Online fusion of incremental learning for wireless sensor networks

Ever-more ubiquitous embedded systems provide us with large amounts of data. Performing analysis close to the data source allows for data reduction while giving information when unexpected behavior (i.e. \emph{anomalies} in the system under observation) occurs. This work presents a novel approach to online anomaly detection, based on an ensemble of classifiers that can be executed on distributed embedded systems. We consider both single and multi-dimensional input classifiers that are based on prediction errors. Predictions of single-dimensional time series input come from either a linear function model or general statistics over a data window. Multi-dimensional input stems from current and historical sensor values as well as predictions. We combine the classifier outputs in the ensemble using a heuristic method and Fisher's combined probability test. The proposed framework is tested thoroughly using synthetic and real-world data. The results are compared to known methods for anomaly detection on limited-resource systems. While individual classifiers perform comparably to known methods, our results show that using an ensemble of classifiers increases the overall detection of anomalies considerably.