Abstract
Wireless sensor network (WSN) is deployed to monitor certain physical quantities in a region. This monitoring problem could be stated as the problem of detecting a change in the parameters of a static or dynamic stochastic system. A moving window procedure is proposed to detect the systematic error, which occurs at an unknown time. It can detect the deviation in the mean of sensor measurements keeping variance as constant. The performance measures, such as the average run length (ARL) to detection delay and false alarms are computed for various window sizes. The performance comparison is done against traditional cumulative sum (CUSUM) method. The detection of change in mean using CUSUM is done with smaller delay compared to the proposed moving window detection procedure. In order to calculate CUSUM statistics, the number of measurements to keep in sensor memory increases with time. However, in the proposed moving window detection procedure, the number of stored measurements is limited by the size of the window. Therefore, it is advantageous to use the moving window procedure for change detection in sensor nodes that have very limited memory. A high probability of detection is achieved at the cost of larger window size and higher detection delay. However, we are able to achieve the maximum probability of detection even at a window size of 11.
1. Introduction
A set of nodes each encompassing the functionalities of a microprocessor, a memory storage unit, a transceiver, and a sensing element supplied by a suitable source of power working together to achieve a common task is called a wireless sensor network. The applications are categorized into military, environmental, health, residential, and other commercial areas [1]. The foremost application for WSN is detection, which serves as the initial goal of a sensing system [2]. The function of the WSN is to provide fine-grained real-time data on the physical environment and to detect time critical events. The samples of measurements from the sensors in a WSN are a realization of a random process. These measurements are assumed to be normally distributed. The parameters of normal distribution are mean and variance. The statistical distribution of the samples of measurements of a sensor node may change abruptly at some unknown time. It is required to detect the change “as early as possible” after its occurrence, subject to constraints on the false alarm probability.
In classical centralized detection, the local sensors in the multisensor system detect and transmit all their data wirelessly to fusion center (FC). It is responsible for making a decision on the change in the statistical parameters of the observations. In case of decentralized detection, each local sensor does some preliminary processing of data and the compressed data is being transmitted wirelessly from each sensor to other sensors and finally to the FC. The advantages of this decentralized detection include increased reliability of the system, reduced cost, and reduced communication bandwidth requirement [3].
Two different scenarios that describe the detection problem are static and dynamic. In the former setting, the sensor nodes receive either a single or a single block of observations and FC makes the binary decision. This static setting is useful in many applications, which include radar detection and surveillance systems. However, this is not useful in most of the problems. These problems can be dealt by means of dynamic setting. In this, each sensor node receives a sequence of observations, computes a test statistic, and compares it with the threshold set by the user. If the test statistic exceeds the threshold, the final decision is made; otherwise the detection system has the option to continue taking observations. This is the simplest decentralized binary sequential detection [4].
Change detection is a different binary sequential decision-making problem. Over several decades, the field of statistics has studied the change detection problem. Applications of change detection include critical infrastructure monitoring, failure detection in manufacturing systems and large machines, intrusion detection in computer networks and security systems, detection of the start of an epidemic, and target detection in surveillance systems. As an example, consider the problem of detecting the discharge of a biochemical substance in the environment using WSN. The sensor nodes in WSN detect this event; and information about the discharge of biochemical substance is accessible at the FC. Upon reception of the messages from each sensor node, it detects the discharge of biochemical substance as soon as possible.
There are two feasible settings in the detection procedure: centralized and decentralized. In the former setting, all the sensor observations are available without distortion at the FC for making a final decision. In the latter, each sensor performs preliminary processing of data and sends compressed information to FC. It processes the local decisions sent by all the sensors and produces a final decision. FC of a decentralized detection system is different from the central processor in centralized detection systems. It has only fractional information as sent by the sensor nodes and this results in the loss of performance in decentralized systems as compared to centralized systems. By optimal processing of information at each sensor node, it is possible to make the performance loss as small [3].
The advantages of decentralized setting are lower communication bandwidth requirement, higher reliability, and low cost. In a decentralized decision-making, each sensor node sends a binary message to FC and it takes the final decision. There are situations in which the information for decision-making is available in a decentralized setting. Decision fusion is the most general configuration for decentralized decision-making. The following contributions discuss the decentralized framework of the change detection problem. Each sensor node in WSN performs a cumulative sum (CUSUM) type test.
Crow and Schwartz (1996) discussed the quickest detection for sequential decentralized decision system [5]. The authors developed a local detection procedure to compare the sum of the successive blocks of sensor observations to a threshold in which the disorder time was assumed unknown and the design of local threshold using a simple method was discussed. Finally, the choice of block length for the local detection was developed.
Raghavan and Veeravalli (2010) proposed a work in [6]. According to them, the onset of a signal could occur in all the sensor nodes at the same time. The lifetime of the sensor network was increased by using energy efficient distributed cooperative change detection scheme. In [7], Banerjee et al. (2011) proposed an energy efficient change detection algorithm. In that, each sensor node used CUSUM algorithm and they communicated only when the CUSUM statistic was above the threshold set by the user. Wireless channel was modeled using multiple access channel corrupted with noise. The FC executed another CUSUM for change detection. Moreover, the authors considered transmission delays from different sensor nodes at FC.
In contrast, the local sensor nodes sent summary messages to the FC only when necessary as in Mei (2011). It prolonged the reliability and lifetime of the network. Further, the author considered threshold schemes in which there would be a raise in global alarm only when the sum of those local detection statistics exceeded the threshold set by the user [8].
Lai (2012) proposed a model to study the change point detection and identification problem in [9]. The reason was that the change point might occur at different times across sensors. For example, to detect the presence of a biological or chemical event, multiple sensors were deployed in different floors of a building. It is obvious that the sensors that are close to the point of event would observe changes at times earlier than sensors that are far away from the point of event. Under this condition, it was not only to detect the presence of a change but also of interest to identify the sensor that first observed a change.
Qiany et al. (2012) focused on the quickest detection of nuclear radiation using a nonparametric version of CUSUM test based on the local measurements from each sensor node in [10]. Since the occurrence of the nuclear radiation is unpredictable, it was assumed that the prior knowledge of the adversary was not available. Each sensor took binary decision locally and transmitted it to FC, which takes the global decision.
Tartakovsky and Polunchenko (2007) in [11] focused on composite postchange hypotheses when the postchange parameter was unknown. The authors analyzed various communication scenarios with FC, from the centralized setting (where the sensors sent sufficient statistics) to the decentralized setting (where they sent quantized observations or local decisions). In addition, a nonparametric version of the CUSUM change detection method was tested on a real dataset for detecting a denial-of-service attack in a high-speed computer network.
Xie and Siegmund (2013) developed a mixture procedure that achieved good detection performance in case of an unknown subset of affected sensors and incompletely mentioned postchange distributions in [12]. The detection statistic was computed with the assumption of fraction of affected sensors.
Page (1954) had solved the problem of change detection in a centralized setting in [13]. In the centralized setting, all information regarding the phenomenal changes was available at a single location called processing center for making a final decision about the change.
Assume that a WSN is used to monitor continuous production of a chemical plant. The value of the output substance is described by the intensity of some chemical ingredient. This intensity is assumed to be normally distributed. Under normal operating conditions of the plant, the parameters mean and standard deviation of this normal distribution are and , respectively. Under faulty conditions, there may be a deviation from the reference mean value towards , with unvarying standard deviation. This type of change is known as a systematic error. In addition, there may be a deviation from the reference standard deviation towards , with unvarying mean value. This type of change is known as a random error.
The contribution of this work is to design a statistical decision function and a decision rule that can detect the change in mean value. The average of samples of fixed window size is said to be the decision function. The decision is taken with the help of a stopping rule. The time instant in which the deviation from reference mean value towards new mean value takes place is referred to as change time. This change of time is unknown. The distributed sensor nodes make use of an averager and threshold comparator. When the mean of the sensor measurements of fixed window exceeds the user defined threshold, the change is detected. Exponential Chebyshev’s inequality is exploited to provide an upper bound to the probability of detection that the absolute deviation of a random variable from its mean will exceed the given threshold.
This research paper has been organized in the following manner. Section 2 presents the problem statement for moving window detection procedure and analysis of detection rule followed by the description of standard CUSUM method. Section 3 discusses the performance measures related to change detection and simulation results. Finally, the concluding remarks and suggestions for further work are presented in Section 4.
2. Problem Statement
2.1. Moving Window Detection Procedure
Figure 1(a) shows the proposed procedure for decentralized change detection. The sensor nodes are deployed in the region of interest. The sequence of measurements received by “” sensors at time instant are , where . These samples of measurements are a realization of a random process. They are assumed to be normally distributed. The parameters of normal distribution are mean and variance. Under faulty conditions, these parameters may deviate from the reference value. It is assumed that this deviation may occur at some unknown time instant simultaneously at all the sensors. Assume that the measurements follow a common probability distribution function before the change time and after the change time. The wireless links between the sensor nodes and the fusion center are good such that there is no transmission error. The information about the postchange mean is assumed to be known. This is an easy but idealistic case. Nevertheless, it could be extended to circumstances that are more practical by replacing unknown mean by values fixed a priori or by estimated values [14]. However, the proposed moving window detection procedure detects the occurrence of change point sequentially by considering “” samples in the window. For a specific application, if the sensor observations are learned over time, it is possible to estimate the mean value of the observations after change.
(a)
(b)
Each sensor node in the decentralized system uses an averager, which computes the test statistic and a threshold comparator as shown in Figure 1(b). Here, the decision function is the average of the sensor measurements within a fixed size window. The comparator compares the decision function with the user defined threshold.
When the average of the sensor measurements of fixed size window exceeds the user defined threshold, the change is detected. The binary local decision taken by each sensor node is being transmitted wirelessly to the fusion center for global decision of change. In a sequence of sensor node measurements , where the first measurements correspond to pre change data and the measurements correspond to post change data.
For , the probability density function of observation is given by , and , the probability density function of observation is given by , where and .
The procedure for detecting the change in the mean of the sensor node measurements in WSN is illustrated in Figure 2. The description of change detection procedure is as follows. Let “” belong to positive integers; denote the size of the fixed sample window and is the threshold. From the observations of sensor node, a sequence of batch-statistics is constructed as follows. Let , , and so on be the sequence of batch-statistics, where the statistic The statistic generated at time (after collecting observations) is compared with a fixed threshold. When it exceeds the threshold , the test is terminated and an alarm is initiated. Otherwise, one more sample is taken and is generated at time , and so on. The following decision function defined the statistic for all A local binary decision is obtained based upon the average of “” successive observations which exceeds the fixed local threshold . For a fixed sample size “,” the optimal decision rule is given by where the local threshold is assumed to be equal to the postchange mean value. This is an ideal case. For a specific application, if the sensor observations are informed over time, it is possible to estimate the mean value of the observations after change. The term is the decision function. The decision is taken with the help of a stopping rule, which is defined as where (4) is the alarm time. When the decision is in favor of change, the process of moving the window is stopped.
2.2. Analysis of the Detection Rule
In this section, analysis of the change detection rule is presented. The probability of detection is defined as the probability in which a change has been correctly detected within the fixed window size. Exponential Chebyshev’s inequality is used to provide an upper bound on the probability that an observation should be far from its mean.
Let be any random variable; then for any , the exponential Chebyshev’s inequality is the inequality , where and expectation is finite. This inequality may be used to obtain exponential inequalities for unbounded variables. From (1), where is a real variable.
The cumulants of a probability distribution are a set of quantities that provide an alternative to the moments of the distribution. In some cases, theoretical treatments of problems in terms of cumulants are simpler than those using moments. The cumulants of a random variable are defined via the cumulant-generating function, which is the logarithm of the moment-generating function. That is, Cumulant-generating function = .
Supremum is referred to as the least upper bound. In order to find the least upper bound of probability of detection, define For the normal distribution, with postchange mean value and variance , the cumulant-generating function is given by Let : In order to find out the supremum of the real variable , equate : Hence, the maximum value of is where is the variance. Probability of detection is Similarly, where is prechange mean value, is a given parameter, and is the probability of false alarm.
From (12), it is clear that window size and local threshold are chosen such that probability of detection is maximum while . This is possible by choosing , the postchange mean value, and window size .
2.3. CUSUM Detection Procedure
This subsection describes the commonly used change detection procedure cumulative sum or CUSUM, which is a standard method for modern usage. Page (1954) solved the problem of change detection in a centralized setting using CUSUM in [13]. Consider an example of detecting a change in the mean of the observations using CUSUM. One-sided case of an increase in the mean is considered. Assume that the postchange mean value is greater than the prechange mean value. The CUSUM statistic at each sensor node is calculated using the recursion formula as where is the log-likelihood ratio at time instant for the th sensor node. It is computed using the formula where = probability density after the change time; = probability density before the unknown change time; and for all “” and the corresponding CUSUM detection rule is given by The user arbitrarily sets the threshold [13]. This algorithm is incorporated in all sensor nodes and they take local binary decision. All sensor nodes transmit this binary decision to FC. When the binary decision is 1 at the first time for all the sensor nodes then the FC indicates the change by raising an alarm.
3. Performance Evaluation
In this section, the significance of evaluating the measures of performance for change detection procedures followed by defining the performance measures is presented. In addition, an approach for generating the performance curves for different window sizes is explained with an example.
A decentralized system for detecting a change in the mean of the observed samples with unknown change time is dependent on a sequence of observations from all the sensor nodes. In order to make a detection decision, when the number of observations increases, the probability of error is decreased. However, it increases the mean time to detect the change that first appears [15].
In a classical detection structure, threshold is fixed by means of the probability of false alarm. It corresponds to the probability of deciding alternative hypothesis when null hypothesis is true. In the sequential detection case, threshold is fixed in a similar way, although the probability of false alarm is approximated. On the other hand, in a change detection structure, the objective is to keep testing while new sensor observations are being arrived. Instead of fixing a false alarm probability, the usual approach is to decide the average run length (ARL) before a false alarm. Hence, for the detection of change in the mean of sequentially observed successive samples, ARL to detection delay and false alarm are used as performance measures.
Average Detection Delay. Average detection delay is a measure, which gives the ability of the algorithm to set an alarm when a change actually occurs.
Average Run Length (ARL). Run length is defined as the number of observations checked before raising an alarm for the occurrence of change point. It is dependent on whether the system is in control or out of control. Therefore, run length should be large if the system is in control and small if it is out of control. ARL is the expectation of the run length. ARL to false alarm and ARL to detection delay are the two values taken corresponding to prechange and postchange parameters, respectively. The former corresponds to the expected number of samples before a false alarm is signaled. The latter corresponds to the expected number of samples before the detection of a change.
3.1. Simulation Results
In this section, simulation results for the proposed moving window and standard CUSUM change detection metrics for detection on information streams in WSN are presented. Evaluation of the abovementioned detection procedures is done using NS-2, which is an open source, network simulation software. In the simulation, a 500 m by 500 m WSN that consists of 10 sensor nodes and 1 FC is constructed. As specified in Section 3, each sensor node in the WSN uses the proposed algorithm and the local decision taken by them is transmitted wirelessly to FC. In case of continuous monitoring of a specific event, each node is active throughout the entire simulation interval. The simulation parameters used for simulating the proposed moving window detection procedure are given in Table 1.
Moving Window Detection Procedure. The observations from the sensor node are modeled using Gaussian distribution as shown in Figure 3 with prechange and postchange mean values represented as and , respectively, and the variance is represented as . These observations may change abruptly in response to a sudden change in the environment or due to the malfunctioning of the sensor nodes. The change in the mean value of the distribution models additive changes in the sensor node observations. It is desirable to detect this abrupt change as early as possible with a constraint on ARL to false alarm. The change time may be unknown. The prechange and postchange observations follow and . The probability density function of observation before change is given by and after change, the probability density function of observation is given by . The definition of and is given below Assume prechange mean value , postchange mean value , and variance .
Consider a window of fixed sample size “” varying from 5 to 13. In general, “” is any integer. Now, for the fixed sample window size , there is a shift along the observations of sensor node sequentially and there is a test for the detection of change in mean for each window size. Let us assume that . To facilitate the test for a change in mean within a specified window, determine whether (1) holds true. If it is true, a warning signal is raised. Otherwise, it continues testing by sliding the window. Repeat this step for all window sizes for 1000 times. After finding out whether an alarm is raised or not for each window size, the implementation of the test is evaluated by the measures mentioned in this section.
Figure 4 illustrates the operating characteristics of moving window and standard CUSUM procedure for change detection where the postchange mean is assumed to be known.
The assumption of known postchange mean value is an easy but impractical case. It is often used as an initial point for the design of a detection algorithm. This assumption is based on the values fixed a priori or estimated values [14].
In order to obtain the average run length to false alarm and average detection delay, the window size is varied from 5 to 13. The threshold set by the user is assumed to be equal to the postchange mean value of the distribution which the observed samples follow. For a specific application, if the sensor observations are learned over time, it is possible to estimate the mean value of the observations after change.
For the CUSUM procedure, the threshold is set arbitrarily. Here, each point in the curve is plotted for various threshold settings. The detection of change in mean using CUSUM is done with smaller delay compared to the proposed moving window detection procedure. In order to calculate CUSUM statistics, the number of measurements to keep in sensor memory increases with time, whereas, in the proposed moving window detection procedure, the number of stored measurements is limited by the size of the window. Therefore, it is advantageous to use the moving window procedure in sensor nodes that have very limited memory. The slope of the line is determined by finding the ratio of the vertical change between two points on the line and the horizontal change between the points. Here, the slope between two consecutive points in Figure 5 is computed and listed in Table 2.
In Figure 5, ln(ARL) is used for the reason that, for large ARL, the average detection delay increases linearly as ARL increases exponentially [6]. In addition, this exhibits a constant slope for large ARL. The smaller the slope, the lesser the average detection delays.
From Figure 6, in the proposed moving window detection procedure, when the window size is less, the detection delay in change in mean of sensor measurements and the probability of detection are less. As the window size increases, average detection delay also increases linearly. A high probability of detection is achieved at the cost of higher memory usage and higher detection delay. However, we are able to achieve the maximum probability of detection even at a window size of 11. From Table 3, it is clear that the optimum window size can be taken as 11.
For larger window sizes, the expected number of samples required before signaling false alarm is found to be more when compared to smaller window sizes. For smaller window sizes, very often the local decisions are transmitted to the fusion center. This in turn increases the bandwidth required for each of the channels.
4. Concluding Remarks and Further Work
A moving window change detection procedure is proposed to detect the abrupt change in the observations from the sensor node at some unknown time. The proposed scheme is suitable for detecting the additive changes in the observed samples from the sensor nodes in WSN. The additive changes in the signal are modeled as change in the mean of the specific probability distribution, which the samples are assumed to follow. This change in the mean is to be detected with small mean time of detection for various window sizes.
It has been found that the average detection delay is increased with the increase in window size. This detection procedure can be used in applications where it is desired to detect even small changes in the mean of the observed samples sequentially. The operating characteristics and the performance analysis for the moving window detection procedure and CUSUM are carried out with the assumption of known postchange mean without considering any upper bound on average run length to false alarm. The proposed technique is validated using NS-2. Further, it could be incorporated into real hardware and real data could be used to validate the proposal.
Conflict of Interests
The authors B. Victoria Jancee and S. Radha declare that there is no conflict of interests regarding the publication of this paper.