CEP-traj: An event-based solution to process trajectory data

In this day and age, there exists an increasing need for systems and architectures able to process spatio-temporal data in a timely way. As a result, this paper presents CEP-traj, a novel middleware to ease the development of real-time trajectory-based services based on the Complex Event Processing (CEP) paradigm. By means of an event-based approach, the present middleware is able to detect a set of generic patterns along with meaningful changes of an entity׳s movement. In order to prove its suitability and feasibility, a vessel abnormal-behaviour detection system has been developed on the basis of the middleware׳s features. Finally, both synthetic and real datasets have been used to test the accuracy and performance of the middleware and the detection system implemented on top of the Esper engine.     

Identifying shoplifting behaviors and inferring behavior intention based on human action detection and sequence analysis

Identification of abnormal behaviors affecting public safety (e.g., shoplifting, robbery, and stealing) is essential for preventing human casualties and property damage. Many studies have attempted to automatically identify abnormal behaviors by detecting relevant human actions by developing intelligent video surveillance systems. However, these studies have focused on catching predefined actions associated explicitly with the target abnormal behavior, which can lead to errors in judgment when such actions are undetected or inaccurately detected. To better identify abnormal behaviors, it is essential to understand a series of performed actions to capture behaviors’ pre- and post-indications (e.g., repeatably looking around and spotting CCTVs) and infer the intentions underlying such behaviors. Thus, in the present study, we propose a framework to identify abnormal behaviors through deep-learning-based detection of non-semantic-level human action components segmented with a window size of several seconds (e.g., walking, standing, and watching) and performing sequence analyses of the detected action components to infer behavior intentions. Then, we tested the applicability of the framework to the specific scenario of shoplifting, one of the most common crimes. Analysis of actual incident data confirmed that shoplifting intentions could be effectively gauged based on distinct action sequence features, and the intention inference results are continuously updated with the accumulated series of detected actions during the course of the input video stream. The results of this study can help enhance the ability of intelligent surveillance systems by providing a new means for monitoring abnormal behaviors and deeply understanding the underlying intentions.     

Hierarchical crowd analysis and anomaly detection

ObjectiveThis work proposes a novel approach to model the spatiotemporal distribution of crowd motions and detect anomalous events.MethodsWe first learn the regions of interest (ROIs) which inform the behavioral patterns by trajectory analysis with Hierarchical Dirichlet Processes (HDP), so that the main trends of crowd motions can be modeled. Based on the ROIs, we then build a series of histograms both on global and local levels as the templates for the observed movement distribution, which statistically describes time-correlated crowd events. Once the template has been built hierarchically, we import real data containing the discrete trajectory observations from video surveillance and detect abnormal events for individuals and for crowds.ResultsExperimental results show the effectiveness of our approach, which is able to analyze and extract the crowd motion information from observed trajectory dataset, and achieve the anomaly detection at the hierarchical levels.ConclusionThe proposed hierarchical approach can learn the moving trends of crowd both in global and local area and describe the crowd behaviors in statistical way, which build a template for pedestrian movement distribution that allows for the detection of time-correlated abnormal crowd events.     

Learning motion patterns in unstructured scene based on latent structural information

ContextAs trajectory analysis is widely used in the fields of video surveillance, crowd monitoring, behavioral prediction, and anomaly detection, finding motion patterns is a fundamental task for pedestrian trajectory analysis.ObjectiveIn this paper, we focus on learning dominant motion patterns in unstructured scene.MethodsAs the invisible implicit indicator to scene structure, latent structural information is first defined and learned by clustering source/sink points using CURE algorithm. Considering the basic assumption that most pedestrians would find the similar paths to pass through an unstructured scene if their entry and exit areas are fixed, trajectories are then grouped based on the latent structural information. Finally, the motion patterns are learned for each group, which are characterized by a series of statistical temporal and spatial properties including length, duration and envelopes in polar coordinate space.ResultsExperimental results demonstrate the feasibility and effectiveness of our method, and the learned motion patterns can efficiently describe the statistical spatiotemporal models of the typical pedestrian behaviors in a real scene. Based on the learned motion patterns, abnormal or suspicious trajectories are detected.ConclusionThe performance of our approach shows high spatial accuracy and low computational cost.     

基于数据挖掘的协议分析检测模型

针对现有入侵检测系统的不足,根据入侵和正常访问模式的网络数据表现形式的不同以及特定数据分组的出现规律,提出按协议分层的入侵检测模型,并在各个协议层运用不同的数据挖掘方法抽取入侵特征,以达到提高建模的准确性、检测速度和克服人工提取入侵特征的主观性的目的。其中运用的数据挖掘算法主要有关联挖掘、序列挖掘、分类算法和聚类算法。     

基于隐马尔科夫模型的用户行为异常检测方法

提出了一种基于HMM的用户行为异常检测的新方法,用shell命令序列作为审计数据,但在数据预处理、用户行为轮廓的表示方面与现有方法不同。仿真实验结果表明,本方法的检测效率和实时性相对较高,在检测准确率方面也有较大优势。     

一种基于时序分析异常数据的跌倒行为监测方法*

针对疑似跌倒行为在跌倒监测中经常造成误报的问题,提出了一种基于时间序列分析异常数据的跌倒监测方法。该方法对手机加速度信号进行时间序列分析,通过计算相邻时间窗口之间的相似度来检测异常数据,利用分类器算法对疑似跌倒行为与真实跌倒行为的异常数据样本进行分类。该跌倒监测方法准确率为95％,比传统跌倒监测的方法准确率提高19％,误报率下降5.3％。实验结果表明本方法是一种可行的跌倒监测方法。     

免疫算法在入侵检测数据预处理中的应用

基于聚类的入侵检测方法大都是以距离差异为基础的,而同等重要地依赖所有属性的相似性度量会引起误导。提出利用免疫算法确定网络数据属性的权重值的设计方法。采用二进制编码方式对网络数据的属性进行编码,并设计了抗体和抗原亲和力的评价算法。实验结果显示,该方法确定的权重值在检测入侵方面是可行的、有效的。     

Goal-based trajectory analysis for unusual behaviour detection in intelligent surveillance

In a typical surveillance installation, a human operator has to constantly monitor a large array of video feeds for suspicious behaviour. As the number of cameras increases, information overload makes manual surveillance increasingly difficult, adding to other confounding factors such as human fatigue and boredom. The objective of an intelligent vision-based surveillance system is to automate the monitoring and event detection components of surveillance, alerting the operator only when unusual behaviour or other events of interest are detected. While most traditional methods for trajectory-based unusual behaviour detection rely on low-level trajectory features such as flow vectors or control points, this paper builds upon a recently introduced approach that makes use of higher-level features of intentionality. Individuals in the scene are modelled as intentional agents, and unusual behaviour is detected by evaluating the explicability of the agent's trajectory with respect to known spatial goals. The proposed method extends the original goal-based approach in three ways: first, the spatial scene structure is learned in a training phase; second, a region transition model is learned to describe normal movement patterns between spatial regions; and third, classification of trajectories in progress is performed in a probabilistic framework using particle filtering. Experimental validation on three published third-party datasets demonstrates the validity of the proposed approach.     

Physical-barrier detection based collective motion analysis

Collective motion is one of the most fascinating phenomena and mainly caused by the interactions between individuals. Physical-barriers, as the particular facilities which divide the crowd into different lanes, greatly affect the measurement of such interactions. In this paper we propose the physical-barrier detection based collective motion analysis (PDCMA) approach. The main idea is that the interaction between spatially adjacent pedestrians actually does not exist if they are separated by the physical-barrier. Firstly, the physical-barriers are extracted by two-stage clustering. The scene is automatically divided into several motion regions. Secondly, local region collectiveness is calculated to represent the interactions between pedestrians in each region. Finally, extensive evaluations use the three typical methods, i.e., the PDCMA, the Collectiveness, and the average normalized Velocity, to show the efficiency and efficacy of our approach in the scenes with and without physical barriers. Moreover, several escalator scenes are selected as the typical physical-barrier test scenes to demonstrate the performance of our approach.Comparedwith the current collectivemotion analysis methods, our approach better adapts to the scenes with physical barriers.     

基于数据挖掘的网络入侵检测技术研究

现有NIDS的检测知识一般由手工编写,其难度和工作量都较大.将数据挖掘技术应用于网络入侵检测,在Snort的基础上构建了基于数据挖掘的网络入侵检测系统模型.重点设计和实现了基于K-Means算法的异常检测引擎和聚类分析模块,以及基于Apriori算法的关联分析器.实验结果表明,聚类分析模块能够自动建立网络正常行为模型,并用于异常检测,其关联分析器能够自动挖掘出新的入侵检测规则.     

聚类分析与模糊评判结合的入侵检测算法

针对K-prototypes聚类算法处理混合型入侵检测数据时易陷入局部最优且对初始值敏感的问题,提出了一种基于K-prototypes与模糊评判相结合的入侵检测方法,利用K-prototypes对数据进行统计归类,在聚类中建立模糊评判模型,从统计和特征两方面对数据进行双重判定。实验结果表明两种算法的有效结合,可以提高任一种算法单独使用时的检测性能,有效地提高了检测率,降低了误检率。     

基于数据挖掘的入侵检测系统智能结构模型

为了提高对拒绝服务攻击、内存溢出攻击、端口扫描攻击和网络非法入侵等发现的有效性以及对海量的安全审计数据能进行智能化处理,采用数据挖掘的方法从大量的信息中提取有威胁的、隐蔽的入侵行为及其模式.将数据挖掘的聚类分析方法与入侵检测系统相结合,提出了一种入侵检测系统的智能结构模型.实验表明,它能够有效地从海量的网络数据中进行聚类划分,找到相关的入侵数据,从而提高对各种攻击类型网络入侵检测的效率.     

一种基于数据流分析的网络行为检测

为了更好地对网络行为进行分析, 提出了一种基于数据流分析的网络行为检测方法。通过分析网络系统体系架构, 对网络行为进行形式化建模, 并针对网络行为特点提出了一种基于与或图的行为描述方法, 最终设计实现了基于数据流分析的网络行为检测算法。实验证明该方法能在多项式时间内完成数据流事件中的关系分析, 而且与其他算法相比, 能有效提高网络行为检测的查准率。     

一种基于聚类和协议分析的入侵检测方法

根据入侵检测中协议分析技术与聚类数据挖掘技术各自不同的检测特点,提出了一种新的入侵检测方法,将协议分析技术融合到聚类数据挖掘中。通过数据清洗和协议分析不但可以有效减少聚类挖掘的数据量,快速地检测出入侵行为,而且可以让被挖掘的数据更加符合聚类数据挖掘的先决条件,提高了聚类数据挖掘检测的效率。     

增量式SVM的数据流异常检测模型

针对网络数据流异常检测,既要保证分类准确率,又要提高检测速度的问题,在原有数据流挖掘技术的基础上提出一种改进的增量式学习算法.算法中建立多模型轮转结构,在每次训练中从几何角度出发求出当前训练样本集的支持向量,选择出分布于超平面间隔中的支持向量进行增量SVM训练.使用UCI标准数据库中的数据进行实验,并且与另外两种经典分类模型进行比较,结果表明了方法的有效性.     

TRASMIL: A local anomaly detection framework based on trajectory segmentation and multi-instance learning

Local anomaly detection refers to detecting small anomalies or outliers that exist in some subsegments of events or behaviors. Such local anomalies are easily overlooked by most of the existing approaches since they are designed for detecting global or large anomalies. In this paper, an accurate and flexible three-phase framework TRASMIL is proposed for local anomaly detection based on TRAjectory Segmentation and Multi-Instance Learning. Firstly, every motion trajectory is segmented into independent sub-trajectories, and a metric with Diversity and Granularity is proposed to measure the quality of segmentation. Secondly, the segmented sub-trajectories are modeled by a sequence learning model. Finally, multi-instance learning is applied to detect abnormal trajectories and sub-trajectories which are viewed as bags and instances, respectively. We validate the TRASMIL framework in terms of 16 different algorithms built on the three-phase framework. Substantial experiments show that algorithms based on the TRASMIL framework outperform existing methods in effectively detecting the trajectories with local anomalies in terms of the whole trajectory. In particular, the MDL-C algorithm (the combination of HDP-HMM with MDL segmentation and Citation kNN) achieves the highest accuracy and recall rates. We further show that TRASMIL is generic enough to adopt other algorithms for identifying local anomalies.     

Dust particle detection in traffic surveillance video using motion singularity analysis

Dust particle detection in video aims to automatically determine whether the video is degraded by dust particle or not. Dust particles are usually stuck on the camera lends and typically temporally static in the images of a video sequence captured from a dynamic scene. The moving objects in the scene can be occluded by the dusts; consequently, the motion information of moving objects tends to yield singularity. Motivated by this, a dust detection approach is proposed in this paper by exploiting motion singularity analysis in the video. First, the optical model of dust particle is theoretically studied in by simulating optical density of artifacts produced by dust particles. Then, the optical flow is exploited to perform motion singularity analysis for blind dust detection in the video without the need for ground truth dust-free video. More specifically, a singularity model of optical flow is proposed in this paper using the direction of the motion flow field, instead of the amplitude of the motion flow field. The proposed motion singularity model is further incorporated into a temporal voting mechanism to develop an automatic dust particle detection in the video. Experiments are conducted using both artificially-simulated dust-degraded video and real-world dust-degraded video to demonstrate that the proposed approach outperforms conventional approaches to achieve more accurate dust detection.     

一种Hadoop集群下的行为异常检测方法

随着分布式计算技术的发展,Hadoop成为大规模数据处理领域的典型代表,由于安全机制相对薄弱,缺少用户行为活动的监控,容易受到隐藏的安全威胁,如数据泄露等。结合主成分分析计算的特点,基于MapReduce对其做并行化处理,克服了传统主成分分析计算的缺点,提高了模型训练效率。提出了一种基于并行化主成分分析的异常行为检测方法,即比较当前用户的行为模式是否与历史行为模式相匹配作为判定用户行为异常与否的度量标准。实验表明该方法能够较好地发现用户的异常行为。     

基于递归神经网络局部建模的人群异常事件监测

针对密集人群建模困难、异常事件检测可靠性差等问题,提出了一种基于递归神经网络局部建模的人群异常事件监测与定位方法。该方法首先对人群场景进行网格划分,提取多尺度光流统计直方图特征,并按照一定规则进行特征选择,建立人群动态序列事件表示;然后采用递归神经网络对人群场景进行局部细粒度建模和预测;最后基于前后帧重构误差进行异常事件判定,实现异常事件的监测和定位。公共数据集UCSD上进行的对比实验结果验证了该方法的有效性。