on an intrusion-detection approach via adaptive prediction

1. Introduction

On An Intrusion-DetectionApproach ViaAdaptive Prediction

N. AHMED, Senior Member, IEEE

R.J. FOGLER

D.L. SOLDAN, Student Member, IEEEKansas State University

G.R. ELLIOTT

N.A. BOURGEOIS, Senior Member, IEEESandia Laboratories

Abstract

We introduce the notion of using adaptive (digital) prediction

in an intrusion-detection application, where stimuli due to in-

truders are transient signals. The basic idea is to use an

adaptive digital predictor for removing correlated noise. As

such, this approach assists in reducing false (nuisance)

alarms in the absence of intruder stimuli. It also yields an

improvement in signal-to-noise ratio when intruder stimuli

are present, thereby assisting in their detection.

The performance of this approach is assessed in terms

of a fixed-point arithmetic simulation. Some aspects of a

corresponding hardware implementation that involves a com-

mercial microprocessor are also included.

Manuscript received July 24, 1978; revised December 20, 1978.

This work was supported by the Base and Installation SecuritySystems Programs Office, Electronic Systems Division of the AirForce Systems Command, Hanscom Air Force Base, MA 01731.Some of the material included in this paper was presented at a

Digital Signal Processing Symposium held at Sandia Laboratories,Albuquerque, NM, Dec. 6-7, 1977.

Authors' addresses: N. Ahmed, R.J. Fogler, and D.L. Soldan,Department of Electrical Engineering, Kansas State University,Manhattan, KS 66506; G.R. Elliott and N.A. Bourgeois, SandiaLaboratories, Organization 1736, Alburquerque, NM 87115.

0018-9251/79/0500-0430 $00.75 1979 IEEE

In recent years there has been a growing interest inadaptive filtering techniques. Much of the activitycenters around the development of algorithms forcontrolling the parameters of the adaptive filter. Themost widely used is Widrow's least-mean-square(LMS) algorithm [1]. This paper concerns an applica-tion of the LMS predictor to improve the perfor-mance of perimeter sensors for intrusion detection insecurity systems [2-5]. Such sensors are buried cablesalong the perimeter of an area to be protected. Theresponse (output) of a cable to a signal sourcedepends upon the type of source and its proximity tothe source.

Perimeter sensors commonly respond not only tointruder stimuli, but also to a variety of other stimuli(e.g., noise sources), resulting in poor signal-to-noiseratio (SNR). Intruder stimuli are transient signals, asexemplified in Fig. 1. The noise may be eitherperiodic or random, or a combination of both. Sincethe random noise encountered is generally stationaryonly on a short-term basis, we consider an adaptiveapproach which employs an adaptive digital predictor(ADP). The basic idea is to use the ADP for remov-ing correlated noise. As such, this approach assists inreducing false (nuisance) alarms in the absence of in-truder stimuli. It also yields an improvement in SNRwhen intruder stimuli are present, thereby assisting intheir detection.

The performance of this approach is assessed interms of a fixed-point arithmetic simulation, wherethe ADP is implemented via the LMS algorithm [1].For the purpose of illustration, a simple movingaverage filter (MAF) is employed as a detector; seeFig. 2. Some aspects of a corresponding hardware im-plementation involving a commercial microprocessorare also included.

11. ADP Fundamentals [6, 7]

Let f(t) be a stationary signal with mean 0 andvariance a2 which is sampled at times t1, t2, ..., ti, ...

and let fi, f2, ..., fi, ... denote the correspondingsampled values. For convenience, we consider the casewhen the delay A indicated in Fig. 1 is unity. Then, alinear estimate gm of the current sample fm based onthe previous N samples is given by

(1)gm = bifm-i + b2fm-2 + * - + bNf,,,-N

where bi is the ith predictor coefficient (weight). Wenote that the mean value of g,m, is 0.

The corresponding error sample is thus given byem fM -gJm . (2)

The desired predictor weights are obtained by minimiz-ing the mean-square error (mse)

IEEE TRANSACTIONS ON AEROSPACE AND ELECTRONIC SYSTEMS VOL. AES-15, NO.3 MAY 1979430

60

0

-30

0 0.5

Fig. 1. Example of intruder stimulus caused by intruder (walker) crossing sensor (cable)once; sampling frequency = 128 Hz.

ADP

1--- -- ---- - - ------fm m I~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Input

I I~~~~~~~~~~~~/. l--Fig. 2. Intrusion detection model.

e2 =E{e2} =E{(fm _gm)2} (3) Thus, assuming that R in (5) is nonsingular, the weightvector of the optimum ADP is given by

with respect to bi, where E denotes statistical expecta-tion. This minimization process leads to the followingset of equations:

b = R-'c.

T_J= 1 rijbj=--rio, i= 1, 2, ..N (4)

where rij = EVfm ifmj} denote the covariances of theinput and can be found from the autocorrelationfunction tp(T) of the signal itself, i.e., rij = tp(tj - ti).

Equation (4) can be written in matrix form as

Rb = c (5)

where bT = [b1, b2, ..., bN] is the weight vector, R isan (N x N) autocorrelation matrix, and c is an (N x 1)cross-correlation vector. R and c in (5) are as follows:

It can be shown that the mse in (3) can be expressedin terms of the autocorrelation coefficients and theADP weights given by (8) as

2em = roo- [br10 + b2r20 + + bNrNO].

Since the mean value of em in (2) is 0, it follows that2 2 2Sem = ae, where o2 is its variance. Again, roo equals the

input variance of. Thus

2 2Ge = Of - [b1r1o + b2r20 + ... + bNrNOJ.-

r1 r12

r2l r22R=

[rNl rN2

and

r.3... rlN

r23 r2N

rNN

CT = [r10 r20 ... rNOI.

An important property of the ADP is that the er-

(6) ror sequence {e,} is less correlated and has a smallervariance than the input sequence {f} by the amountshown in the parentheses in (9). As such, the ADP inFig. 2 serves to decorrelate (as much as possible) thenoise input to it. Some noise decorrelation examples

(7) will be presented in Section IV.

AHMED ET AL.: ON AN INTRUSION-DETECTION APPROACH VIA ADAPTIVE PREDICTION

(8)

(9)

.......................... .............................. .............. .............. ..............

-------------- ............................. ------------ --------------- --------------

.............. ....... .... ......................................... .............. ------------

.............................. .............. .............................

431

(a inpu t PDS: Aircraft

.~~~~ 2

(bt Output PDS

d 32 Hz

(c) Input PDS: Heavy Equipment

32 Hz

] d ) Output PD>S

0 32 Hz

X (e) Input PDS: Truck

o

0 32 Hz

(f) Output PDS~~~~~~~~. . _ H(g) Input PDS: Car

.~~~~ SO0 32 Hz

Ih) Outut PDS

Q 32 Hz

( i) Input PDS: Wind

(j) Output PDS

332 Hz

Fig. 3. Examples of decorrelation of various noise sources with 16-weight ADP.

111. ADP Implementation

We implement the ADP discussed above usingWidrow's LMS algorithm [1]. Accordingly, the ADPcoefficients are updated using the relation

b,,,±lk = b,,7A +k f,,,_A.:,, k - 1, 2, ..., N(10)

where v is the convergence parameter. Assuming astationary input to the ADP, the solution for the ex-pected value of the coefficient vector bm at the mthiteration is given by [8]

E{bm} = (I vR)t bo + R-1[I- (I vR)m]c (11)

where 1T = [bl,,,, b2,.l*-- bNIJ,]; bo is the initialweight vector, I is the identity matrix, and R and care defined in (5).

The quantity E{b,m in (11) converges to the desiredsolution R-'c given in (8). nrovided v satisfies the con-dition [see 4] 0 < v < 2/max Ai, i = 1, 2, ..., N, whereAi denotes the ith eigenvalue of R.

The parameter v in (10) determines the rate ofadaptation. In addition, v also has an effect on thecoefficient variance, since the coefficient adaptation isstochastic. Consequently, even though their expectedvalues converge to the correct value, their variancescontribute to a certain amount of degradation. Thecorresponding fractional increase of the mse relativeto the optimum e. in (9) is given by [1]

F= (v/2) l At. (12)

Equation (12) implies that small values of v, andhence long time constants, will minimize the aboveerror.

In the remainder of this paper any reference to theADP will imply that its weights are updated via theLMS algorithm in (10).

IV. ADP Noise Decorrelation Examples

We demonstrate the noise decorrelation property(i.e., removal of correlated noise) of the ADP bypresenting examples involving the following types ofnoise sources: 1) aircraft, 2) vehicular, 3) heavy equip-ment, and 4) wind. In each case, the power densityspectrum (PDS) of the noise input to the ADP andthe corresponding output PDS are included.

The results are summarized in Fig. 3(a) throughFig. 3(j). The data were sampled at 128 samples persecond and were acquired at different sites via aspecial purpose digital data acquisition system. Thedecorrelation effect of the ADP is apparent from thefact that the output PDS in each case is relatively flatcompared to the corresponding input PDS. In otherwords, the ADP output tends to be bandlimited whitenoise.

V. Detection Considerations

Detection at the output of the ADP can be at-tempted via classical data smoothing methods, an ex-cellent discussion of which is available in [9]. For thepurpose of illustration, we consider an MAF which issimple to implement. The underlying idea of this filteris that uncorrelated noise samples will average out[101.

The MAF output is denoted by qm; see Fig. 2. It isassumed that its input (i.e., the ADP output) consistsof zero-mean uncorrelated noise samples with varianceao Thus E{e;} = 0 and

( 0, i jE{eie.}-= 2

oe Z J-

The MAF computes the average of L samples to ob-tain the sample mean random variable


I . . I X . I X W .

vk*%V APAA . ioAoAIU-AA(a) Input

(b) MAF output

(c) ADP-MAF col

_o- -o ,pt

ibination output;

8

N=16, v = .0001

o 1.

seconds 16

Fig. 4. Effect of not using predictor to decorrelate noiseprior to MAF stage.

32

0

Hz

32 Hz

Fig. 5. PDS of input noise to predictor, and correspondingoutput.

MAF combination output in Fig. 4(c) does not. Thisis because the input noise is appreciably correlated.This correlation is reduced by a 16-weight ADP,which is apparent from the corresponding input andoutput PDSs shown in Fig. 5. Hence, the overall out-put of the ADP-MAF combination is negligible com-pared with that of only the MAF.

VI. Fixed-Point Simulation

Real-Time Considerations

The performance of a real-time implementation ofthe ADP-MAF combination was studied by means ofa 16-bit minicomputer simulation. The fixed-pointarithmetic approach was used to allow fractionalarithmetic with a minimal sacrifice in execution time.Accordingly, special attention was given to the follow-ing factors:

1) Proper alignment of the binary point for eachoperation.

2) Range selection of each variable, so that thebinary point can be positioned to avoid overflow foradditions/subtractions, and underflow for multiplica-tions.

3) Proper rounding following each multiplication.

A further reduction in execution time was achievedby computing each MAF operation in (13), by sub-tracting a previous ADP output value, and then add-ing the current ADP output value at each iteration.This process avoids the necessity of computing the en-tire sum each time. Thus we have

q= qm - em.-L+l + em

(1/L) YJ_= emj+,. (13)

Next, we move M samples and compute the averageof the next L samples, and so on. The values ofMused in all the experiments that follow equal 1.

It can be shown that the variance of q,,, is given by[see 10] a, = o2/L, a result which leads to the obser-vation that as the number of samples L increases, thevariance of qm decreases as 1/L. This means that forsufficiently large L, q, will have a probability densityfunction which is closely concentrated about itsmean.

We note that if the noise which is input to an

MAF is not sufficiently decorrelated, then its outputmay be large enough to cause false (nuisance) alarms.To illustrate, consider Fig. 4(a) which shows 16 s ofnoise (with no intruder) due to the takeoff of an air-craft. For convenience, the squared values of the cor-

responding MAF output and the ADP-MAF combina-tion are shown in Figs. 4(b) and 4(c), respectively. Weobserve that the MAF output in Fig. 4(b) tends to in-dicate an intruder in the 8-12-s range, while the ADP-

where q, = Lqm. Again, since L was chosen to be an

integer power of 2 (i.e., 2, 4, 8, etc.), the quantityqm/L was computed by merely redefining the positionof the binary point in q,.

A flowchart pertaining to the ADP-MAF simula-tion is shown in Fig. 6. We observe that an analog-to-digital (A/D) converter is used as a data source. Toillustrate the related performance, the input was ob-tained from a sine wave generator whose fequencywas set at 20 Hz. The corresponding input-outputwaveforms were displayed on a dual traceoscilloscope, an example of which is shown in Fig. 7..The sampling frequency was 128 samples per second.

Experimental Results

The input data shown in Figs. 8(a) through 10(a)was obtained at 128 samples per second. The varioustypes of noise sources considered are identified inthese figures. At each of the points indicated by thesymbol "t", there is an intruder crossing. The object

AHMED ET AL.: ON AN INTRUSION-DETECTION APPROACH VIA ADAPTIVE PREDICTION

0

(14)

., ,, ,,,,I Tfw 1- "

Ca

uz

433

START

CLEAR THE FOLLOWING:input sample buffer f_k k=1,2, .*,NADP coefficient buffer bm k k=1,2, ..,NADP error buffer em j+l j=1,2,...,L

| START THE A/D CONVERTER

WAIT AN "APPROPRIATE" |AMOUNT OF TIME

/ READ IN A SAMPLE (f) AND START NEXT CONVERSION/

|COMPUTE THE ADP OUTPUT:N

g, = Ib, fim-gm k=l mk m-k

COMPUTE THE ADP ERROR: Iem = f - g

IUPDATE THE MAF SUM

qm qdm- - e'-L+l m |

_ 1~~~~~UPDATE THE ADP COEFFICIENTS:

b,+l k = bm k + vf _ke. k=1,2,...,N

SQUARE THE MAF SUM:

Iqm =qmqm

WAIT AN "APPROPRIATE"]AMOUNT OF TIME

/2OUTPUT q TO THE D/A

Fig. 6. Flowchart for fixed-point simulation.

of the experiment is to detect intruder crossings viathe ADP-MAF combination.

A 16-weight ADP was used, followed by an MAFwhose window length L was 16. All 16 weights wereinitially set to zero. The value of the convergenceparameter v was 0.00001. The MAF outputs for thefixed-point simulation are shown in Figs. 8(b) through10(b). Figures 8(c) through 10(c) show the MAF out-puts squared. From these results, it is apparent thatthe ADP-MAF combination outputs obtained allowdetection via a threshold approach.

VIl. Hardware Considerations

The eventual objective for a deployed system is tohave the entire signal processing to be carried out ona small militarized microcomputer. As a feasibilityand evaluation project, the algorithm was im-

(b)

Fig. 7. Pertaining to a real-time simulation. (a) Upper traceshows input with an abrupt change in amplitude occurringat " t." Lower trace shows corresponding ADP-MAF com-bination output (squared). (b) Upper trace shows input withabrupt change in frequency occurring at " T." Lower traceshows corresponding ADP-MAF combination output(squatted).

plemented in a microcomputer based upon a 12-bitcommercial microprocessor. Complementary metal-oxide-semiconductor technology was used extensivelybecause of its good noise immunity characteristics andlow power consumption. The microcomputer waspackaged in a small carrying case so it can be readilymoved from site to site, checking the performance onmany different sensors under varied noise and en-vironmental conditions. Fig. 11 shows the fieldableunit along with an auxiliary box containing paper tapereader, keyboard, and display with associated cir-cuitry.

Most digital signal processing algorithms requirethe processor to accomplish extensive multiplicationsand the ADP is no exception. Hence, a multiplier ex-ternal to the processor was employed. Presently twoapproaches are used: one is rather conventional, usingseveral integrated circuits; the other, a unique

IEEE TRANSACTIONS ON AEROSPACE AND ELECTRONIC SYSTEMS VOL. AES-15, NO. 3 MAY 1979

(a)

4314

(a) Itiput

9

9-

81

: ~~~~~~-eouA i4 p- -A

° (b) ADP-MIAF output 8250

(c) ADP-MAF output, squared

Fig. 8. Experimental results-data set 1.

100

(a) Input

-12. 5

625

(b) ADP-MAFP output

(c) ADP-MAF output, squared

82 50

82 50

82 50


AHMED ET AL.: ON AN INTRUSION-DETECTION APPROACH VIA ADAPTIVE PREDICTION 435

° (b) ADP-MAF output

...........;....

I .............I---.:

- -- - ---

t: .:

(c) ADP-MAF output, souared


logarithmic table lookup scheme implemented in read-only memory [111.

The question of word length arises also with theplacing of any algorithm on a fixed word lengthmachine using integer arithmetic. The 12-bit wordlength used here appears to cause minimal degrada-tion in performance. However, as mentioned in Sec-tion VI, care has to be taken in coding. An evaluationrelated to using 8-bit and 16-bit processors will also beundertaken.

VIII. Concluding Remarks

We have demonstrated that the concept of usingadaptive prediction to remove correlated noise for aspecific intrusion detection application is indeedpromising. Future work will focus on evaluating morecomplex detection techniques [9, 10] at the output ofthe ADP, in terms of reliable detection and reductionin false alarms. Attention will be given to appreciablyreducing the bandwidth of the input signals. This isbecause the gain function of the MAF considered herehas (sin xlx) form [12], and a filter length (i.e., L) of16, results in a main lobe that occupies the 0-8-Hzregion. Hence, lower sampling rates will also be con-sidered. Some attention will be given to the possibilityof implementing the ADP via lattice structures [13], inlieu of the transversal filter implementation consideredhere. The motivation for doing so is that lattice struc-tures have superior convergence properties.

In addition, an extensive evaluation will be made

Fig. 11. Microprocessor implementation of ADP-MAF (left),and auxiliary unit (right).

of low power microprocessors and associated circuitrywhich might be available as military qualified parts.The objective is to use such parts in final productionunits which will be small and rugged.

References

[1] B. Widrow, et al., "Adaptive noise cancelling: Principlesand applications," Proc. IEEE, vol. 63, pp. 1692-1716, Dec.1975.

[2] G.R. Elliott, W.L. Jacklin, and S.D. Stearns, "The adaptivedigital predictor," Sandia Laboratories, Albuquerque, N.Mex., Tech. Rep. SAND 76-0360, Aug. 1976; available fromNational Technical Information Service, 5285 Port RoyalRoad, Springfield, Va. 22161.


1400~~~~~~~~~~~~.

~ ~ ~ ~ ~ ~~~~ .............. .... ........................

.............. .... ....... ........... ............. .. ..

_CA___

..........

.............

-25

436

[3] S.D. Stearns, G.R. Elliott, and N. Ahmed, "On adaptiverecursive filtering," Proc. 10th Asilomar Conf. Circuits andSystems, pp. 5-11, 1976.

[4] N. Ahmed, "A study of adaptive digital filters," SandiaLaboratories, Albuquerque, N. Mex., Tech. Rep. SAND77-0102, Aug. 1977; available from National Technical In-formation Service, 5285 Port Royal Road, Springfield, Va.22161.

[5] G.R. Elliott, S.D. Stearns, and N. Admed, "Adaptivetransfer filter considerations," Proc. Ilth Asilomar Conf.Circuits and Systems, pp. 259-262, 1977.

[6] A. Papoulis, Probability Randon Variables and StochasticProcesses. New York: McGraw-Hill, 1965.

[7] J.B. O'Neal, "Predictive quantizing systems for transmissionof television signals," Bell Syst. Tec. J., pp. 689-721, May-June, 1966.

[8] D.R. Morgan and S.E. Craig, "Real-time adaptive linearprediction using the least mean square gradient alorithm,"

IEEE Trans. Acoust. Speech Signal Processing, vol.ASSP-24, pp. 494-507, Dec. 1976.

[9] M. Schwartz and L. Shaw, Signal Processing: Discrete Spec-tral Analysis, Detection, and Estimation. New York:McGraw-Hill, 1975, ch. 5.

110] A. Papoulis, Signal Analysis. New York: McGraw-Hill,1977.

[11] J.E. Simpson and R.A. Wayne, "A high speed look-up tabletechnique for digital multiplication," Sandia Laboratories,Albuquerque, N. Mex., Tech. Rep. SAND 77-1866, Mar.1978; available from National Technical Information Service,5285 Port Royal Road, Springfield, Va. 22161.

[12] R.W. Hamming, Digital Filters. Englewood Cliffs, N.J.:Prentice-Hall, 1977, ch. 3.

[13] J. Makhoul, "A class of all-zero lattice digital filters: Pro-perties and applications," IEEE Trans. Acoust. SpeechSignal Processing, vol. ASSP-26, pp. 304-314, Aug. 1978.

Nasir Ahmed (S'62-M'66-SM'77) was born in Bangalore, India, in 1940. Hereceived the B.S. degree in electrical engineering from the University of Mysore,India, in 1961 and the M.S. and Ph.D. degrees from the University of New Mex-ico, Albuquerque, in 1963 and 1966, respectively.

From 1966 to 1968 he worked as Principal Research Engineer in the area ofinformation processing at the Systems and Research Center, Honeywell, Inc., St.Paul, Minn. Since 1968 he has been with Kansas State University, Manhattan.Presently, he is a Professor of Electrical Engineering. He is the author of anumber of technical papers in the area of digital signal processing and iscoauthor of the book, Orthogonal Transforms for Digital Signal Processing(Spinger-Verlag, 1975). His second book, Computer Science Fundamentals: AnAlgorithmic Approach Via Structured Programming (with Elizabeth Unger), isexpected to be released in 1979, by the Charles Merrill Publishing Co.

Dr. Ahmed is an Associate Editor of the IEEE Transactions on Elec-tromagnetic Compatibility (Walsh Functions Applications) and is a member ofSigma Xi.

AHMED ET AL.: ON AN INTRUSION-DETECTION APPROACH VIA ADAPTIVE PREDICTION 437

R. Joseph Fogler was born in Junction City, Kansas, on August 23, 1953. Hereceived the B.S. degree in electrical engineering in 1977 from Kansas StateUniversity, Manhattan, and is completing work there on the M.S. degree. Hisprincipal research area is digital signal processing with applications in themicroprocessor environment.

He is a member of Tau Beta Pi and Eta Kappa Nu.

David L Soldan (S'75) received the B.S.E.E. and M.S.E.E. degrees from KansasState University in 1969 and 1976, respectively. He is currently a candidate forthe Ph.D. degree at Kansas State University.

From 1968 to 1970 he was employed in the Avionics Division of CollinsRadio Company where he worked with automatic direction finding systems. Dur-ing 1970 and 1971 he was with the Communications Division of Motorola, Inc.,where he designed two-way VHF radios. After completion of four years in theU.S. Air Force, he returned to graduate school in 1975 and is now an Instructorat Kansas State University. His current research interests are digital signal pro-cessing and microprocessor applications.

Mr. Soldan is a member of Phi Kappa Phi, Sigma Tau, and Eta Kappa Nu.

Glenn R. Elliott was born in Oklahoma and received the B.S.E.E. degree fromOklahoma State University in 1953.

He has been with Sandia Laboratories in Albuquerque, N. Mex., since thattime. He has worked with analog and digital test systems and has been involvedin the design of a number of computer-based systems in the areas of communica-tions, distributed processing, and digital signal processing. He has coauthoredseveral papers in the microprocessor and signal processing field.

N.A. Bourgeois, Jr. (SM'00) was born in New Orleans, La., on February 17,1928. He received the B.S. degree in electrical engineering from Tulane Universityin 1952.

Since 1955 he has been a member of the technical staff of SandiaLaboratories. He designed computer-controlled test equipment prior to his cur-rent assignment with a digital signal processing group.

N.A. Bourgeois, Jr., is a member of Tau Beta Pi.


on an intrusion-detection approach via adaptive prediction

Documents