A mobile edge–cloud collaboration outlier detection framework in wireless sensor networks

IET CommunicationsVolume 15, Issue 15 p. 2007-2020 ORIGINAL RESEARCH PAPEROpen Access A mobile edge–cloud collaboration outlier detection framework in wireless sensor networks Cong Gao, Corresponding Author cgao@xupt.edu.cn orcid.org/0000-0001-9829-8025 School of Computer Science and Technology, Xi'an University of Posts and Telecommunications, Xi'an, China Shaanxi Key Laboratory of Network Data Analysis and Intelligent Processing, Xi'an University of Posts and Telecommunications, Xi'an, China Correspondence Cong Gao, School of Computer Science and Technology, Shaanxi Key Laboratory of Network Data Analysis and Intelligent Processing, Xi'an University of Posts and Telecommunications, Xi'an, Shaanxi 710121, China. Email: cgao@xupt.edu.cnSearch for more papers by this authorGuohao Song, orcid.org/0000-0002-1899-6518 School of Computer Science and Technology, Xi'an University of Posts and Telecommunications, Xi'an, ChinaSearch for more papers by this authorZhongmin Wang, orcid.org/0000-0003-3731-4049 School of Computer Science and Technology, Xi'an University of Posts and Telecommunications, Xi'an, China Shaanxi Key Laboratory of Network Data Analysis and Intelligent Processing, Xi'an University of Posts and Telecommunications, Xi'an, ChinaSearch for more papers by this authorYanping Chen, orcid.org/0000-0002-7812-4199 School of Computer Science and Technology, Xi'an University of Posts and Telecommunications, Xi'an, China Shaanxi Key Laboratory of Network Data Analysis and Intelligent Processing, Xi'an University of Posts and Telecommunications, Xi'an, ChinaSearch for more papers by this author Cong Gao, Corresponding Author cgao@xupt.edu.cn orcid.org/0000-0001-9829-8025 School of Computer Science and Technology, Xi'an University of Posts and Telecommunications, Xi'an, China Shaanxi Key Laboratory of Network Data Analysis and Intelligent Processing, Xi'an University of Posts and Telecommunications, Xi'an, China Correspondence Cong Gao, School of Computer Science and Technology, Shaanxi Key Laboratory of Network Data Analysis and Intelligent Processing, Xi'an University of Posts and Telecommunications, Xi'an, Shaanxi 710121, China. Email: cgao@xupt.edu.cnSearch for more papers by this authorGuohao Song, orcid.org/0000-0002-1899-6518 School of Computer Science and Technology, Xi'an University of Posts and Telecommunications, Xi'an, ChinaSearch for more papers by this authorZhongmin Wang, orcid.org/0000-0003-3731-4049 School of Computer Science and Technology, Xi'an University of Posts and Telecommunications, Xi'an, China Shaanxi Key Laboratory of Network Data Analysis and Intelligent Processing, Xi'an University of Posts and Telecommunications, Xi'an, ChinaSearch for more papers by this authorYanping Chen, orcid.org/0000-0002-7812-4199 School of Computer Science and Technology, Xi'an University of Posts and Telecommunications, Xi'an, China Shaanxi Key Laboratory of Network Data Analysis and Intelligent Processing, Xi'an University of Posts and Telecommunications, Xi'an, ChinaSearch for more papers by this author First published: 29 May 2021 https://doi.org/10.1049/cmu2.12231AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onEmailFacebookTwitterLinked InRedditWechat Abstract Wireless sensor networks (WSNs) are extensively deployed to collect various data. Due to harsh environments and limitation of computing and communication capabilities of sensor nodes, the quality and reliability of sensor data are compromised by outliers. With the advent of 5G, sensors tend to generate increasingly more complex data. When faced with big data, traditional outlier detection methods relied on sensor nodes and remote cloud are unable to accord satisfactory performance in terms of delay and energy consumption. To address this problem, we propose a mobile edge–cloud collaboration outlier detection framework. Outlier detection is performed by edge nodes between the remote cloud and the underlying WSNs, while the training and updating of detection model are conducted on the cloud. A fast angle-based outlier detection method is developed to obtain training data. The detection model is constructed based on support vector data description. An on-line learning-based iterative optimization scheme is devised to update the detection model. Besides, a fuzzy concept is incorporated into the detection model to alleviate the problem of loose decision boundary. Extensive experiments are conducted on real-world data set. Simulation results show that our model is superior to three popular methods in terms of delay and energy consumption. In addition, when the percentage of operational nodes is 60%, our proposal prolongs the network lifetime by 14.2% to 69.8% compared to the three methods. 1 INTRODUCTION With the rapid development of microelectronics and wireless technologies, wireless sensor networks (WSNs) have been extensively applied to a large variety of fields, such as agriculture [1], healthcare [2], industry [3-5], and smart home [6]. A WSN is a distributed network architecture formed by deploying a large number of sensor nodes in an area. It aims to collect desired data from the region of interest. However, as the core component of a WSN, sensor nodes are prone to generate outliers in the collected data [7]. The main reasons lie in the following three aspects [8]. 1) Resource limitation. Sensor nodes possess stringent resource constraints, such as computing power, storage space, and communication bandwidth. Due to limited resources and capabilities, data generated by sensor nodes are apt to be inaccurate and unreliable. In addition, sensor nodes are battery powered. When battery is draining, the performance of a sensor node tends to deteriorate. Then, outliers come out more frequently. 2) Harsh environments. Due to unintended environments like dynamic climate change or harsh phenomenon in uncontrolled areas, sensors might report unstable data. Therefore, sensor nodes suffer from radio interference and potential damage from a harsh environment. 3) Malicious attacks. As sensor nodes are randomly deployed, they are prone to various kinds of malicious attacks. For instance, the collection and processing of data may be attacked by attackers. Moreover, attackers can also inject malicious codes to make sensor nodes produce erroneous data. The above issues may lead to the occurrence of outliers. An outlier, also known as anomaly, is a pattern in data which does not conform to a well-defined notion of normal behaviour [9]. As the existence of an outlier may significantly compromise the accuracy and reliability of data, it is essential to efficiently identify outliers. Moreover, the occurrence of outliers may indicate events of interest, such as equipment failure, sudden environmental change, and security breach. Recently, outlier detection in WSNs has attracted much research attention. It is widely used for various real-world applications, such as fraud detection, intrusion detection, environmental monitoring, health and medical monitoring, localization, and target tracking. For WSNs, outlier detection techniques often involve computation and communication among different sensor nodes. In general, outlier detection techniques are divided into centralized structure and distributed structure. In a centralized structure, each node transmits the received data to a central location (e.g., cloud platform). Besides delay and congestion induced by bottleneck effect, this type of structure also tends to cause highly inefficient resource utilization. Large amount of raw data needs to be transmitted from sensors to cloud platform. This entails substantial channel interference and energy consumption. However, in fact, only a small fraction of the transmitted data are anomalous [10]. Therefore, to improve the efficiency of resource utilization as well as responsiveness, a distributed outlier detection structure is preferred by researchers. However, outlier detection is challenging for sensors with limited resources due to the elusive nature of outliers and the variability of surrounding physical environment. Solutions based on various approaches have been proposed. In [11], outlier detection approaches are classified as six groups: statistical-based, clustering-based, classification-based, spectral decomposition-based, nearest neighbour-based, and other methods. However, most existing solutions are either computationally expensive or overwhelmed by communication overhead. Thus, the applicability to resource-constrained WSNs is limited. In [12], the authors present a test methodology for the comparison of edge computing architecture and cloud computing architecture for anomaly detection systems. The experiments are conducted based on the implementations of deep learning algorithms. The major drawback of deep learning algorithms is that they usually require high computational power. The proposed methodology mainly concentrates on comparisons among deep learning algorithms. The applicability of this proposal is not wide. In [13], the authors propose a hybrid bacteria foraging algorithm to address the problem of edge task placement. The proposed algorithm aims to conduct task scheduling in edge network and it is able to explore a large search space and obtain a feasible solution in polynomial time. However, as the task placement is an NP-complete problem, the proposed model introduces some constraints. In [14], the authors describe an autonomous anomaly analysis framework for clustered cloud or edge resources. It aims to find out the cause of a user-aware anomaly in the underlying infrastructure by hidden Markov models. Experiments are just conducted in clustered cloud computing resources. Edge resources are not covered. In addition, due to the advent of new information technologies (e.g., 5G) and the integration of sensors, more and more data with complex structure are generated. When conducting outlier detection for large amount of data with multi-features, existing approaches are confronted with excessive bandwidth demand, increasing energy consumption, and low accuracy. Here, we propose a mobile edge–cloud collaboration outlier detection framework in WSNs. The employment of edge computing is targeted at reducing detection delay and energy consumption. An edge layer is placed between WSNs and cloud. As this edge layer is close to the underlying WSNs, data transmission from sensor node to edge layer is efficient. Outlier detection tasks which are computation-intensive and energy-consuming for sensor nodes to accomplish are performed at the edge layer. In addition, an iterative optimization scheme is developed to update the outlier detection model. The main contributions are as follows. 1) A fast angle-based outlier detection algorithm (FastABOD) is introduced to obtain training data. Faced with the increasing dimensionality of high-dimensional data, the concept of distance in TODMs becomes less meaningful. Our FastABOD algorithm turns to angular variation among data points for outlier detection. Compared to the basic ABOD algorithm, our method achieves an improvement in the time complexity by an order of magnitude. 2) Traditional support vector data description (SVDD) method is only applicable to data set whose input space is circular. For an input space with a non-circular distribution, the actual performance of this method cannot be guaranteed. To address this problem, we introduce the concept of kernel function. The employed Gaussian kernel function possesses good robustness and is independent of sample size. When there are outliers in the training data, the traditional SVDD method is likely to accord loose decision boundaries. To address this problem, we introduce fuzzy theory to finding a minimum hypersphere with fuzzy constraints. The above building blocks constitute our f-SVDD package which is the detection model. 3) A mobile edge–cloud collaboration scheme is designed. The accuracy of outlier detection is improved by optimizing the detection model with on-line machine learning techniques. Edge nodes equipped with the f-SVDD package collect data and conduct outlier detection. The cloud trains the f-SVDD package and provides model optimization to the edge nodes. The remainder of this paper is organized as follows. Section 2 reviews the existing outlier detection methods in WSNs. Section 3 presents our mobile edge–cloud collaboration outlier detection framework. Section 4 evaluates the proposed model with extensive experiments. Finally, conclusions and future work are presented in Section 5. 2 RELATED WORK Here, existing outlier detection methods in WSNs are summarized. The six categories of outlier detection approaches for WSNs given by [11] are detailed as follows. 2.1 Statistical based The core idea of statistical-based outlier detection is a prior probability distribution model with a confidence interval. Measurements that lie within the confidence interval are considered to be normal, while outliers are outside the confidence interval. Statistical-based outlier detection models can be classified as parameterized and parameterless based on the construction methods. This type of outlier detection is rational in mathematics. Provided a data distribution could be estimated in advance, statistical-based approaches are able to accord satisfactory outlier detection. In [15], a distributed outlier detection model based on credibility feedback for WSNs is proposed. Final credibility of sensor nodes are derived from initial credibility by credibility feedback and Bayes theorem. Then, the set of outliers is adjusted. The presented message complexity reveals that the proposed model possesses high energy consumption. In [16], a statistical distributed outlier detection method based on Euclidean distance is proposed. The fitting of measurements in time series for forward expansion is conducted based on statistical distribution. Thus, a measurement which exhibits large deviation from the distribution center is considered to be an outlier. In [17], the authors proposed an on-line outlier detection approach based on a segmented sequence analysis (SSA) algorithm. A piecewise linear model of time series sensor data is constructed by SSA. The model is a two-layered distributed model where the first layer is a local detection process at an individual node, whereas the second layer is a centralized detection process at a cluster head. Drawbacks: in a real-world scenario, the probability distribution of sensor data stream can hardly be obtained in advance. Thus, statistical-based outlier detection models are not easy to put into practice. 2.2 Clustering based Clustering-based outlier detection is popular in data mining. Different clusters are formed by grouping measurements with similar behaviours. Each cluster consists of similar measurements which are distinct from measurements in other clusters. For a measurement belongs to no cluster or a cluster whose members are significantly less than other clusters. This measurement is considered to be an outlier. Clustering-based outlier detection is able to work without a prior knowledge of data distribution. Thus, it is suitable for scenario where new data are generated constantly. In [18], a lightweight k-means clustering method is proposed. It aims to improve the energy consumption and processing ability of sensor nodes. However, an appropriate value of k is difficult to determine beforehand. In [19], the authors proposed a distributed hyperspherical cluster-based algorithm for identifying outliers in measurements from WSNs. Measurements are clustered and the obtained clusters are further merged. The description of clusters sent to other nodes is a compact version. Thus, communication overhead is reduced. However, this method is just able to identify outliers at the level of an individual node. In [20], an outlier detection process called density-based spatial clustering of applications with noise (DBSCAN-OD) is proposed. This method combines the calculation of parameters and class identification in spatial–temporal databases. However, as the real-time outlier detection is conducted in a centralized base station, the issue of bottleneck is inevitable. Drawbacks: clustering-based outlier detection requires predetermination of appropriate values for key parameters, which is not easy. In addition, the processing of multi-dimensional data set consumes large amount of computation resources. 2.3 Classification based Classification-based outlier detection basically consists of two phases: training and testing. In the training phase, a classifier is trained with labelled data. In the testing phase, unlabelled data are tested by the obtained classifier. A test case is identified as normal or abnormal. Existing outlier detection methods in WSNs are mainly based on two mathematical packages: support vector machine (SVM) and Bayesian network. In [21], one-class support vector machine (OCSVM) is employed to perform outlier detection. Spatial–temporal correlation of sensor data are used to represent the relations among sensors. Thus, the correlation graph of a WSN can be established. Based on the readings given by sensors, the correlation graph is able to detect anomaly without any information of threshold. In [22], the authors proposed an unsupervised outlier detection scheme for unlabelled data in WSNs. One of the one-class SVM variants, centered hyper-ellipsoidal SVM (CESVM), is used as a classifier to detect outliers. In [23], an OCSVM-based method for outlier detection is proposed. It is able to reduce computation complexity of the training and the testing phase. In general, SVM-based detection possesses high accuracy and low false positive rate. However, if there are outliers in the training data, the performance of OCSVM becomes very poor. In [24], an outlier detection model with layered structure is proposed. The first layer introduces Bayes classifier to individual sensor node. The second layer determine whether there are outliers by aggregating results of different sensor nodes. Drawbacks: classification-based outlier detection is confronted with high computation cost when dealing with multi-dimensional data. Moreover, the performance of classifier is heavily dependent on the quality of training data. Whereas, the acquisition of appropriate training data is difficult in certain circumstances. 2.4 Spectral decomposition based The basic idea of spectral decomposition-based outlier detection is as follows. Certain key features of data are obtained by spectral analysis methods. The extracted principal components are used for dimensionality reduction of multi-dimensional data. If a measurement does not conform to the constitution of minimum principal components, it is considered as an outlier. Spectral decomposition-based outlier detection is suitable for high-dimensional data. In [25], a distributed outlier detection model based on one-class principal component classifier (OCPCC) is proposed. Outlier detection is based on spatial correlation among sensor nodes. Each node in a cluster constructs a local normal reference model which is sent to the cluster head. The cluster head obtains a global normal reference model by integrating the received local models. Finally, the global normal reference model is sent back to local nodes for outlier detection. However, this model suffers from high false positive rate. In [26], the authors proposed a novel local on-line outlier detection method based on principal component analysis (PCA). As methods based on the original PCA usually suffer from high computational overhead, the authors employ a recursive subspace tracking approach for PCA to address this problem. Drawbacks: spectral decomposition-based outlier detection relies on the selection of appropriate model. This process requires a large amount of computation. 2.5 Nearest neighbour based Nearest neighbour-based outlier detection uses distance to formulate the relations among data. For both univariate continuous data and multivariate continuous data, the most popular choice is Euclidean distance. If a measurement is far away from its neighbours, it is considered to be an outlier. Namely, the degree of anomaly is measured by distance. This idea performs well for low-dimensional data. In [27], an outlier detection method based on local outlier factor (LOF) for machinery condition monitoring is proposed. Time domain features are extracted from segments of data. Then, PCA is applied to the obtained features. The degree of anomaly for a segment is evaluated by LOF calculated based on principal components. In [28], a k-nearest neighbour outlier detection method in WSNs is proposed. The computation complexity is reduced by remapping the outlier detection task from hypersphere detection region to hypergrid detection region. However, this method should be tested on more data with dynamic variation. In [29], a LOF-based model is proposed. The average distance from a measurement to its nearest neighbours is denoted by d. The average of the nearest neighbours' distances to their nearest neighbours is denoted by d ¯ n . The LOF uses the ratio of d d ¯ n to detect outliers. In [30], a SVM based on k-nearest neighbour (KNN-SVM) algorithm for outlier detection in WSNs is proposed. The scale of training data is reduced by the KNN technique. Thus, both training time and optimizing time are shortened. In order to identify outliers, measurements are mapped to feature spaces by kernel function. However, the involvement of KNN and SVM introduces high computational overhead. Drawbacks: for multi-modal data and high-dimensional data, nearest neighbour-based outlier detection demands considerable resources to cope with the increase of computation complexity. 2.6 Others As a key concept of ensemble leaning, isolation is introduced to outlier detection. The intrinsic characteristics of outlier are taken into full account during the construction of outlier detector. On the whole, compared to normal data, outliers are few and different. In other words, outliers are more isolated than normal data. In [31], a distributed outlier detection model based on isolation forest (iForest) is proposed. Local isolation scores of a measurement is given by local detectors. The final isolation score of a measurement is calculated by a global detector which aggregates the results of local detectors. Drawbacks: outlier detection based on iForest is not sensitive to outliers which are close to normal data. With the blooming development of edge computing [32], more and more researchers in the field of outlier detection turn to this novel concept. In [10], a two-part outlier detection algorithm based on autoencoder neural networks is proposed. The two parts are sensors and IoT cloud. Outliers can be detected at an individual sensor in a distributed structure without communicating with any other sensors or the cloud. The computation-intensive learning tasks are handled by the cloud. In [33], a distributed sensor data outlier detection model based on edge computing is proposed. The continuity of time series and the correlation among multi-source data are used to conduct outlier detection. Drawbacks: currently, the offloading degree of edge computing is still an open question. There are short of appropriate solutions. Thus, there is no guarantee of effective outlier detection in practice. In general, the deployment of WSNs is considered mature in various application scenarios. As appropriate combination of edge device and wireless sensor node is able to improve the efficiency of network in terms of message overhead and energy consumption, the terminal layer of edge computing often employs WSNs to collect data. However, there are few literatures about the combination of edge computing and outlier detection in WSNs. Hereby, we propose an innovative mobile edge–cloud collaboration outlier detection framework in WSNs. 3 MOBILE EDGE–CLOUD COLLABORATION OUTLIER DETECTION FRAMEWORK 3.1 Traditional outlier detection model A WSN typically consists of a large number of sensor nodes scattered over a region of interest. The network is deployed to monitor specific physical phenomena. For different application scenarios, various kinds of topologies can be formed based on different arrangements of sensor nodes. A typical network topology is shown in Figure 1. Sensor nodes in the network are grouped into seven clusters. Clusters are separated by dashed line. Each cluster has a cluster head which is denoted by a grey point. Other nodes are denoted by black points. There is only one sink node and it is denoted by a black circle. Communication links between a cluster head and the sink node are denoted by dotted line. The sink node transmits data collected by sensor nodes to a cloud platform. FIGURE 1Open in figure viewerPowerPoint A typical topology of WSN For traditional methods, the idea of outlier detection is as follows. Sensor nodes within a cluster send collected data to cluster head. The cluster head conducts outlier detection based on the received data and sends the result to the sink node. In this way, cluster head makes a considerable amount of energy consumption during the process of outlier detection. In general, the main purpose of a WSN is collecting data and forwarding data packets from event regions to a sink. As sensor node is energy constrained, the corresponding computing capacity of a sensor node is distinctly insufficient when dealing with large amount of complex data. Consequently, the energy of cluster head is expected to be drained ahead of other sensor nodes. Typically, a certain amount of node failure may lead to the compromise of network usability. 3.2 Mobile edge–cloud collaboration outlier detection Though there is no generally accepted definition of a detailed edge computing architecture, we employ a hierarchical architecture with three layers: (1) cloud layer, (2) edge layer, and (3) WSNs. The cloud layer possesses abundant storage space and powerful computation capability. The edge layer containing mobile edge nodes mainly focuses on outlier detection and uploading data to the cloud. It is also a connector between the cloud and the WSNs. The bottom layer contains various kinds of WSNs whose purpose is collecting data. As different WSNs may target at different phenomena, mobile edge nodes for outlier detection are also different. For each WSN, mobile edge nodes establish the corresponding detection model (i.e. detector) based on the collected normal data. The detector is expected to detect outliers in a quick way during the process of data collection. In addition, certain data are uploaded to the cloud for the update of detection model described later in this section. 3.2.1 Fast ABOD With the development of data science, WSNs are confronted with considerable amount of high-dimensional data. Traditional methods suffer from high time complexity which significantly compromises real-time requirements. Thus, the outlier detection of high-dimensional data in WSNs is an urgent issue [34]. We introduce a FastABOD to tackle this problem. With the increase of data dimensionality, the concept of distance is becoming more and more meaningless for high-dimensional data. Thus, distance is not suitable for formulating an outlier detection model. Then, researchers turned to angular variation among data points for the purpose of conducting outlier detection. This idea is able to alleviate the impact caused by curse of dimensionality. Figure 2 is presented to facilitate the description of angle-based outlier detection. FIGURE 2Open in figure viewerPowerPoint Angle-based outlier detection As shown in Figure 2, we introduce an apparent outlier which is denoted by c. Now, we consider the cluster formed by other points in Figure 2. For each point o, all cases of angle ∠ x o y are examined, where x ≠ o and y ≠ o . Points located around the cluster center tend to form angles which are of great difference (e.g., point a), while points located around the border are likely to form angles which are of little difference (e.g., point b). For outliers (e.g., point c), differences among the formed angles are even slighter than that of points located around the border. Thus, angle variance can be chosen as an outlier factor to evaluate anomaly degree of each point. Detailed implementation is based on a weighted cosine variance, where weights are denoted by corresponding distances among points. In specific, for point o ∈ D , the angle-based outlier factor (ABOF) could be formulated as A B O F ( o ) = V A R x , y ∈ D ( x ≠ o , y ≠ o ) o x ⃗ , o y ⃗ d i s t ( o , x ) 2 · d i s t ( o , y ) 2 , (1)where ⟨ , ⟩ denotes scalar multiplication, d i s t ( , ) is Euclidean distance. It is obvious that the distance between a point and the cluster is inversely proportional to the differences among the formed angles. While the differences among the formed angles are proportional to the value of ABOF. Points in set D are sorted in ascending order based on ABOF. However, the above ABOD method has a major flaw. For each point, all pairs of other points in the cluster have to examined. This contributes to a time complexity of O ( n 3 ) which is unacceptable for large volume of data. Thus, we introduce FastABOD which is based on ABOD. This alg