1 / 47

a n - PowerPoint PPT Presentation

Activity Discovery and Anomalous Activity Explanation Raffay Hamid, Amos Johnson, Samir Batta, Aaron Bobick, Charles Isbell, Graham Coleman Activity Discovery and Anomalous Activity Explanation Activity Discovery and Anomalous Activity Explanation

Related searches for a n

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.

PowerPoint Slideshow about 'a n ' - oshin

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

Raffay Hamid, Amos Johnson, Samir Batta, Aaron Bobick, Charles Isbell, Graham Coleman

• Anomaly - “deviation” from the “common” or “regular”

• Anomaly - “deviation” from the “common” or “regular”

• Key Questions:

• ‘representation’ of activities

• ‘regular’ activities

• ‘different’ from regular

• ‘explain’an anomaly

• Anomaly - “deviation” from the “common” or “regular”

• Key Questions:

• ‘representation’ of activities

• ‘regular’ activities

• ‘different’ from regular

• ‘explain’an anomaly

• Previous representations include:

• Stochastic Context Free Grammars

• Expectation Grammars

• …..

• Previous representations include:

• Stochastic Context Free Grammars

• Expectation Grammars

• …..

• Require some a priori information about activity structure

• Two pieces of information:

• content

• structure

• Drawing from Natural Language Processing – treating documents as bags of words

• Treat Activities as bags of event n-grams

• Extraction of global structural information using local event statistics

• Two pieces of information:

• content

• structure

• Drawing from Natural Language Processing – treating documents as bags of words –captures content well

• Treat Activities as bags of event n-grams

• Extraction of global structural information using local event statistics

• Two pieces of information:

• content

• structure

• Drawing from Natural Language Processing – treating documents as bags of words –captures content well

• Treat Activities as bags of event n-grams –captures activity structure

• Extraction of global structural information using local event statistics

• Two pieces of information:

• content

• structure

• Drawing from Natural Language Processing – treating documents as bags of words –captures content well

• Treat Activities as bags of event n-grams –captures activity structure

• Extraction of global structural information using local event statistics

• Anomaly - “deviation” from the “common” or “regular”

• Key Questions:

• ‘representation’ of activities

• ‘regular’ activities

• ‘different’ from regular

• ‘explain’an anomaly

• Anomaly - “deviation” from the “common” or “regular”

• Key Questions:

• ‘representation’ of activities

• ‘regular’ activities

• ‘different’ from regular

• ‘explain’an anomaly

- Occur frequently

- Are similar to each other

• Anomaly - “deviation” from the “common” or “regular”

• Key Questions:

• ‘representation’ of activities

• ‘regular’ activities

• ‘different’ from regular

• ‘explain’an anomaly

- Activity similarity

- Activity discovery

• Two types of differences

• core structural differences (csd)

• event frequency differences (efd)

• Sim (A,B) = w1*CSD(A,B) + w2*EFD(A,B)

• Properties:

• Identity

• Commutative

• Positive semi-definite

• Two types of differences

• core structural differences (csd)

• event frequency differences (efd)

• Properties:

• Identity

• Commutative

• Positive semi-definite

• Two types of differences

• core structural differences (csd)

• event frequency differences (efd)

• Properties:

• Identity

• Commutative

• Positive semi-definite

• Anomaly - “deviation” from the “common” or “regular”

• Key Questions:

• ‘representation’ of activities

• ‘regular’ activities

• ‘different’ from regular

• ‘explain’an anomaly

Activity similarity

- Activity discovery

• Recall: regular activities occur frequently and are similar to each other

• Activity Sub-Class Discovery - a Graphic Theoretic problem of finding maximal cliques in edge-weighted graphs

• Maximal Cliques: overall similarity between clique nodes greater than some value, addition of any other node would reduce the overall clique similarity

• Recall: regular activities occur frequently and are similar to each other

• Activity Sub-Class Discovery - a Graphic Theoretic problem of finding maximal cliques in edge-weighted graphs

• Maximal Cliques: overall similarity between clique nodes greater than some value, addition of any other node would reduce the overall clique similarity

• Recall: regular activities occur frequently and are similar to each other

• Activity Sub-Class Discovery - a Graphic Theoretic problem of finding maximal cliques in edge-weighted graphs

• Maximal Cliques: overall similarity between clique nodes greater than some value, addition of any other node would reduce the overall clique similarity

• Sequentially find maximal cliques in edge weighted graph of activities

• Activities different enough from all the regular activities are anomalies

• Sequentially find maximal cliques in edge weighted graph of activities

• Activities different enough from all the regular activities are anomalies

• Sequentially find maximal cliques in edge weighted graph of activities

• Activities different enough from all the regular activities are anomalies

• Anomaly - “deviation” from the “common” or “regular”

• Key Questions:

• ‘representation’ of activities

• ‘regular’ activities

• ‘different’ from regular

• ‘explain’an anomaly

• Anomaly - “deviation” from the “common” or “regular”

• Key Questions:

• ‘representation’ of activities

• ‘regular’ activities

• ‘different’ from regular

• ‘explain’an anomaly

Activity classification

- Anomaly detection

• Compute weighted similarity between a new activity T and previous class members as:

• Select membership sub-class as:

• Compute weighted similarity between a new activity T and previous class members as:

• Select membership sub-class as:

• Anomaly - “deviation” from the “common” or “regular”

• Key Questions:

• ‘representation’ of activities

• ‘regular’ activities

• ‘different’ from regular

• ‘explain’an anomaly

Activity classification

- Anomaly detection

• Define function

• Learn the detection threshold from training data

• Define function

• Represents the within-Class difference of the test activity w.r.t. previous class members

• Pick a particular threshold to detect anomalies

• Define function

• Represents the within-Class difference of the test activity w.r.t. previous class members

• Pick (learn) a particular threshold to detect anomalies

• Anomaly - “deviation” from the “common” or “regular”

• Key Questions:

• ‘representation’ of activities

• ‘regular’ activities

• ‘different’ from regular

• ‘explain’an anomaly

• Explanatory features:

• Consistent

• Frequent

• Explanation based on features that were:

• Deficientfrom an anomaly but were frequently and consistentlypresent in regular members

• Extraneous in an anomaly but consistently absentfrom the regular members

• Explanatory features:

• Consistent

• Frequent

• Explanation based on features that were:

• Deficientfrom an anomaly but were frequently and consistentlypresent in regular members

• Extraneous in an anomaly but consistently absentfrom the regular members

• Explanatory features:

• Consistent

• Frequent

• Explanation based on features that were:

• Deficientfrom an anomaly but were frequently and consistentlypresent in regular members

• Extraneous in an anomaly but consistently absentfrom the regular members

• One month worth of data:

• 5 days a week – 9 a.m. till 5 p.m.

• Event Vocabulary – 61 events

• 195 activities:

• 150 train activities + 45 test activities

Bird’s Eye View of

Experimental Setup

General Characteristics of

Discovered Activity Classes

• UPS Delivery Vehicles

• Fed Ex Delivery Vehicles

• Delivery Trucks – multiple packages delivered

• Cars and vans, only 1 or 2 packages delivered

• Motorized cart used to pick and drop packages

• Van deliveries – no use of motorized cart

• Delivery trucks – multiple people

General Characteristics of

Discovered Activity Classes

Few of the detected Anomalies

• UPS Delivery Vehicles

• Fed Ex Delivery Vehicles

• Delivery Trucks – multiple packages delivered

• Cars and vans, only 1 or 2 packages delivered

• Motorized cart used to pick and drop packages

• Van deliveries – no use of motorized cart

• Delivery trucks – multiple people

• Back door of delivery not closed

• (b) More than usual number of people

• (c) Very few vocabulary events performed

• Are the detected anomalous activities ‘interesting’ from human view-point?

Anecdotal Validation:

• Studied 7 users

• Showed each user 8 regular activities selected randomly

• Showed each user 10 test activities, 5 regular and 5 detected anomalous activities

• 8 out of 10 activity-labels of the users matched the labels of our system

• Probability of this match happening by chance is 4.4%

• House environment – Commercially available strain gages

• Five month worth of daily data (151 days):

• Event Vocabulary – 16 events

• 151 activities

Top View of

Experimental Setup

• Anomaly - “deviation” from the “common” or “regular”

• Key Questions:

• ‘representation’ of activities

• ‘regular’ activities

• ‘different’ from regular

• ‘explain’an anomaly

• Importance of semantically meaningful activity-classes?

• If not – can we construct a rules to translate computer-discovered classes to something human interpretable?