The document presents a methodology for learning pattern-of-life (POL) models from GPS tracking data to detect anomalies. It proposes a hierarchical model with temporal and spatial layers. The temporal layer models preferred schedules using kernel density estimation (KDE) and conformal anomaly detection. The spatial layer models preferred routes using online clustering. The methodology is tested on two datasets and detects spatial and spatiotemporal anomalies. Results show CAD detects narrower anomalies than KDE. Future work includes improving the models and testing other techniques.

1. Introduction Methodology Results Conclusions and Future Work Bibliography
LEARNING TARGET PATTERN-OF-LIFE FOR
WIDE-AREA ANOMALY DETECTION
Tatiana López Guevara
June 2015

2. Introduction Methodology Results Conclusions and Future Work Bibliography
Participants
Supervisors
Dr. Rolf Baxter Dr. Neil Robertson

3. Introduction Methodology Results Conclusions and Future Work Bibliography
Contents
1 Introduction
2 Methodology
3 Results
4 Conclusions and Future Work
5 Bibliography

4. Introduction Methodology Results Conclusions and Future Work Bibliography
Section 1
Introduction

5. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
What is Anomaly Detection?
Chandola et al. [1]: "Patterns in data that do not conform to a well
defined notion of normal behaviour"
Well defined notion?
Same Size?
Same Type?

6. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
What is Anomaly Detection?
Chandola et al. [1]: "Patterns in data that do not conform to a well
defined notion of normal behaviour"
Well defined notion?
Same Size?
Same Type?

7. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
What is Anomaly Detection?
Chandola et al. [1]: "Patterns in data that do not conform to a well
defined notion of normal behaviour"
Well defined notion?
Same Size?
Same Type?

8. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
What is Anomaly Detection?
Chandola et al. [1]: "Patterns in data that do not conform to a well
defined notion of normal behaviour"
Well defined notion?
Same Size?
Same Type?

9. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
What is Anomaly Detection?
Hawkins et al. [2]: "An observation which deviates so much from
other observations as to arouse suspicions that it was generated by
a different mechanism."

10. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
What is Anomaly Detection?
Hawkins et al. [2]: "An observation which deviates so much from
other observations as to arouse suspicions that it was generated by
a different mechanism."

11. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
Pattern-of-Life
Learn preferred behaviour from target’s daily interaction with its
environment

12. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
Pattern-of-Life
Learn preferred behaviour from target’s daily interaction with its
environment

13. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
Pattern-of-Life
Learn preferred behaviour from target’s daily interaction with its
environment

14. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
Pattern-of-Life
Learn preferred behaviour from target’s daily interaction with its
environment

15. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
Wide-Area
Not limited to a single/fixed scenario

16. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
Wide-Area
Not limited to a single/fixed scenario

17. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
What kind of behaviour?
Human movement
⇒ Trajectories

18. Introduction Methodology Results Conclusions and Future Work Bibliography
Definitions
Anomaly Detection
Detect behaviour not represented by the model
⇒ General indicator of an interesting event!

19. Introduction Methodology Results Conclusions and Future Work Bibliography
Our observation
What other information could be useful?
Periodic modulation that characterise human nature

20. Introduction Methodology Results Conclusions and Future Work Bibliography
Why is it useful?
POL as a prior
Enhanced Tracking
Personalized/Proactive Systems
Anomalies detected
Raise alarms ⇒ elderly/cognitive impaired people
Other domains
Change single target’s traces ⇒ ships/cars/pedestrians
Other types of human behaviour
Indoor high level activities

21. Introduction Methodology Results Conclusions and Future Work Bibliography
Why is it challenging?
POL characteristics : Must have
1 Unsupervised on-line learning
2 Partially observed trajectories
3 No external dependencies
4 Few ad-hoc thresholds / Low False Positive Rate (FPR)
No prior work use time-dependent POL for anomaly detection!

22. Introduction Methodology Results Conclusions and Future Work Bibliography
Why is it challenging?
POL characteristics : Must have
1 Unsupervised on-line learning
2 Partially observed trajectories
3 No external dependencies
4 Few ad-hoc thresholds / Low False Positive Rate (FPR)
No prior work use time-dependent POL for anomaly detection!

23. Introduction Methodology Results Conclusions and Future Work Bibliography
Summary of Objectives
Learn behaviour from movement
Single person’s GPS Tracks
Include temporal dependency
Time of the day
Day of the week
Detect Anomalies
Spatial
Spatio-Temporal

24. Introduction Methodology Results Conclusions and Future Work Bibliography
Section 2
Methodology

25. Introduction Methodology Results Conclusions and Future Work Bibliography
Hierarchical Model Learning
Temporal layer
Preferred schedules
Spatial layer
Preferred routes
Sp
Te

26. Introduction Methodology Results Conclusions and Future Work Bibliography
Overview of Proposed Methodology
Update Spatial
Model
Spatial
Anomaly ?
Temporal
Anomaly ?
Update Temporal
Model
Point Anomaly
Logger
Trajectory Point
Anomaly
Processor
Temporal Layer
Spatial Layer
Anomaly Detection
Preprocessing

27. Introduction Methodology Results Conclusions and Future Work Bibliography
Spatial Layer

28. Introduction Methodology Results Conclusions and Future Work Bibliography
Spatial Layer: Model Learning
Adaptation of on-line method proposed by Piciarelli et al. [4]
to work with wide-area data
1 2 3
4 5 6
c1
c2 c3
c4
c1
c4
c2 c3
c1
c2 c3
c4
c1
c2 c3
c4
c1
c2 c3
c4
c5
c1
c2 c3
c4
c5
c6
(Images adapted from [4]).

29. Introduction Methodology Results Conclusions and Future Work Bibliography
Temporal Layer
Two methods
1 Kernel Density Estimation (KDE)
2 Conformal Anomaly Detection (CAD)

30. Introduction Methodology Results Conclusions and Future Work Bibliography
Temporal Layer - Kernel Density Estimator (KDE)
KDE Definition
ˆf (x;h) =
1
n
n
i=1
Kh(x−xi) (1)
Which Kernel?
Circular data
⇒ von-Misses Kernel
Advantages
Non parametric
Parameter-light

31. Introduction Methodology Results Conclusions and Future Work Bibliography
Temporal Layer - Kernel Density Estimator (KDE)
KDE Definition
ˆf (x;h) =
1
n
n
i=1
Kh(x−xi) (1)
Which Kernel?
Circular data
⇒ von-Misses Kernel
Advantages
Non parametric
Parameter-light

32. Introduction Methodology Results Conclusions and Future Work Bibliography
Temporal Layer - Kernel Density Estimator (KDE)
KDE Definition
ˆf (x;h) =
1
n
n
i=1
Kh(x−xi) (1)
Which Kernel?
Circular data
⇒ von-Misses Kernel
Advantages
Non parametric
Parameter-light

33. Introduction Methodology Results Conclusions and Future Work Bibliography
Temporal Layer
Two methods
1 Kernel Density Estimation (KDE)
2 Conformal Anomaly Detection (CAD)

34. Introduction Methodology Results Conclusions and Future Work Bibliography
Temporal Layer - Conformal Anomaly Detector (CAD)
Proposed by Laxhammar et al. [3]
Advantages
Based on theory of confidence Interval
Completely on-line
Parameter-light
is directly bounded to the FPR

35. Introduction Methodology Results Conclusions and Future Work Bibliography
Temporal Layer - CAD - Method
Input
Previous observations: B = {z1,..,zn−1}
New observation: zn
Output
Ratio of samples in B that are at least as
different as zn.
pzn
Nonconformity Measure NCM
Sum of the distance of the K− nearest
neighbours

36. Introduction Methodology Results Conclusions and Future Work Bibliography
Temporal Layer - CAD - Method
Input
Previous observations: B = {z1,..,zn−1}
New observation: zn
Output
Ratio of samples in B that are at least as
different as zn.
pzn
Nonconformity Measure NCM
Sum of the distance of the K− nearest
neighbours

37. Introduction Methodology Results Conclusions and Future Work Bibliography
Temporal Layer - CAD - Method
Input
Previous observations: B = {z1,..,zn−1}
New observation: zn
Output
Ratio of samples in B that are at least as
different as zn.
pzn
Nonconformity Measure NCM
Sum of the distance of the K− nearest
neighbours

38. Introduction Methodology Results Conclusions and Future Work Bibliography
Temporal Layer - CAD - Method
Input
Previous observations: B = {z1,..,zn−1}
New observation: zn
Output
Ratio of samples in B that are at least
as different as zn.
pzn
Nonconformity Measure NCM
Sum of the distance of the K− nearest
neighbours

39. Introduction Methodology Results Conclusions and Future Work Bibliography
Temporal Layer - CAD - Method
Input
Previous observations: B = {z1,..,zn−1}
New observation: zn
Output
Ratio of samples in B that are at least
as different as zn.
pzn
Nonconformity Measure NCM
Sum of the distance of the K− nearest
neighbours

40. Introduction Methodology Results Conclusions and Future Work Bibliography
Anomaly Detection
Spatial
No cluster match found
Match to a low density cluster < thrT
Temporal - KDE Method
Low density regions: less than 95% of the total density
Temporal - CAD Method
Fraction less than parameter: pzn <

41. Introduction Methodology Results Conclusions and Future Work Bibliography
Section 3
Results

42. Introduction Methodology Results Conclusions and Future Work Bibliography
Datasets
Heriot-Watt Dataset
Period: 7 months Dates: Oct 2014 - Apr 2015

43. Introduction Methodology Results Conclusions and Future Work Bibliography
Qualitative Results - Spatial Layer
Zoom in: Most Transited Area

44. Introduction Methodology Results Conclusions and Future Work Bibliography
Qualitative Results - Spatial Layer
Zoom out: Overall view

45. Introduction Methodology Results Conclusions and Future Work Bibliography
Quantitative Results - Spatial Layer
Quantitative result of spatial anomalies detected by the Spatial layer

46. Introduction Methodology Results Conclusions and Future Work Bibliography
Qualitative Results - Temporal Layer
0/24 1
2
3
4
5
6
7
8
9
10
111213
14
15
16
17
18
19
20
21
22
23
+
KDE CAD
8 19 20 21 22 23 24
KDE Circular
Anomalies
Observations
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
Track: 758, Cluster: 1839 [-1]
KDE Circular
Anomalies
Observations
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
KDE Circular
1
Track: 715, Cluster: 2139 [-1]
KDE Circular
2

47. Introduction Methodology Results Conclusions and Future Work Bibliography
Qualitative Results - Temporal Layer
0/24 1
2
3
4
5
6
7
8
9
10
111213
14
15
16
17
18
19
20
21
22
23
+
KDE CAD
19 20 21 22 23 24
KDE Circular
Anomalies
Observations
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
Track: 758, Cluster: 1839 [-1]
KDE Circular
Anomalies
Observations
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0 21 22 23 24
KDE Circular
Anomalies
Observations
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Track: 715, Cluster: 2139 [-1]
KDE Circular
Anomalies
Observations
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
0
0.2
0.4
0.6
0.8
1
1.2
1.4
1.6
1.8
2

48. Introduction Methodology Results Conclusions and Future Work Bibliography
Quantitative Results - Temporal Layer
KDE CAD
Quantitative result of spatial anomalies detected by the Temporal layer

49. Introduction Methodology Results Conclusions and Future Work Bibliography
Datasets
Geolife Dataset
Microsoft Research
Area:
75km2
Period:
71 days
Dates:
Feb 9 - Apr 27, 2009

50. Introduction Methodology Results Conclusions and Future Work Bibliography
Qualitative Results - Spatial Layer
GeoLife: Each color represents one cluster

51. Introduction Methodology Results Conclusions and Future Work Bibliography
Qualitative Results - Temporal Layer
KDE CAD
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
0
0.2
0.4
0.6
0.8
1
1.2
1.4
Track: 405, Cluster: 239 [−1]
KDE Circular
Anomalies
Observations
0 5 10 15 20 25
0
2
4
6
8
NCM Track: 405, Cluster: 239 [−1]
Temporal Resolution
Alpha
0 5 10 15 20
0
0.5
1
CAD Probability Track: 405, Cluster: 239 [−1]
Temporal Resolution
p
CAD method creates narrower normality regions ( 30m) than KDE

52. Introduction Methodology Results Conclusions and Future Work Bibliography
Section 4
Conclusions and Future Work

53. Introduction Methodology Results Conclusions and Future Work Bibliography
Conclusions
1 New hierarchical model incorporating time-dependence was
proposed
2 Two methods for modelling temporal information were
implemented/compared
3 A CAD-NCM metric using circular distance for time was
proposed
4 KDE method showed an over-smoothing effect due to the
bandwidth selection method.
5 Spatial and Spatio-Temporal anomalies quantitatively and
qualitatively assessed against 2 datasets

54. Introduction Methodology Results Conclusions and Future Work Bibliography
Future Work
1 Proper way to forget!
2 Test other CAD-NCM’s: Entropy-based / Local Outlier Factor
(LOF)
3 Efficient on-line Kernel Density Estimation
4 Anomaly prediction using Long Short-Term Memory Networks

55. Introduction Methodology Results Conclusions and Future Work Bibliography
Thank you
Any questions ?

56. Introduction Methodology Results Conclusions and Future Work Bibliography
Section 5
Bibliography

57. Introduction Methodology Results Conclusions and Future Work Bibliography
Bibliography
Varun Chandola, Arindam Banerjee, and Vipin Kumar.
Anomaly detection.
ACM Computing Surveys, 41(3):1–58, 2009.
Douglas M Hawkins.
Identification of outliers, volume 11.
Springer, 1980.
Rikard Laxhammar and Goran Falkman.
Online learning and sequential anomaly detection in trajectories.
IEEE Transactions on Pattern Analysis and Machine Intelligence, 36(6):1158–1173, 2014.
C. Piciarelli and G. L. Foresti.
On-line trajectory clustering for anomalous events detection.
Pattern Recognition Letters, 27:1835–1842, 2006.

58. Introduction Methodology Results Conclusions and Future Work Bibliography
Spatial Model Learning
Matching
Match
Found?
Create Cluster
Update Cluster
Exiting
Cluster?
Near
End?
Split
no
yes
yes
no
Concatenate
Roots
Prune Dead
Clusters
Merge
Clusters
Model Learning: Left image show the cluster building process (Modified from [4]) executed every time a new trajectory point
is observed. Right image the maintenance process executed in batch. Developed in the VisionLab.
Distance Function
d(zi,C) = min
j
dist(zi,cj)
σ2
∀j ∈ 1,..,M (2)

59. Introduction Methodology Results Conclusions and Future Work Bibliography
Temporal Layer - Kernel Density Estimator
KDE Definition
ˆf (x;h) =
1
n
n
i=1
Kh(x−xi) (3)
KDE using von-Misses Kernel
ˆf (θ;v) =
1
n(2π)Ir(v)
n
i=1
evcos(θ−θi)
(4)
0/24 1
2
3
4
5
6
7
8
9
10
111213
14
15
16
17
18
19
20
21
22
23
+
0/24 1
2
3
4
5
6
7
8
9
10
111213
14
15
16
17
18
19
20
21
22
23
+