Anomaly Detection in Logical Sub-Views of WSNs

Abstract

Wireless sensor networks are often distributed, diverse, and large making their monitoring hard. One way to tackle it is to focus on part of the system by creating logical sub-views which can be seen as proxies of the overall system operations. In this manuscript, logical sub-views consist of traffic aggregators and their topology which are monitored for anomaly. The aggregators are selected based on diversity and importance in the system and they are modelled as graphs to capture aggregation topology and data distributions. The aggregators' selection criteria, the method for comparison of partially overlapping sub-views, normal aggregation profiles acquisition, and measures of anomaly are proposed. A simulated wireless sensor network is used to acquire data at the edge and apply the method to demonstrate that focusing on system sub-views and comparing aggregation profiles facilitates anomaly detection also caused elsewhere in the system and the impact the anomaly has on aggregators.