Filtering Approaches for Dealing with Noise in Anomaly Detection

TL;DR

This paper explores how filtering techniques can improve residual-based anomaly detection methods, especially in noisy environments, and discusses their effectiveness against stealthy attacks.

Contribution

It introduces filtering approaches to enhance residual-based detectors and compares their performance with traditional methods in noisy and attack scenarios.

Findings

Filtering improves detection accuracy in noisy conditions

Filtered methods can outperform traditional residual-based detectors

Stealthy attack impact varies with filtering strategies

Abstract

The leading workhorse of anomaly (and attack) detection in the literature has been residual-based detectors, where the residual is the discrepancy between the observed output provided by the sensors (inclusive of any tampering along the way) and the estimated output provided by an observer. These techniques calculate some statistic of the residual and apply a threshold to determine whether or not to raise an alarm. To date, these methods have not leveraged the frequency content of the residual signal in making the detection problem easier, specifically dealing with the case of (e.g., measurement) noise. Here we demonstrate some opportunities to combine filtering to enhance the performance of residual-based detectors. We also demonstrate how filtering can provide a compelling alternative to residual-based methods when paired with a robust observer. In this process, we consider the class of attacks that are stealthy, or undetectable, by such filtered detection methods and the impact they can have on the system.