## 3 The Proposed Framework
### Anomaly Detection
#### 3.2.2 Classifier  
CCTV videos are characterized by a redundancy of information in normal scenes. Building the event model by using all vectors obtained for each frame during the training phase would skew the distribution by weighting redundant elements and marginalizing rare ones that would lead to misinterpretations and generate confusion between rare events and abnormalities in the detection process. That is why we proposed in this paper an online selection of vectors of interest. It allows definition of a balanced distribution able to represent all normal events, including rare ones, since the representation of redundant and rare events reaches an equilibrium. Thus, all normal events have the same importance during the detection process so that false alarms would be avoided. In this way, we were able to construct a robust classifier, able to minimize redundancy, and avoid the marginalization of rare events and reduce false alarms. Algorithm 1 shows the construction of the balanced distribution. Thus, to select our representative vectors, we declare \"N\" first vectors from the first frame as vectors of interest. Then, for each new vector \"\(X_{i}\)\" of the processed frame, we calculate a string metric \"\(dist_{i}\)\" based on Mahalanobis distance between \"\(X(i)\)\" and the \"N\" vectors of the distribution. This is represented in the following equation:  
\[dist_{i}=(X(i)-moy)*Q*(X(i)-moy)^{\prime} \tag{1}\]  
where \"\(moy\)\" and \"\(Q\)\" are the mean and the inverse of the covariance matrix of the distribution, respectively. The Mahalanobis distance considers the correlation between data variables since it is calculated using the inverse of the covariance matrix [38]. Using this distance, the probability that a test point belongs to a set is characterized not by its euclidean distance but by a metric tacking into account the distribution of the data. In our case, if this distance exceeds a threshold \"a\", the vector is selected to be a vector of interest, then we update \"\(moy\)\" and \"\(Q\)\". Otherwise, the vector is not considered for the detection of abnormalities. We then continue the same process for each new arrival frame in the training phase. We thus assess the relevance of each vector to be included in the balanced distribution. Finally, this distribution is pruned to eliminate among the first \"N\" elements those that are redundant, which ultimately generates \"\(M\)\" different vectors of interest that are considered as the representation of video volumes. This method allows us to compute our algorithm in real time. Furthermore, this method represents each redundant normal event by a single vector in order to have an equilibrium in point of interest data. It then prevents the marginalization of normal events  
Figure 4: Global scheme of the proposed framework. that occur rarely during the training process. Thus, every event has the same importance in abnormal detection procedure. For the testing phase, each patch, represented by a vector obtained by the feature extraction mentioned above is assessed using the same principle. Indeed, we measure the similarity between the vector representing the patch and the balanced distribution. If the measure exceeds a threshold \"\(\beta\)\", the vector is considered as an outlier. Thus, the considered patch is labeled as abnormal. The detailed procedure is presented in Algorithm 1. All the thresholds (\(\alpha\), \(\beta\) and \(\eta\)) were selected empirically. While \"\(\alpha\)\" and \"\(\eta\)\" were selected manually according to their effects on the size of the balanced distribution, \"\(\beta\)\" was selected in order to obtain the best results (minimum of false alarms and misdetections) in the monitored scenes. CCTV also faces another challenge due to the constant evolution of the environment that can be characterized as a dynamic background, appearance of new interactions or temporary authorization of abnormal events. These changes can generate false alarms that disturb the interaction with the users of the anomaly detection algorithm.