11/11/051 ME A Novel Technique for Learning Rare Events Margaret H. Dunham, Yu Meng, Jie Huang CSE Department Southern Methodist University Dallas, Texas This material is based upon work supported by the National Science Foundation under Grant No. IIS

11/11/052 Objectives/Outline Develop modeling techniques which can “learn/forget” past behavior of spatiotemporal events. Apply to prediction of rare events. nIntroduction nEMM Overview nEMM Applications to Rare Event Detection nFuture Work

11/11/053 Objectives/Outline Develop modeling techniques which can “learn/forget” past behavior of spatiotemporal events. Apply to prediction of rare events. nIntroduction nEMM Overview nEMM Applications to Rare Event Detection nFuture Work

11/11/054 Spatiotemporal Environment nEvents arriving in a stream nCan not look at a snapshot of the data. nAt any time, t, we can view the state of the problem at a site as represented by a vector of n numeric values: V t = V2V2 V2V2 …V2V2 S1S1 S 11 S 12 …S 1q S2S2 S 21 S 22 …S 2q …………… SnSn S n1 S n2 …S nq Time

11/11/055 Spatiotemporal Modeling nExample Applications: n Flood Prediction n Rare Event Detection – Network traffic, automobile traffic nRequirements n Capture Time n Capture Space n Dynamic n Scalable n Quasi-Real Time

11/11/056 Technique nSpatiotemporal modeling technique based on Markov models. nHowever – n Size of MM depends on size of dataset n The required structure of the MM is not known at the model construction time. n As the real world being modeled by the MM changes, so should the structure of the MM. Thus not only should transition probabilities change, but the number of states should be changed to more accurately model the changing world.

11/11/057 MM A first order Markov Chain is a finite or countably infinite sequence of events {E1, E2, … } over discrete time points, where Pij = P(Ej | Ei), and at any time the future behavior of the process is based solely on the current state A Markov Model (MM) is a graph with m vertices or states, S, and directed arcs, A, such that: nS ={N 1,N 2, …, N m }, and nA = {L ij | i  1, 2, …, m, j  1, 2, …, m} and Each arc, L ij = is labeled with a transition probability P ij = P(N j | N i ).

11/11/058 Problem with Markov Chains nThe required structure of the MC may not be certain at the model construction time. nAs the real world being modeled by the MC changes, so should the structure of the MC. nNot scalable – grows linearly as number of events. nMarkov Property nOur solution: n Extensible Markov Model (EMM) n Cluster real world events n Allow Markov chain to grow and shrink dynamically

11/11/059 Objectives/Outline Develop modeling techniques which can “learn/forget” past behavior of spatiotemporal events. Apply to prediction of rare events. nIntroduction nEMM Overview nEMM Applications to Rare Event Detection nFuture Work

11/11/0510 Extensible Markov Model (EMM) nTime Varying Discrete First Order Markov Model nNodes are clusters of real world states. nLearning continues during application phase. nLearning: n Transition probabilities between nodes n Node labels (centroid/medoid of cluster) n Nodes are added and removed as data arrives

11/11/0511 Related Work nSplitting Nodes in HMMs n Create new states by splitting an existing state n M.J. Black and Y. Yacoob,”Recognizing facial expressions in image sequences using local parameterized models of image motion”, Int. Journal of Computer Vision, 25(1), 1997, nDynamic Markov Modeling n States and transitions are cloned n G. V. Cormack, R. N. S. Horspool. “Data compression using dynamic Markov Modeling,” The Computer Journal, Vol. 30, No. 6, nAugmented Markov Model (AMM) n Creates new states if the input data has never been seen in the model, and transition probabilities are adjusted n Dani Goldberg, Maja J Mataric. “Coordinating mobile robot group behavior using a model of interaction dynamics,” Proceedings, the Third International Conference on Autonomous Agents (agents ’99), Seattle, Washington

11/11/0512 EMM vs AMM Our proposed EMM model is similar to AMM, but is more flexible: nEMM continues to learn during the application (prediction, etc.) phase. nThe EMM is a generic incremental model whose nodes can have any kind of representatives. nState matching is determined using a clustering technique. nEMM not only allows the creation of new nodes, but deletion (or merging) of existing nodes. This allows the EMM model to “forget” old information which may not be relevant in the future. It also allows the EMM to adapt to any main memory constraints for large scale datasets. nEMM performs one scan of data and therefore is suitable for online data processing.

11/11/0513 EMM Extensible Markov Model (EMM): at any time t, EMM consists of an MM and algorithms to modify it, where algorithms include: nEMMSim, which defines a technique for matching between input data at time t + 1 and existing states in the MM at time t. nEMMBuild algorithm, which updates MM at time t + 1 given the MM at time t and classification measure result at time t + 1. Additional algorithms are used to modify the model or for applications.

11/11/0514 EMMBuild Input: V t = : Observed values at n different locations at time t. G: EMM with m states at time t-1. N c :Current state at time t-1. Output: G: EMM graph at time t. N c :Current state at time t. if G = empty then// Initialize G, first input vector is the first state N 1 = V t ; CN 1 = 0; N c = N 1 ; else// update G as new input comes in foreach N i in G determine EMMSim(V t, N i ); let N n be node with largest similarity value, sim; if sim >= threshold then// update matching state information CN c = CN c + 1; if L cn exists CL cn = CL cn + 1; else create new transition L cn = ; CL cn = 1; N c = N n ; else // create a new state N m+1 represented by V t create new node N m+1 ; N m+1 = V t ; CN m+1 = 0; create new transition L c(m+1) = ; CL c(m+1) = 1; CN c = CN c + 1 ; N c = N m+1 ;

11/11/0515 EMMSim nFind closest node to incoming event. nIf none “close” create new node nLabeling of cluster is centroid/medoid of members in cluster nProblem n O(n) n BIRCH O(lg n) Requires second phase to recluster initial

11/11/0516 EMMBuild <18,10,3,3,1,0,0><17,10,2,3,1,0,0><16,9,2,3,1,0,0><14,8,2,3,1,0,0><14,8,2,3,0,0,0><18,10,3,3,1,1,0.> 1/3 N1 N2 2/3 N3 1/1 1/3 N1 N2 2/3 1/1 N3 1/1 1/2 1/3 N1 N2 2/3 1/2 N3 1/1 2/3 1/3 N1 N2 N1 2/2 1/1 N1 1

11/11/0517 EMMDecrement N2 N1N3 N5N6 2/2 1/3 1/2 N1N3 N5N6 1/6 1/3 Delete N2

11/11/0518 EMM Advantages nDynamic nAdaptable nUse of clustering nLearns rare event nScalable: n Growth of EMM is not linear on size of data. n Hierarchical feature of EMM nCreation/evaluation quasi-real time nDistributed / Hierarchical extensions

11/11/0519 Growth of EMM Servent Data

11/11/0520 EMM Performance – Growth Rate DataSim Threshold Ser went Jaccrd Dice Cosine Ovrlap22334 Ouse Jaccrd Dice Cosine Ovrlap11111

11/11/0521 EMM Performance – Growth Rate Minnesota Traffic Data

11/11/0522 Error Rates nNormalized Absolute Ratio Error (NARE) NARE = nRoot Means Square (RMS) RMS =

11/11/0523 EMM Performance - Prediction NARERMS No of States RLF EMM Th= Th= Th=

11/11/0524 EMM Water Level Prediction – Ouse Data

11/11/0525 Objectives/Outline Develop modeling techniques which can “learn/forget” past behavior of spatiotemporal events. Apply to prediction of rare events. nIntroduction nEMM Overview nEMM Applications to Rare Event Detection nFuture Work

11/11/0526 Rare Event nRare - Anomalous – Surprising nOut of the ordinary nNot outlier detection n No knowledge of data distribution n Data is not static n Must take temporal and spatial values into account n May be interested in sequence of events nEx: Snow in upstate New York is not rare n Snow in upstate New York in June is rare nRare events may change over time

11/11/0527 Rare Event Examples nThe amount of traffic through a site in a particular time interval as extremely high or low. nThe type of traffic (i.e. source IP addresses or destination addresses) is unusual. nCurrent traffic behavior is unusual based on recent precious traffic behavior. nUnusual behavior at several sites.

11/11/0528 What is a Rare Event? nNot an outlier n We don’t know anything about the distribution of the data. Even if we did the data continues changing. A model created based on a static view may not fit tomorrow’s data. nWe view a rare event as: n Unusual state of the network (or subset thereof). n Transition between network states which does not frequently occur. nBase rare event detection on determining events or transitions between events that do not frequently occur.

11/11/0529 Rare Event Examples – VoIP Traffic nThe amount of traffic through a site in a particular time interval as extremely high or low. nThe type of traffic (i.e. source IP addresses or destination addresses) is unusual. nCurrent traffic behavior is unusual based on recent precious traffic behavior. nUnusual behavior at several sites.

11/11/0530 Rare Event Detection Applications nIntrusion Detection nFraud nFlooding nUnusual automobile/network traffic

11/11/0531 Rare Event Detection Techniques nSignature Based n Created signatures for normal behavior n Rule based n Pattern Matching n State Transition Analysis nStatistical Based n Profiles of normal behavior nData Mining Base n Classification n Clustering

11/11/0532 EMM Rare Event Prediction – VoIP Traffic nPredict rare events at a specific site (switch) representing an area of the network. nUse: n Identify when rare transition occurs n Identify rare event by creation of new node nHierarchical EMM: Collect rare event information at a higher level by constructing an EMM of more global events from several sites there.

11/11/0533 Our Approach nBy learning what is normal, the model can predict what is not nNormal is based on likelihood of occurrence nUse EMM to build model of behavior nWe view a rare event as: n Unusual event n Transition between events states which does not frequently occur. nBase rare event detection on determining events or transitions between events that do not frequently occur. nContinue learning

11/11/0534 EMMRare nEMMRare algorithm indicates if the current input event is rare. Using a threshold occurrence percentage, the input event is determined to be rare if either of the following occurs: n The frequency of the node at time t+1 is below this threshold n The updated transition probability of the MC transition from node at time t to the node at t+1 is below the threshold

11/11/0535 Determining Rare nOccurrence Frequency (OF c ) of a node N c as defined by: OF c = nLikewise when determining what is meant by small for a transition probability, we should look at a normalized rather than actual value. We, thus, define the Normalized Transition Probability (NTP mn ), from one state, N m, to another, N n, as: NTP mn =

11/11/0536 Ongoing/Future Work nExtend to Emerging Patterns nIncorporate techniques to reduce False Alarms nExtend to Hierarchical/Distributed

11/11/0537 Conclusion We welcome feedback