending abnormal dataPoint-based autoregressive model from current monitoring data of nodes
Figure FDA0002538546520000023
And historical monitoring data
Figure FDA0002538546520000024
Calculating the residual value of the current model
Figure FDA0002538546520000025
If it is
Figure FDA0002538546520000026
If the data fall in the target interval, the monitoring data are normal, and the preliminary detection result obtained by adopting compressed sensing is corrected:
1) according to the autoregressive model previously established for each sensor node:
Figure FDA0002538546520000027
thereby calculating the residual value at the time t
Figure FDA0002538546520000028
2) Judgment of
Figure FDA0002538546520000029
Whether the value of (D) falls within the interval [ mu ]i-3σi,μi+3σi]If the value falls within [ mu ]i-3σi,μi+3σi]If the time is within the range, the monitoring data of the target sensor node with the sequence number i at the time t is normal, otherwise, the monitoring data of the target sensor node with the sequence number i at the time t is abnormal;
and step six, identifying the detection result of the abnormal node of the monitoring data by each cluster head at the time t according to the space-time correlation of the monitoring data in the cluster, and finally sending the detection result of the abnormal event in the cluster by each cluster head, namely, numbering the abnormal event occurring node in the monitoring area to the sink node to obtain a global detection result:
1) at time t, each cluster head receives abnormal monitoring data sent by target sensor node with sequence number i
Figure FDA00025385465200000210
Then, sending a data transmission request to other sensor nodes in the cluster, and sending the monitoring data of the other sensor nodes in the cluster at the time t to a cluster head; setting the monitoring data set of all sensor nodes at the time t as
Figure FDA00025385465200000211
2) The cluster head sorts the monitoring data sent by all the nodes in the cluster to obtain a median Me (if there are even monitoring data, the mean value of the middle two is taken); the difference value set of the monitoring data of each node and the median Me is
Figure FDA00025385465200000212
Mean value
Figure FDA00025385465200000213
Standard deviation of
Figure FDA00025385465200000214
Figure FDA00025385465200000215
Normalized value of
Figure FDA00025385465200000216
3) When in use
Figure FDA00025385465200000217
When the value is larger than the preset threshold α, the abnormal data sent by the ith node is caused by the measurement error, otherwise, the abnormal condition occurs in the area monitored by the ith node, and the node sends the abnormal data to the area monitored by the ith nodeSending an early warning signal by a cluster head in a cluster; each cluster head sends respective detection results to the sink node, namely sends the node number of the abnormal condition of the monitoring area to the sink node, and finally obtains a global detection result.
2. The enhanced anomaly detection method based on compressive sensing and autoregressive models as claimed in claim 1, wherein the network scenario layout and network initialization process comprises the following steps:
1) randomly distributing N sensor nodes in a monitoring area; all sensor nodes have the same initial energy and transmission rate; all the sensor nodes can acquire self geographical position information by positioning methods such as a GPS (global positioning system) and the like;
2) according to the distribution of abnormal events, dividing the monitoring area of the whole wireless sensor network into C clusters, selecting cluster heads and sink nodes to form a clustering network, wherein the number of sensor nodes monitored by the jth cluster head is Nj，j＝1,2,...,C。
CN201810367791.XA2018-04-232018-04-23 An Enhanced Anomaly Detection Method Based on Compressed Sensing and Autoregressive ModelsExpired - Fee RelatedCN108682140B (en)

Priority Applications (1)

Application NumberPriority DateFiling DateTitle
CN201810367791.XACN108682140B (en)2018-04-232018-04-23 An Enhanced Anomaly Detection Method Based on Compressed Sensing and Autoregressive Models

Applications Claiming Priority (1)

Application NumberPriority DateFiling DateTitle
CN201810367791.XACN108682140B (en)2018-04-232018-04-23 An Enhanced Anomaly Detection Method Based on Compressed Sensing and Autoregressive Models

Publications (2)

Publication NumberPublication Date
CN108682140A CN108682140A (en)2018-10-19
CN108682140Btrue CN108682140B (en)2020-07-28

Family

ID=63802144

Family Applications (1)

Application NumberTitlePriority DateFiling Date
CN201810367791.XAExpired - Fee RelatedCN108682140B (en)2018-04-232018-04-23 An Enhanced Anomaly Detection Method Based on Compressed Sensing and Autoregressive Models

Country Status (1)

CountryLink
CN (1)CN108682140B (en)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
CN109348450B (en)*2018-11-012021-05-25北京京航计算通讯研究所High-reliability data transmission method applied to emergency disposal
CN109492193B (en)*2018-12-282020-11-27同济大学 Anomaly network data generation and prediction method based on deep machine learning model
CN109921952B (en)*2019-04-012021-11-23安徽农业大学Data collection method based on compressed sensing and model driving
CN111189488B (en)*2019-12-132020-12-04精英数智科技股份有限公司Sensor value abnormity identification method, device, equipment and storage medium
CN112672302B (en)*2020-12-212022-07-26国网甘肃省电力公司电力科学研究院Clustering and data sensing method applied to photovoltaic power station wireless sensor

Citations (7)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
CN101511099A (en)*2009-04-012009-08-19南京邮电大学Collection method for wireless sensor network data based on time series prediction model
CN102594904A (en)*2012-03-042012-07-18浙江大学Method for detecting abnormal events of wireless sensor network in distributed way
EP3016352A1 (en)*2014-11-032016-05-04Fujitsu LimitedMethod of managing sensor network
CN105636094A (en)*2016-03-162016-06-01中国地质大学（武汉）Wireless sensor network early warning method and system based on clustering compressed sensing
TW201619582A (en)*2014-11-252016-06-01國立臺灣大學Method for vibration monitoring and alarming using autoregressive models
CN105682171A (en)*2016-03-092016-06-15北京航空航天大学Spatio-temporal clustering method for compressive data gathering
CN106792435A (en)*2016-11-232017-05-31西安电子科技大学 A Data Aggregation Method Based on Compressed Sensing in Wireless Sensor Networks

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
WO2008141225A1 (en)*2007-05-112008-11-20The Trustees Of Columbia University In The City Of New YorkSystems and methods for telescopic data compression in sensor networks

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication numberPriority datePublication dateAssigneeTitle
CN101511099A (en)*2009-04-012009-08-19南京邮电大学Collection method for wireless sensor network data based on time series prediction model
CN102594904A (en)*2012-03-042012-07-18浙江大学Method for detecting abnormal events of wireless sensor network in distributed way
EP3016352A1 (en)*2014-11-032016-05-04Fujitsu LimitedMethod of managing sensor network
TW201619582A (en)*2014-11-252016-06-01國立臺灣大學Method for vibration monitoring and alarming using autoregressive models
CN105682171A (en)*2016-03-092016-06-15北京航空航天大学Spatio-temporal clustering method for compressive data gathering
CN105636094A (en)*2016-03-162016-06-01中国地质大学（武汉）Wireless sensor network early warning method and system based on clustering compressed sensing
CN106792435A (en)*2016-11-232017-05-31西安电子科技大学 A Data Aggregation Method Based on Compressed Sensing in Wireless Sensor Networks

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
Distributed Compressive Sampling for Lifetime Optimization in Dense Wireless Sensor Networks;Carlo Caione 等;《IEEE Transactions on Industrial Informatics》;20120229;第8卷(第1期);第30-40页*
基于压缩感知的无线传感网数据收集研究进展;朱更明 等;《西北大学学报(自然科学版)》;20150825;第45卷(第4期);第560-566页*
采用压缩感知和GM(1,1)的无线传感器网络异常检测方法;刘洲洲 等;《西安交通大学学报》;20170228;第51卷(第2期);第40-46页*

Also Published As

Publication numberPublication date
CN108682140A (en)2018-10-19

Similar Documents

PublicationPublication DateTitle
CN108682140B (en) An Enhanced Anomaly Detection Method Based on Compressed Sensing and Autoregressive Models
Clouqueur et al.Fault tolerance in collaborative sensor networks for target detection
CN106687773B (en)Sensor node location and sensor network organization based on context event detection
CN108882225B (en) A secure location method based on ranging in wireless sensor networks
Moshtaghi et al.Anomaly detection by clustering ellipsoids in wireless sensor networks
CN103200597B (en)Wireless sensor network-oriented fault-tolerance event boundary detection method
CN113497726A (en)Alarm monitoring method, alarm monitoring system, computer readable storage medium and electronic equipment
CN102752784B (en)Detection method of distribution type event domain based on graph theory in wireless sensor network
CN108650706B (en)Sensor node positioning method based on second-order Taylor approximation
CN111027721B (en) A System Fault Location Method
US10200965B2 (en)Analysis and monitoring of a positioning infrastructure
CN109547929B (en) Distributed sensor node localization method based on conjugate gradient method
Nguyen et al.Applying time series analysis and neighbourhood voting in a decentralised approach for fault detection and classification in WSNs
Rajagopal et al.Distributed online simultaneous fault detection for multiple sensors
CN110266527B (en)Sensor node fault classification alarm method and device based on spatial correlation
CN111157943A (en) TOA-Based Sensor Position Error Suppression in Asynchronous Networks
CN118611706A (en) A communication control method based on power line network dual-mode communication
Zhang et al.Cooperative sensor anomaly detection using global information
Chen et al.Noncooperative topology inference of wireless networks with monitoring sensors
CN111884859A (en)Network fault diagnosis method and device and readable storage medium
CN108988496B (en) Method, device and equipment for diagnosing fault of secondary system of intelligent substation
CN110988928B (en)Satellite navigation landing integrity monitoring method based on length constraint
CN109861859B (en)Multi-Agent system fault detection method based on side inspection comprehensive judgment
Cho et al.Robust calibration for localization in clustered wireless sensor networks
CN102075970B (en)Method for detecting sparse event of wireless sensor network by loop restructuring

Legal Events

DateCodeTitleDescription
PB01Publication
PB01Publication
SE01Entry into force of request for substantive examination
SE01Entry into force of request for substantive examination
GR01Patent grant
GR01Patent grant
CF01Termination of patent right due to non-payment of annual fee

Granted publication date:20200728

CF01Termination of patent right due to non-payment of annual fee
[8]ページ先頭
©2009-2025 Movatter.jp