Anomaly detection in sensor networks based on large deviations of Markov chain models

We introduce an anomaly detection framework for wireless sensor networks able to detect statistically significant temporal or spatial changes in either the underlying process the sensor network is monitoring or the network operation itself. We consider a series of Markov models to characterize the behavior of the sensor network, including tree-indexed Markov chains which can model its spatial structure. Large deviations techniques are used to compare the distribution of the Markov model estimated from past anomaly-free traces with its most recent empirical measure. We develop optimal decision rules for each corresponding Markov model to identify anomalies in recent activity. Simulation results validate the effectiveness of the proposed anomaly detection algorithms.