Distributed Anomaly Detection and Estimation over Sensor Networks: Observational-Equivalence and Q-Redundant Observer Design

TL;DR

This paper develops distributed anomaly detection methods for sensor networks, analyzing stateful and stateless approaches, and introduces Q-redundant observer design for robustness against sensor failures.

Contribution

It proposes probabilistic threshold design for anomaly detection and introduces Q-redundant observer design for fault tolerance in sensor networks.

Findings

Increasing window length may not reduce false alarms.

Distributed detection enables local fault isolation.

Q-redundant observers enhance robustness to sensor failures.

Abstract

In this paper, we study stateless and stateful physics-based anomaly detection scenarios via distributed estimation over sensor networks. In the stateful case, the detector keeps track of the sensor residuals (i.e., the difference of estimated and true outputs) and reports an alarm if certain statistics of the recorded residuals deviate over a predefined threshold, e.g., \chi^2 (Chi-square) detector. Instead, only instantaneous deviation of the residuals raises the alarm in the stateless case without considering the history of the sensor outputs and estimation data. Given (approximate) false-alarm rate for both cases, we propose a probabilistic threshold design based on the noise statistics. We show by simulation that increasing the window length in the stateful case may not necessarily reduce the false-alarm rate. On the other hand, it adds unwanted delay to raise the alarm. The distributed aspect of the proposed detection algorithm enables local isolation of the faulty sensors with possible recovery solutions by adding redundant observationally-equivalent sensors. We, then, offer a mechanism to design Q-redundant distributed observers, robust to failure (or removal) of up to Q sensors over the network.