Anomaly Detection using Context-Aided Target Tracking

Anomaly detection refers to the problem of finding patterns in data that do not conform to expected normal behavior. Anomaly detection is extensively used in a wide variety of applications such as monitoring business news, epidemic or bioterrorism detection, intrusion detection, hardware fault detection, network alarm monitoring, and fraud detection [13]. Anomaly detection in target tracking is an essential tool in separating benign targets from intruders that pose a threat. This paper presents a new, innovative anomaly detection scheme using context-aided target tracking. Various data, feature, and knowledge fusion strategies and architectures have been developed over the last several years for improving the accuracy, robustness, and overall effectiveness of anomaly detection technologies. Singh et al. [41] illustrate the capabilities of hidden Markov models (HMMs), combined with featureaided tracking, for the detection of asymmetric threats. In [41], HMMs are integrated into feature-aided tracking using a transaction-based probabilistic model and a procedure analogous to Page’s test is used for the quickest detection of abnormal events. An information fusion-based decision support tool is presented in [8] to aid the identification of a target carrying out a pattern of activity, which could be comprised of a wide variety of possible sub-activities. Barker et al. [8] propose the time series anomaly detection methods to process multi-modal sensor data, which are then integrated by a Bayesian information fusion algorithm to provide a probability that each candidate under observation is carrying out the target activity. While the traditional anomaly-based intrusion detection approach builds one global profile for normal activities and detects intrusions by comparing current activities with the normal profile, Salem and Karim [39] propose a context-based profiling methods for building more realistic normal profiles than global ones. Moreover, contextual information is also exploited to build attack profiles that can be used for diagnosis purposes. Jackson et al. [21] propose a cognitive fusion approach for detecting anomalies appearing in the behavior of dynamic self-organizing systems such as sensor networks, mobile ad hoc networks, and tactical battle management. Fusion of relevant sensor data, maintenance database information, and outputs from various diagnostic and prognostic technologies have proven effective in reducing false alarm rates, increasing confidence levels in early fault detection, and predicting time to failure or degraded condition requiring maintenance action. Roemer et al. [38] provide an overview of various aspects of data, information, and knowledge fusion, including the places where fusion should exist within a health management system, the different types of fusion architectures, and a number of different fusion techniques. Compared to these existing context-aided anomaly detection schemes, the proposed