Anomaly Detection Based On Graph In Wireless Sensor Networks

With the rapid development of sensor technology, embedded computing technology and distributed information processing technology, wireless sensor network (WSN) came into being and gradually mature. Anomaly detecting is one of key applications of WSN and of great research value. This thesis designed an anomaly detection and analysis system for abnormal behavior in WSN. The anomaly detection system is mainly divided into three parts:data acquisition and preprocessing, graph modeling and anomaly detection of graph sequence.In the part of data acquisition, sensor nodes may collect error data because of their own fault and environmental factors. Therefore this part mainly studies on how to detect fault data. First of all, according to the correlation between multi-attributes to judge whether the node is in normal condition. Then for the normal nodes, using fault-tolerant method based on histogram to filter noise data.In the graph modeling part, because of the complexity of the data collected, this thesis uses graph to organize the data, and puts forwards a modeling method of triggered data snapshot graph. In this method, the graph is modeled at the moment of the infrared sensor node being triggered to avoid the waste of energy which is caused by the graph modeling in the absence of behavior. At the same time, we use the subsequent data to achieve the data completion. This method takes into account the modeling time and the changes of node data. Comparing with the traditional method, the model can accurately reflect the user's behavior change.In the anomaly detection of graph sequence, direct detection of graph sequence has a high algorithm complexity. So, this part uses the characteristic of graph to convert graph sequence to multivariate time series. Then the converted multivariate time series becomes anomaly detection object. The detection method includes two steps:PCA processing and the distance measure. In this part, we propose a minimum distance metric based on the area to measure the distance between multivariate time series. The method directly measures the distance between the orthogonal coordinate system which is constructed by the characteristic vector from the principal component sequence. Compared to the Euclidean distance and the distance based on the area, the quality of the measurement is better.Experimental results show that the system has a better detection effect.