## 3 Methods
### Network Layer
#### 3.1.7 Sensor Data Fusion and Machine Learning  
The network generates a continuous stream of data consisting of the different sensor responses (IMS spectra, MO sensor channels, and response of the FPD, PID and EC). This amount of data from the different sensors and nodes, arriving at a sampling rate of 1 Hz, makes some sensor data fusion mandatory. The main tasks in EU-SENSE where data fusion and ML play a role are, one, detection of an incident, and, two, estimation of the concentration of the released agent. Detection (in the sense of \"detect-to-warn\") is the decision of whether a (real) incident has occurred or not. Incident means the presence of a harmful substance concentration. In this case, the detection should follow as early and reliably as possible. In mathematical terms, detection is about classification, and concentration is about regression. Classification and regression are two of the most common types of machine learning tasks, and there exists a rich set of methods to treat classification and regression. In the EU-SENSE project, the detection is performed in two steps. The first step is anomaly detection, followed by an identification step. Anomaly detection shows a change, being an unusual, possibly harmful situation, in the incoming time series of sensor responses. This recognition of anomaly detection is based on raw sensor data collected from individual sensors. These sensors are combined into \"sensor nodes\" and, at a higher level, a network of sensor nodes. Therefore, anomaly detection can occur on sensor level, node level and/or the network level. The method used is a statistical, distance-based approach that compares incoming response values against (multi-variate) probability distributions learned continuously from previously seen data (online learning) in different schemes. The results of anomaly detection are a new (one-dimensional) time series (on sensor level, node level, etc.) of anomaly scores. On one hand, these anomaly scores are very sensitive; on the other hand, they ignore normal environmental noise by learning the statistical clutter characteristics. However, the process is still so sensitive that false positives are unavoidable as:  
* It detects small concentrations;
* It detects signals of harmless substances;
* It detects artefacts. Figure 2: EU-SENSE system prototype. (**a**) EU-SENSE detection tool; (**b**) Sensor node. In this context, it is interesting to reflect for a moment what a false alarm actually is. Is it a false alarm when there is a (low) concentration of a harmless substance in the air containing, e.g., phosphorus (fertiliser)? And does the AP4C (P channel) respond to that? The AP4C does exactly what it is supposed to do, and from this perspective, it is not a false alarm. However, it is a false alarm for emergency personnel since the substance is harmless in a low concentration. Therefore, the next step is to verify whether an identified anomaly is a real incident. It is an identification phase. Identification is possible by learning the response characteristics of several different sensors and their responses to different substances. In the EU-SENSE project, IMS technology facilitates the identification process. The methods used for identification are a combination of machine learning methods and the utilisation of the specific sensor capabilities. As the primary tool, Bayesian inference in the form of Bayesian networks is used. Bayesian inference is about knowledge, and it can be defined as: acquiring new knowledge from given knowledge contained in the Bayesian network. The relation between the nodes of a Bayesian network contain knowledge in the form of conditional probabilities.