Abstract
Novelty, or abnormality, detection aims to identify patterns within data streams that do not conform to expected behaviour. This paper introduces novelty detection techniques using a combination of Gaussian processes, extreme value theory and divergence measurement to identify anomalous behaviour in both streaming and batch data. The approach is tested on both synthetic and real data, showing itself to be effective in our primary application of maritime vessel track analysis.
Similar content being viewed by others
References
Basseville M (1989) Distance measures for signal processing and pattern recognition. Signal Process 18(4):349–369
Budzynski R, Kondracki W, Krolak A (2008) Applications of distance between probability distributions to gravitational wave data analysis. Class Quantum Gravity 25(1):015005
Coles S (2001) An introduction to statistical modelling of extreme values. Springer, UK
George J, Crassidis J, Singh T et al (2011) Anomaly detection using content-aided target tracking. J Adv Inf Fusion 6(1):39–56
Grubbs F (1969) Procedures for detecting outlying observations in samples. Technometrics 11(1):1–21
Hartikainen J, Särkkä S (2010) Kalman filtering and smoothing solutions to temporal Gaussian process regression models. In: Proceedings of IEEE international workshop on machine learning for signal processing (MLSP). Kittilä, Finland, pp 379–384
Lane R, Nevell D, Hayward S et al (2010) Maritime anomaly detection and threat assessment. In: Proceedings of 13th conference on information fusion (FUSION). Edinburgh, UK, pp 1–8
Laws K, Vesecky J and Paduan J (2011) Monitoring coastal vessels for environmental applications: application of Kalman filtering. In: Proceedings of 10th current, waves and turbulence measurements (CWTM). Monterey, CA, USA, pp 39–46
Laxhammar R (2008) Anomaly detection for sea surveillance. In: Proceedings of 11th international conference on information fusion. Cologne, Germany, pp 1–8
Laxhammar R, Falkman G, Sviestins E (2009) Anomaly detection in sea traffic—a comparison of the Gaussian mixture model and the Kernel density estimator. In: Proceedings of 12th international conference on information fusion. Seattle, WA, USA, pp 756–763
Lee H, Roberts S (2008) On-line novelty detection using the Kalman filter and extreme value theory. In: Proceedings of 19th international conference on pattern recognition. Tampa, Florida, USA, pp 1–4
Li X, Han J, Kim S (2006) Motion-alert: automatic anomaly detection in massive moving objects. In: Proceedings of IEEE intelligence and security informatics. San Diego, CA, USA, pp 166–177
Markou M, Singh S (2003) Novelty detection: a review—Part 1: statistical approaches. Signal Process 83(12):2481–2497
Mascaro S, Nicholson A, Korb K (2011) Anomaly detection in vessel tracks using Bayesian networks. In: Proceedings of eighth UAI Bayesian modeling applications workshop. Barcelona, Spain, pp 99–107
Miller S, Miller W, McWhorter P (1992) Extremal dynamics: a unifying physical explanation of fractals, 1/f noise, and activated processes. J Appl Phys 73(6):2617–2628
Osborne M (2010) Bayesian Gaussian processes for sequential prediction, optimisation and quadrature. University of Oxford, UK, pp 49–54, pp 79–90
Pinheiro J, Bates D (1996) Unconstrained parameterizations for variance-covariance matrices. Stat Comput 6(3):289–296
Porter M, Onnela J, Mucha P (2009) Communities in networks. Notices Am Math Soc 56(9):1082–1097
Psorakis I, Roberts S, Ebden M et al (2011) Overlapping community detection using Bayesian non-negative matrix factorization. Phys Rev E 83(6):066114
Psorakis I, Rezek I, Roberts S et al (2012) Inferring social network structure in ecological systems from spatio-temporal data streams. J R Soc Interface 9(76):3055–3066
Rasmussen C, Williams C (2006) Gaussian processes for machine learning. MIT Press, USA
Reece S, Roberts S (2010) The near constant acceleration Gaussian process kernel for tracking. IEEE Signal Process Lett 17(8):707–710
Reece S, Mann R, Rezek I et al (2011) Gaussian process segmentation of co-moving animals. In: Proceedings of AIP conference proceedings. Chamonix, France, pp 430–437
Rhodes B, Bomberger N, Seibert M et al (2005) Maritime situation monitoring and awareness using learning mechanisms. In: Proceedings of military communications conference. Atlantic City, NJ, USA, pp 646–652
Roberts S (2000) Extreme value statistics for novelty detection in biomedical signal processing. In: Proceedings of first international conference on advances in medical signal and information processing. University of Bristol, UK, pp 166–172
Simpson E, Roberts S, Psorakis I et al (2013) Dynamic Bayesian combination of multiple imperfect classifiers. In: Guy T, Karny M, Wolpert D (eds) Decision making and imperfection. Springer, New York, pp 1–35
Will J, Peel L, Claxton C (2011) Fast maritime anomaly detection using Kd-Tree Gaussian processes. In: Proceedings of IMA maths in defence conference. Swindon, UK
Acknowledgments
This work was funded by ISSG, Babcock Marine and Technology Division, Devonport Royal Dockyard. Ioannis Psorakis is funded from a grant via Microsoft Research, for which we are most grateful. This work was further supported by EPSRC project EP/I011587/1.
Author information
Authors and Affiliations
Corresponding author
Appendix
Appendix
Derivation of the Hellinger metric, Eq. 15.
The squared Hellinger distance is a measure of similarity between two probability distributions and is defined as
where \(f\left( \varvec{x}\right) \) and \(g\left( \varvec{x}\right) \) denote probability distributions. Equation 16 can alternatively be expressed as
In the instance distributions \(f\left( \varvec{x}\right) \) and \(g\left( \varvec{x}\right) \) are multivariate Gaussian, the Hellinger distance would take the form
The terms inside the exponents can also be combined and expressed in quadratic form, \((\varvec{x}-\varvec{\mu }^{*})^{\top }\varvec{C}^{-1}(\varvec{x}-\varvec{\mu }^{*})+\varvec{B}\), by making the following associations
The integral can now be solved and the expression simplified
Under the assumption that both distributions have the same zero mean, \(\varvec{\mu }_f=\varvec{\mu }_g=\varvec{0}\), this can be further simplified
To avoid the inverse covariances in this form, the fraction can be multiplied top and bottom by \(\left( |\varvec{\Sigma _{f}}||\varvec{\Sigma _{g}}|\right) ^{-\frac{1}{2}}\), in addition to the application of the determinant identity \(|\varvec{AB}|=|\varvec{A}||\varvec{B}|\), thus
It can be noted, as a means of verifying the result, that by setting \(\varvec{\Sigma }=\sigma ^{2}\), the form is consistent with the Hellinger distance between two univariate Gaussian distributions when \(\mu _{f}=\mu _{g}=0\) namely
Rights and permissions
About this article
Cite this article
Smith, M., Reece, S., Roberts, S. et al. Maritime abnormality detection using Gaussian processes. Knowl Inf Syst 38, 717–741 (2014). https://doi.org/10.1007/s10115-013-0685-z
Received:
Revised:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s10115-013-0685-z