Outlier Detection in Wireless Sensor Networks Using Machine Learning and Statistical Based Approaches

Wireless Sensor Networks (WSNs) that we know today are used in various domains including healthcare, agricultural industry, military, and environmental monitoring. In the healthcare industry, they are used to monitor the patients’ physical conditions, such as heartbeat and temperature, or to track patients and detect any unusual behavior, such as stroke or a fall. In a similar way, WSNs are used in the farming industry to automate many difficult tasks according to the need of farms, such as providing timely water supply, monitoring the temperature and the weather, or managing the use of fertilizers and pesticides. In the military, wireless sensors are used for surveillance, target tracking/soldier tracking, detection of snipers, and for many other purposes.

WSN consists of numerous interconnected small nodes that can be deployed in a distributed area of interest and can be self-configured. Every node is commonly built with a microcontroller, memory, power supply, radio, and an assortment of sensors. WSN nodes are typically tiny, inexpensive, and have limited amounts of energy, computing power, and storage [1]. In a WSN, nodes communicate wirelessly, collaborating to collect, process, and transmit large amounts of sensed data to selected gateway nodes, which may include base stations, cluster heads, or data mules. These gateway nodes, also known as sink points, allow for extra data processing and analysis.

Depending on the application type and the size of the WSN, data transmission can be accomplished through either a single-hop or a multi-hop approach. In a single-hop network, nodes communicate directly with a central node, limiting scalability and potentially requiring more power. In contrast, multi-hop networks allow communication through multiple intermediate nodes, providing scalability, energy efficiency, increased reliability, and redundancy.

In recent years, the efficiency of data collection in WSN has significantly increased with the integration of data mules [2, 3]. Data mules are mobile devices deployed to improve the effectiveness of data collection. These devices, whether in the form of robots or vehicles, have the ability to function in various environments, including aerial (drones), land-based (ground vehicles), or water-based (underwater vehicles). The primary function of data mules is to go around the sensor network and collect data from individual sensors or sensor clusters and submit it to the base station. Figure 1 shows a generic WSN model using data mules.

Even though WSNs have advanced a lot in recent years, they are still limited in what they can do because of the challenges they face. WSNs transmit their data with wireless links with no infrastructure and are prone to many failures, such as hardware failure or physical damage due to harsh environment [4]. There are many hardware constraints that WSNs face, such as limited power supply, low processing, and below average transmission units. These constraints make it very difficult for WSNs to add any additional functionality or carry out complex tasks at the node level, as WSNs must collect data using imperfect sensor nodes with limited resources and power supply. Thus, the data gathered from these nodes is prone to diverse faults, potentially resulting in abnormal data patterns within the monitoring domain. These data readings that deviate significantly from normal readings and are inconsistent with the rest of the data are called outliers which are also known as anomalous [5].

1.png

Figure 1. WSN model using data mules

Outlier detection is essential in WSNs as it plays a crucial role in maintaining data quality, system reliability, and facilitating well-informed decision-making. Its primary function is to identify anomalies and errors within sensor data, enabling early warning systems for abnormal conditions, optimizing resource utilization, and assisting in fault diagnosis.  The accuracy, resilience, and operating efficiency of WSNs are greatly enhanced in a variety of scenarios and applications by proactively detecting and addressing anomalies.

Outlier detection provides important benefits across various real-world applications such as healthcare, agriculture, military, and environmental monitoring. For instance, in healthcare, WSNs monitor crucial indicators like heart rate and temperature. In this case, the application of outlier detection assists in identifying irregularities in patient data, allowing early interventions for critical conditions. Similarly, in environmental monitoring applications, sensors continuously track parameters such as humidity and temperature in harsh regions, helping in the early detection of abnormal environmental changes. In military domain, outlier detection plays a vital role in identifying unusual activities such as unexpected movements or unauthorized access in sensitive areas.

Outliers in WSNs can be detected at different stages of the data transmission process. Outlier detection techniques can be categorized as centralized, distributed, or hybrid depending on where the outliers are detected. In a centralized approach [6], data is gathered from multiple nodes and sent to a central base station. Finding outliers in the received data is the responsibility of the central base station. By sending data to a central location, this technique improves the detection process but may result in increased communication overhead.  Outliers are identified at individual nodes or node clusters using a distributed approach [7]. By finding outliers closer to the data source, this decentralized approach intends to reduce transmission overhead. The hybrid approach utilizes diverse outlier detection algorithms to detect outliers at various locations in the network [8]. By combining the advantages of both distributed and centralized techniques, this approach seeks to improve overall outlier detection performance. Choosing between centralized, distributed, or hybrid approaches often involves deciding on trade-offs between communication overhead, computational efficiency, and network condition adaptability.

In WSN, Outlier detection methods can be categorized based on their underlying methodologies, mainly into statistical and machine methods [9-11]. Statistical methods involve analyzing the statistical properties of data such as mean, median, and z-score to identify outliers based on deviations from the expected distribution.  On the other hand, machine methods employ machine learning algorithms to learn patterns from the data and detect outliers by recognizing deviations from these learned patterns. Machine methods include nearest neighbor-based approaches, clustering approaches, Isolation Forests, Support Vector Machines, and others. Some of the mentioned outlier detection methods tend to be more power-efficient than others. Generally, statistical methods involve basic calculations that don't require an excessive amount of power, although the actual impact depends on the complexity of the statistical measures utilized.   On the other hand, machine learning-based methods typically involve intensive computations, potentially leading to higher power consumption [11]. Hence, when selecting outlier detection methods for WSNs, it's crucial to prioritize power efficiency to minimize energy consumption and extend the lifespan of sensor nodes without frequent battery replacements. This becomes particularly important when nodes are positioned in remote or challenging-to-access areas, making battery replacement more difficult. 

In WSNs, many researchers have shown that data transmission costs for sensor nodes are higher than computation costs because communication uses more energy than computation [12]. Traditional outlier detection methods have mainly been designed based on centralized approaches, in which all data collected by sensor nodes is transmitted to a base station or cluster head for preprocessing. In fact, most existing anomaly detection techniques assume the availability of extensive computational resources and centralized access to all data within the relevant domain. Although this methodology exhibits a reasonable detection rate, it also leads to higher energy usage and communication overhead, ultimately reducing network lifetime and blocking network traffic. Moreover, processing data only at the base station results in a single point of failure for network operations and delays in anomaly detection and response times, impacting time-sensitive applications such as security monitoring, disaster response, or industrial automation. Consequently, these centralized approaches are unsuitable for WSNs due to the energy constraints characteristic of WSNs. Correspondingly, distributed approaches offer significant benefits, such as reducing communication overhead, providing real-time response, and avoiding single points of failure within the network. However, they also come with certain limitations, including complexity, limited resources like processing power, memory, and energy, as well as potentially lower performance levels. Additionally, this approach faces communication constraints, such as substantial propagation delay, signal absorption, extreme path lengths, rapidly changing time-varying channels, noise, and diffusion. Therefore, communication cost is inherently a fundamental challenge for outlier detection approaches in WSNs. In other words, how to reduce communication costs to extend system lifetime and minimize network traffic in WSNs is a major challenge. Addressing this issue requires innovative approaches that balance the trade-offs between detection accuracy, energy efficiency, and communication overhead.

In this paper, we propose a two-step outlier detection technique for WSNs. At the sensor level, we apply a simple statistical method to address limited energy and computational power constraints. At the base station, we employ unsupervised machine learning to identify outliers that may have been missed at the sensor level. This approach aims to reduce communication overhead, optimize resource usage, and improve network performance and reliability. The objectives of the research can be defined as follows:

1. Minimize the energy consumption and communication costs in WSNs resulting from high data transmission costs between sensors and the centralized location, while maintaining accuracy comparable to centralized detection.

2. Prolong the operational lifespan of sensor nodes and the overall WSN by employing targeted outlier detection techniques aimed at reducing communication costs, reduce network traffic, and improve energy efficiency by efficiently identifying and addressing anomalies within the network.

3. Ensure real-time anomaly detection and response by integrating localized anomaly detection at the node level with centralized detection at the base station. This ensures timely detection and mitigation of anomalies, which is crucial for applications that require immediate response to maintain operational integrity and security.

By achieving these objectives, the study aims to enhance the efficiency, reliability, and sustainability of outlier detection techniques in WSNs, addressing key challenges related to communication costs, resource limitations, and real-time responsiveness.

The rest of the article is organized in various sections including, motivation in Section 2, literature review in Section 3, outlier detection algorithms in Section 4, data sets, analysis, and evaluation metrices in Section 5, results in Section 6 and conclusions in Section 7.

In this section, we highlight the most popular and recent studies proposed by researchers for outlier detection in WSNs.

Wang et al. [19] proposed an isolation-based distributed outlier detection framework using nearest-neighbor ensembles (iNNE). This framework consists of a local detector and a global detector. The local detectors are constructed in each node through iNNE algorithm, while the global detector is created combining local detectors from a node and its neighboring nodes. Experimental results showed enhanced detection accuracy and reduced false alarms compared to other techniques. However, limitations include reliance on static parameters and system complexity.

Miao et al. [20] formulated a distributed online one-class SVM algorithm where they use a random approximate function which maps the input data to low-dimension feature space to get a cost function. Then another cost function is created by adding sparse constraint to the previous one, stochastic gradient descent is then applied to this function to get two distributed functions do OCSVM and sparse doOCSVM. The proposed algorithms offer low misdetection rates and high true positive rates with minimal resource usage, ideal for resource-constrained of WSNs. However, challenges like implementation complexity and scalability need addressing for wider real-world deployment.

Poornima and Paramasivan [21] proposed an Online Locally Weighted Projection Regression (OLWPR) for anomaly detection in WSNs, utilizing PCA for dimensionality reduction. LWPR regression predicts sensor values, compared to actual readings, with error determined using a dynamic threshold. Achieving an 86% detection rate and 16% error rate, the method exhibits high detection rates and few false alarms. However, its efficacy may depend on training data quality, facing challenges in computational complexity and scalability.

Gupta et al. [22] utilize the Outlierness Factor-based on Neighbourhood (OFN) technique to analyze and detect the outliers in sensor network. In the proposed approach, the initial step involves determining the neighborhood points, followed by the calculation of the weight assigned to the neighborhood data. The (OFN) technique is applied to categorize outlier data points into events and errors. This classification is based on spatial correlations, representing neighborhood readings, and temporal correlations, representing timestamps of readings. The performance of the proposed approach was evaluated on a real dataset. While the proposed technique showcases notable strengths in efficiency compared to previously considered approaches, it also exhibits potential weaknesses such as sensitivity to parameter settings and the complexity of real-time adaptability to dynamic environmental conditions.

Thangaramya et al. [23] introduced a secured WSN communication model using fuzzy temporal clustering and trust analysis. Their method enhances routing security by identifying malicious nodes and improves communication reliability, packet delivery, delay, and energy consumption. However, implementation complexity and scalability challenges persist, and there's a lack of comparison with other mechanisms regarding outlier detection's impact on packet delivery.

Zidi et al. [24] propose a two-phase detection technique using Support Vector machine. In the first phase a decision function along with support vectors are established in anticipated time, which is then fed to cluster head to classify data. In phase two an observation vector is created using the last three data measurements on which the decision function is applied. If the result is positive the data is correct otherwise it is considered an anomaly. The algorithm provides the most detection accuracy as compared to other algorithms used in the experiment with an accuracy of more than 99%. Despite its resource-efficient nature, SVM-based fault detection may encounter complexities in implementation and parameter tuning, potentially affecting its performance in dynamic and nonlinear scenarios.  Nevertheless, its adaptability and validation in real-world applications highlight its suitability for practical deployment in wireless sensor networks.

Yu et al. [25] proposed an unsupervised contextual outlier detection method in WSNs. The method identifies outlier correlations based on contextual spatial and temporal neighbor values using DBSCAN and Grid partitioning. The experimental results demonstrate that this method can accurately and efficiently detect not only individual anomalies but also anomalous events. The proposed method for anomaly detection in WSNs demonstrates adaptability and comprehensive detection capabilities. However, its effectiveness relies on the selection of clustering method, which has a certain influence on the detection results.

Chander and Kumaravelan [12] proposed a two-step approach for secure routing and outlier detection in WSNs. First, the fuzzy rule and cluster-based secured routing with outlier detection (FRCSROD) algorithm secures communication. Second, the fuzzy rule and distance-based outlier detection algorithm (FRDOA) identifies malicious nodes. This approach enhances security, reliability, and packet delivery rates while reducing communication delays. However, the complexity may increase computational overhead and impact scalability and resource use.

5.2 Analysis

In this research we propose a two-phase detection technique to detect outliers in WSNs. Phase one is performed on the sensor nodes in which outliers above a certain threshold are removed from the data set. Phase two will be performed at the base station, here we will be using a machine learning algorithm to further detect outliers that were not detected in phase one. We used five different unsupervised machine learning algorithms to detect outliers to check the performance of algorithms when combined with standard deviation.

To assess the effectiveness of the proposed approach in terms of their ability to detect outliers in a WSN, two types of analyses were performed.

EXPERIMENT 1: The aim of the initial experiment was to evaluate the effectiveness of various machine learning algorithms in terms of their ability to detect outliers at the base station. Here we performed five different unsupervised machine learning algorithms OCSVM, HBOS, IForest, KNN, and CBLOF. Unsupervised machine learning algorithms are used as they require no labeled inputs to train the algorithm and it can detect hidden patterns in a dataset on its own. On other hand, supervised machine learning needs labelled inputs and outputs to train the algorithm and learn overtime. Therefore, unsupervised machine learning is more suitable for WSNs as WSNs are randomly deployed into nature where the availability of labelled historical data is sometimes not possible.

This experiment involved two main phases: the training phase and the testing phase. In the training phase, classifiers were trained using all observations including both normal and anomalous observations, without the use of labels. During the testing phase, all observations are categorized into either the normal data class or the anomaly class based on the previously trained model. In this process, the classifier assigns labels to each observation based on its predictions, distinguishing between normal and anomalous instances.

Throughout the testing process, the classifiers recorded the number of True Positives (TPs), True Negatives (TNs), False Positives (FPs), and False Negatives (FNs). These recorded values are then used to calculate performance metrics mentioned in the next subsection, offering a comprehensive evaluation of the classifiers' performance.

EXPERIMENT 2: The aim of the experiment was to evaluate the effectiveness and the performance of the proposed two-phase detection approach to compare it with the centralized approach at detecting anomalies in WSNs. This experiment has two phases. In the first phase on sensor nodes, outliers above a threshold are removed. The second phase at the base station uses a machine learning algorithm to identify undetected outliers from phase one.

Phase 1: At the node level we used simple standard deviation to mark any reading that is two standard deviations away from the mean to be labelled as an outlier and we removed those reading form the datasets (the value of standard deviation can be set according to the environment the network will be configured in). The remining data that was not removed will then be used in step two to detect further anomalies that were not able to be detected in phase one. The aim of this phase is to minimize the number of outliers by setting a range depending on the environment the sensor is in, which will decrease the number of readings to be sent to the base station.

Phase 2: At the base station, where more power resources are available, we performed the same machine learning algorithms we used in experiment 1 to detect outliers in the dataset that were not detected in phase one. This phase involved training classifiers on all observations (normal and anomalous) without labels. In the testing phase, the classifier categorized observations into normal or anomaly classes. In the testing phase, we recorded True Positives (TPs), True Negatives (TNs), False Positives (FPs), and False Negatives (FNs) to compute performance metrics.

The proposed algorithm works through the following steps:

1. Read the dataset.

2. Calculate upper and lower limits for the dataset based on the mean and standard deviation.

3. Find data points in the dataset that fall outside the calculated upper and lower limits.

4. Create a subset containing only the data points that are inside the calculated upper and lower limits.

5. Initialize Features and Labels on the cleaned dataset.

6. Initialize Model

7. Fit the Model: Train the model on the feature data.

8. Use the trained model to predict outliers in the feature data.

9. Calculate various performance metrics such as accuracy, true positive rate (TPR), false positive rate (FPR), and Matthew’s correlation coefficient (MCC).

Machine learning algorithms for outlier detection were implemented using the PyOD package [33], a specialized Python package designed for anomaly detection. Default parameter values are employed in each machine learning approach.

5.3 Evaluation metrices

In the context of outlier detection, a confusion matrix is used to assess the effectiveness of the outlier detection model. Unlike traditional binary classification settings, outlier detection focuses on finding instances that substantially vary from the norm. The confusion matrix for outlier detection typically includes the following components:

·True Positive (TP): Instances that are actual outliers and are correctly identified as outliers by the model.

·False Positive (FP): Instances that are not outliers but are incorrectly identified as outliers by the model.

·Ture Negative (TN): Instances that are not outliers and are correctly identified as non-outliers by the model.

·False Negative (FN): Instances that are actual outliers but are incorrectly identified as non-outliers by the model.

These values are then used to calculate performance metrics like accuracy, false positive rate (FPR), and true positive rate (TPR), which offers a concise overview of a model's performance. To evaluate the performance of the algorithms that we used in this research, we have used four evaluations metrices.

a) Detection Accuracy (DA): which is calculated as the number of predictions that were correctly classified by the algorithm. It is defined as:

$Accuracy =\frac{T P+T N}{T P+T N+F P+F N}$                 (1)

b) True Positive Rate, which is the measure of how many positive cases were positive in actual. It is defined as:

$T P R=\frac{T P}{T P+F N}$                  (2)

c) False Positive Rate. which is the measure of positive outcomes that were considered incorrect. It is defined as:

$F P R=\frac{F P}{F P+T N}$                 (3)

d) Matthew’s correlation coefficient (MCC), and it measures the difference between actual value and predicted value. It is defined as:

$\mathrm{MCC}=\frac{T P * T N-F P * F N}{\sqrt{}(T P+F P)(T P+F N)}$                   (4)