Improving Mass-Based Anomaly Detection Using Half-Space Trees and Data Drift for Streaming Data

Anomaly detection is a key issue in wireless sensor networks. One of the most challenging aspects is to carefully specify a data region of ‘normal’ instances to identify anomalous ones. Determining this region and fine-tuning it to improve the anomaly classification, is a not a trivial task. This study is an extension of a previous work, it is based on Half-Space Tree classifier and mass estimation for anomaly detection. Our approach is divided into two phases: the training and the testing phases. It works at the level of a single sensor node and relies on the decision from neighboring sensor nodes to increase the reliability. The improvement was achieved by working on four subject matters: (1) choose split points to create the workspace trees, (2) extract a representative normal mass range and include the data drifting concept, (3) retrain the classification model which was not taken into consideration in our previous work, (4) involve neighboring sensor nodes in the decision making process to decide when to refine the normal range and when to re-build the model. The experiments results show that HS-Tree combined with our proposed work, form an effective combination in terms of time saving, memory space and f1-score.