Distributed Abnormal Activity Detection in Smart Environments

The abnormal activity detection in smart environments has experienced increasing attention over years, due to its usefulness in pervasive applications. In order to meet the real-time needs and overcome the high costs and privacy issues, this paper proposes distributed abnormal activity detection approach (DetectingAct), which employs the computing and storage resources of simple and ubiquitous sensor nodes, to detect abnormal activity in smart environments equipped with wireless sensor networks (WSN). In DetectingAct, activity is defined as the combination of trajectory and duration, and abnormal activity is defined as the activity which deviates greater enough from those normal activities. DetectingAct works as follows. Firstly, DetectingAct finds the normal activity patterns through duration-dependent frequent pattern mining algorithm (DFPMA), which adopts unsupervised learning instead of supervised learning. Secondly, the distributed knowledge storage mechanism (DKSM) is introduced to store the mined patterns in each node. Then, the current triggered sensor adopts distributed abnormal activity detection algorithm (DAADA), in which the clustering analysis plays a critical role, to compare the present activity with normal activity patterns, by calculating the similarity between them. The feasibility, real-time property, and accuracy of the DetectingAct algorithm are evaluated using both simulation and real experiments case studies.


Introduction
User activity detection is one of the key applications in smart environments.As detecting users' normal activities is interesting and important, it has attracted attention of a lot of researchers.Activity recognition is based on learning and analyzing the patterns of activities extracted from occupants' regular activities.The abnormal activity detection also has great significance in building pervasive and smart environments applications.Due to the importance of using it to monitor signature or suspicious activities, the abnormal activity detection can be applied to various application domains ranging from the smart home for healthcare to the intelligent building for security, as mentioned later in details.
Medical professionals believe that one of the best ways to detect an emerging medical condition before it becomes critical is to look for the changes in the activities of daily living (ADLs), that is, to detect the abnormal activities in daily life.For example, in elderly care assisted living, a healthy old person in home has a regular routine, with almost regular activity trajectories patterns.But once he or she feels physical discomfort or physical state declining, the abnormality of the activity trajectory or the routine (e.g., more or fewer trips to the bathroom) will be detected.Moreover, whether the activity is normal can be more efficiently reflected by the combination of trajectory and duration.For instance, in the elderly care, a person staying at a location for a longer duration than usual might indicate the onset of illness and need to alert a family member or formal care provider.
Intelligent building, especially in high-security areas, such as military region, warehouse, and office building, will enhance security and provide proactive service by allowing the environment to detect abnormal activities [1].When coming into a strange place, due to being unfamiliar with the location of room, furniture, or lamp switches, the stranger will spend longer time than the familiar to find the right way, 2 International Journal of Distributed Sensor Networks and the trajectory is messier.Hence, it is feasible to identify such suspicious activities and send an alarm for immediate attention.
For the data collection equipment, there are two kinds of approaches to detect abnormal activity: video-based and sensor-based.
Video-based approaches mainly adopt image processing technologies.However, these approaches have the following serious limitations: (i) costing much but only covering a small area [2]; (ii) violation of user privacy; (iii) only identifying the type of activity with short duration and small scope.
Sensor-based smart environment, which is an emerging research field, can well overcome the above mentioned shortcomings [3,4].Studies in the literature have gotten some achievements, but they occasionally adopt centralized data processing and only process simple trajectory data.So many of them have the following disadvantages: (i) focusing on sequence information of activity and ignoring the importance of temporal information; (ii) using centralized approach, consuming large bandwidth, and long response time; (iii) disregarding the activity variation.
Our motivation in this paper is to solve two main challenges.(1) In activity detection, what kind of activities that should be defined as abnormal is subjective.Therefore, it is necessary to find a series of quantitative metrics for different applications (e.g., healthcare, security etc.) to effectively define abnormal activity.(2) The large bandwidth and long response time of the centralized approach are inadequate for real-time detection.
So in this paper we design a new approach DetectingAct to deal with them.(1) A more accurate distinguishing feature, which introduces other relevant information in addition to sequence such as temporal information, is discovered to detect abnormality.(2) A distributed mechanism is proposed, including (i) storing these compressed patterns in each related sensor with the distributed storage mechanism (duration-dependent frequent pattern mining algorithm) and (ii) deciding whether the present activity is normal is based on the distributed detection mechanism (distributed abnormal activity detection algorithm).The main contributions of this paper are as follows.
(i) Considering the variation of activity, duration is introduced into our model, which reveals not only the trajectory abnormality, but also the duration abnormality caused by unpredictable interference.
(ii) DetectingAct, a novel distributed abnormal activity detection algorithm, is proposed to store the learned parameters using mining-training into each sensor and to detect abnormal activity real-timely based on sensor node's limited resource.
(iii) Simulation and real data based experiments are conducted to verify that our approach can efficiently detect abnormal activity in smart environments.
The rest of the paper is organized as follows: in Section 2, related works in the literature are thoroughly overviewed.The activity model is presented in Section 3. DetectingAct is presented in Section 4, followed by a series of simulations and experimental studies in Section 5. Finally, conclusion is made in Section 6.

Related Work
Lots of efforts have been made in the literature for detecting abnormal activity.According to the equipment used in various approaches, they can be typically grouped into two types: video-based and sensor-based.
Video-based approaches mainly use 2D cameras to collect data and adopt image processing technologies to analyze the data.In these approaches, users wear no sensors.These techniques are well proven and mature.Zhong et al. [5] proposed an unsupervised approach for unusual activity detection in a large video set using simple features.Stauffer and Grimson [6] presented a real-time approximate method for learning patterns of activity.The experiments show that this method is stable and robust, and this system is successfully implemented in indoor environments and in some outdoor environments.Recently, 3D cameras have been introduced in video-based approaches.Liu [7] proposes an activity recognition using 2D and 3D depth cameras.However, video-based approaches intrude on privacy issues and video equipment also costs too much.Sensor-based activity detection has attracted much attention and most of the works have focused on centralized data processing.Tapia et al. [3] proposed a system for recognizing activities in the home environment.The experiments prove that activities can be recognized using a lot of small and simple state-change sensors.Wren and Tapia [1] presented a model that uses simple motion sensors to recognize activities.In abnormal activity detection research, Yin et al. [8] proposed a two-step approach for abnormal activity detection based on attached sensors.The authors have first built a one-class support vector machine (SVM) to filter out most normal activities, and then they derive abnormal activity models through kernel nonlinear regression (KNLR).
However, according to [9,10], due to the network lag of centralized methods possibly resulting in detecting errors, they cannot meet the real-time demand.Hence, other researches have used distributed methods [11] trying to alleviate the drawbacks in centralized methods.Hasan et al. [2] presented a distributed probabilistic model for activity recognition of daily life and experiments show that with enough labeled data, this model recognizes the activities successfully.Amft et al. [12] proposed a distributed model for online recognition of user activities.The authors have used a two-layer model based on the concept that activity sequences are composed of activity events, and activity events are composed of atomic activities.But [2,12] define activity merely by the trigger sequence of sensors.Lee and Mao [13] present an anomaly detection mechanism based on correlation graphs of sensor network for identifying abnormal home events.Most of the mechanism merely works well in specified abnormal event detection because of only trajectory being taken into account, while the duration was ignored.
As far as we know, there is no similar research on the abnormal activity detection by feature-based statistics and unsupervised method which is significantly different from the traditionally used method (detecting the abnormality by recognizing the activity first).Hence, in this paper we have proposed the overall research on the distributed abnormal activity detection system, including definition of activity model, detection mechanism, detection algorithm, and verification method.

Activity Model and Activity Variation
In this section, we describe the details of our proposed activity model and the concept of activity variation.Figure 1 depicts the structure and sensor layout of a realistic smart home test bed, where an old man lives alone for the help of health and security monitoring.

Activity
Model.Now we define the terminologies used in this work.Let M = { 1 ,  2 ,   , . . .,   } be the set of all the motion sensor nodes, which are installed across the smart environment space. is the number of sensor nodes.The location of node   is used to represent the user's position when his movement is detected by   .We know that nearly all people walk with a nonuniform velocity.So the periods of these sensors being activated during the activity are varied and are much longer than the specified sampling time segment.Thus in our model, the activity is made up of basic activities which are composed of atomic activities.
An atomic activity     = (   ,     ) represents the trigger of one sensor node    in the smart environment, where    ∈ M, and     is the triggered time of    in th sampling period and 0 <  <   where   is the number of sampling period when a person passes by    .
A basic activity    = { In this paper, sensors have been divided into FUNC-TIONAL sensors and REGULAR sensors according to the deployment location for data segment.In order to mine more valuable knowledge from sensors triggering history data, a complete trajectory set T  {   1 , . . .,     } should satisfy    > 1,    1 , and     are FUNCTIONAL sensors which have a similar purpose with bNode and eNode in [14] (valid trajectory must begin with bNode (signed-come) and end with eNode (signed-leave)).Taking  3 in Figure 1 as an illustrating example,  3 = {( 18 , 30), ( 19 , 15), ( 10 , 20), ( 21 , 10)},   3 = { 18 ,  19 ,  10 ,  21 },  18 and  21 are both FUNCTIONAL sensor; thus,   3 is a complete trajectory set.The purpose of our work is to detect whether an activity is normal or not, so the normal activity should be defined first.Definition 1.When the frequency of an activity   appearing in the collected data, which we defined as   , exceeds a specific threshold, the activity   is considered as normal activity.
In trajectory-based activity recognition, the temporal relationship is merely the foundation of sequence determination [12], and this could lead to errors of activity recognition.Taking activity  1 and activity  3 as an example, the activity  1 in dashed lines has the same trajectory with the activity  3 in curves, but there is a significant difference in the duration of  18 .In trajectory-based recognition,  1 and  3 will be considered equal, but they are possibly different activities because of the difference in duration.Hence, durationdependent activity model is needed.
Fuzzy Logic [15] is adopted to measure the duration time    .In contrary to traditional logic, fuzzy logic substitutes the truth value that ranges between completely true and completely false for binary value.Fuzzy inference system (FIS) [16] consists of (i) Membership Function.We choose trapezoidal function as membership function to reduce the computational complexity [17].The relevant parameters are set according to the classification of duration.
(ii) Rule Base.The duration    is divided into three levels: short, medium, and long; thus, the goal of FIS is to calculate probabilities of    being short ( S   ), middle ( M   ), and long ( L   ).As a result,  = (   ,    ) can be redefined as  = (   , ( S   ,  M   ,  L   )).In this paper, the rule base is that short duration ranges from 0 to t2 , medium duration ranges from t1 to t4 , and long duration starts from t3 , where 0 < t1 < t2 < t3 < t4 (as shown in Figure 2).Each and    is set according to the location and monitoring area of   .
(iii) Defuzzifier.The mean of maximum method is the most suitable for our approach.

Activity Variation
Activity Variation.It is a common sense that the same pattern of activities may not be repeated exactly the same.So some small differences between these same activities are shown in spatiotemporal information of data set.According to the definition of activity model, the activity variation which contains trajectory variation and duration variation is introduced to measure these tiny differences.
Duration (s) (i) Trajectory Variation.Take  1 and  2 in Figure 1  ( Definition 2. Abnormal activity is defined as the one which has a great deviation in the data against normal activities.According to the proposed (2), abnormal activity can be calculated as follows: for an activity   , if there is not any known normal activity patterns   which makes their A  ≤ ,   could be judged as abnormal activity.
If hash function is employed [18], then the time complexity of (2) can be () and the limitations of space prevent us from covering hash function in this paper.

DetectingAct
The process of DetectingAct is as follows.Firstly, it extracts the normal activity patterns from the original data and introduces compression algorithms to reduce the number of mined patterns of activity.Secondly, it stores the mined patterns in each node according to the storage mechanism.Thirdly, it detects the abnormal activity using the distributed detecting algorithm.

Frequent Pattern Mining, Compression, and Storage.
In order to detect the abnormal activity, it is necessary to mine normal activity patterns from the sensor data.Currently, most of the learning algorithms for sensor data are supervised which requires large amounts of labeled data, so the unsupervised learning algorithm can save labor and accelerate the learning speed [19].Based on the Definition 1, it is feasible to use frequent pattern mining technique [19] to mine normal activity patterns.By the frequent pattern mining technique [19], if the frequency of an itemset, which is an activity in this paper, exceeds the minimum support threshold , it is a normal activity.Each path from root node to leaf node represents a pattern   , and the minimum support count in the path is the frequency   of the pattern.(1, 0, 0) (1, 0, 0)     is the last triggered sensor,   is the corresponding duration probability, and   is the corresponding type information about frequent patterns [17].According to the definition of activity model, the FP-Tree for trajectory-based mining cannot meet the requirement in this paper; thus, duration-dependent FP-Tree is proposed.Taking  1 and  3 in Figure 1 as an example, due to the same sequences of triggered sensors, trajectory-based FP-Tree cannot distinguish the difference between  1 and  3 .However, in our durationdependent FP-Tree, if we set  < 1,  1 and  3 can be detected as different activities.Figure 3 shows the difference between these two FP-Tree patterns.Before introducing the mining algorithm durationdependent frequent pattern mining algorithm (DFPMA), related variables are defined in Table 1.The mining algorithm is shown in Algorithm 3.
Here we explain the   function in Line 3 and Line 5. The function  ((  ,   ), (  ,   )) is to insert the node (  ,   ) into - as the child node of (  ,   ), and  (  ,   ) is to insert the node (  ,   ) into - as the child node of root node.If there exists the node (  ,   ), which is the child node of (  ,   ), or the root node that |  −  | ≤  (calculation method is explained in Algorithm 2) and   =   , then the support count of (  ,   ) is incremented by 1.If not, the node (  ,   ) will be inserted into -tree as the new child node of root node or (  ,   ).
Considering the limited storage of sensors, it is necessary to compress mined frequent patterns.Thus, normal patterns compression algorithm (NPCA) is introduced.It is shown in Algorithm 4 and related parameters are defined in Table 2.
In order to detect abnormality distributedly, normal activity patterns need to be stored in each sensor.Distributed knowledge storage mechanism (DKSM) is introduced to store the knowledge distributedly.DKSM consists of sensor ID   , sensor type type  , and an activity table  V .The  V  of sensor 16 in Figure 1 is shown in Table 3.
Field previous sensor stores the sensor IDs before triggering  16 in normal patterns.Previous duration probability stores the probability of duration corresponding with previous sensor and own duration probability stores the probability of duration corresponding with  16 .According to the proposed storage mechanism, mined activity patterns are stored in each relevant room sensor separately.4).Then, sensor 19 updates the state-change message and broadcasts it to the neighboring sensors (Step 2 in Figure 4).When the next sensor, sensor 10, is triggered, it can restructure the present activity through the statechange message received from sensor 19 and compare it with  V .Finally, the activity will be labeled by each sensor it passes, and if any sensor marks it abnormal, then the activity will be considered abnormal.

Distributed Abnormal Activity Detection Algorithm.
According to Definition 2, distributed abnormal activity detection algorithm (DAADA) is proposed and the related parameters are defined in Table 4.The detection algorithm is shown in Algorithm 5, and the time complexity of the algorithms is ( 2 ).

Experiments
To prove the feasibility and to estimate the accuracy of DetectingAct, the simulation experiment and the real experiment are conducted.

Simulation Experiment.
As a simulation example with ground truth, we adopt smart environment simulator tool [14] to simulate the motion sensor-based smart environment and manually set the knowledge instead of real environment training.
(i) Sensor.We set up a total of 35 sensors in the simulation environment which is shown in Figure 5.
(ii) Trajectory. 10 normal trajectories whose average length is 12 and that reflect the typical situation when user lives in the simulation environment are designed.
(iii) Duration.According to sensor   's location and basic features, 3 kinds of  rule are designed to be applied to corresponding sensors: (1) {2, 4, 6, 8} for the sensor used for detecting passing by such as sensor in hallway;  Step 3: execute the algorithm Normal patterns of sensor 10 Step 2: broadcast message (1, 0, 0) (0, 1, 0) (0, 1, 0) (1, 0, 0) (0, 1, 0)  (2) {1, 3, 9, 11} for the sensor in the area where people may stay a few minutes such as washroom; and (3) {0.5ℎ, 2ℎ, 7ℎ, 8ℎ} for the sensor in the area where people will stay a longer time such as sensor in bed or sofa.Meanwhile, their corresponding  V   and the duration of staying    (simulating some activities which without moving such as reading) are set in suitable values by manual.
After these settings, the simulation detection system corresponds to a real system which has completed the operation of the DFPMA, the NPCA, and the DKSM.
Detecting.   = {   ,    ,    ,    }, the transition probabilities of each sensor, is set to compute the possibility of which neighbor node will be triggered next.Taking the system in Figure 5 as an illustrating example, if any user will trigger  28 , he must trigger one of { 27 ,  23 ,  26 ,  24 } according to transition  28 →  27 ,  28 →  23 ,  28 →  26 ,  28 →  24 .If we set    = {0.3,0.2, 0.4, 0.1}, then he is most likely to choose the trajectory  28 →  26 but it is also possible to do the other three trajectories.We let the user randomly select trajectory from the 10 designed trajectories, and without strictly following the original design, in other words, depending on    , user can change the given route.So after repeating for 85 times, 85 trajectories are generated and only 3 of them are exactly the same as the designed, the rest are more or less different.By our algorithm, 64 abnormal trajectories are detected, and trajectory-based method [20] labels 81 abnormalities, but in fact only 63 real abnormalities are generated (as we motioned above different trajectories may represent the same activity).The result is shown in Table 5 and Figure 6(a).
Taking duration into consideration, there are two important indexes in the simulation experiment.First, the averagespeed is denoted by   , where  is the identification of SensorID (in theory the average-speed is a concept corresponding with every connected node-pair, but in the simulator tool we should set various speeds in each sensor to control the average-speed).Second, the variance-speed is denoted by   indicating the variance of   .In detecting, the user also randomly selects trajectory from the 10 designed and strictly follows it.Meanwhile, when he is passing by   , the   is randomly chosen from 0.5 m/s to 1.4 m/s,   is randomly chosen from 0.13 m/s to 0.37 m/s, and the    is modified manually.After repeating for 45 times, 45 trajectories are generated with ununiform durations.In fact, 32 abnormalities are generated.And 31 abnormal trajectories are detected by our algorithm; however, trajectory-based method [20] completely failed.The result is shown in Table 5 and Figure 6(b) Simulation experiment is designed to test the accuracy, real-time property, and stability of DetectingAct.
Accuracy.Experimental results under variation threshold  = 0.24 are as shown in Table 5.It illustrates the different capacity between DetectingAct and trajectory-based method [20] in discovering abnormality.Then, the statistical comparison chart of the two test results is given in Figures 6(a) and 6(b).
The accuracy rate and precision of distributed detection have reached 96.2% and 94.3%; both are superior to the algorithm based on trajectory.
Real-Time Property.The parameter average detection distance (ADD) is designed to measure the real-time property, and ADD is calculated as follows: International Journal of Distributed Sensor Networks |  | is the length of   and  leni is the number of triggered sensors when making decision.Experimental results are as follows: the ADD of DetectingAct is 78.2% which is better than the centralized detection algorithm.
Stability.The increasing amount of data and artificially raising of variation threshold lead to the increasing of false rate ((FP+ FN)/ALL); in order to study the stability of DetectingAct, we take the variation threshold value as a variable, collecting a number of detected results within two-day test data.The results are as follows.
Figure 7 shows the following.(1) Under the same data environment, the larger  is, the higher the compression ratio and the false rate are.However, with appropriate thresholds selection, with appropriate thresholds selection is able to achieve a good balance between the compression ratio and the false rate.(2) The false rate is increasing as the amount of data increases, but the growth is limited and the false rate is acceptable.Thus, DetectingAct also keeps strong stability.

Real Experiment.
In this section, a real experiment is conducted to prove the feasibility and to estimate the accuracy of DetectingAct.complexity of the main statement in Line 7 of Algorithm 5 is (), the time complexity of the DAADA is ( 2 ).The sensor nodes chosen for real experiment are TelosW due to its three advantages which are as follows.
(i) Using MSP430 with a considerable computing capacity as MCU (microcontroller), TelosW can meet the computational demands of DetectingAct.
(ii) Having the wake-on sensing capability, TelosW can construct a completely event-driven wake-on sensor network that remarkably reduces energy consumption.
(iii) Being equipped with an onboard energy meter TelosW can precisely measure in situ energy consumption making it possible to practically analyze energy-efficient protocols.
TelosW has the flash storage of 1 MB, which means that if the average length of stored pattern is 10, then 1024 * 1024(BYTE)/((2 + 4 + 4 + 4)(BYTE) * 10) = 7489 patterns can be stored in each sensor.So the storage of patterns is feasible.The sampling frequency is set sampled once every 0.1 seconds, and the continuous two or more triggers can be considered as the real triggers of nodes, which is to avoid generating dirty data because of signal interference.After using the TinyOS to execute the performance test on TelosW nodes, the experimental results are shown in Table 6.

Experimental Setup and Results
. The test bed for validating our algorithms is a workplace located on the Chongqing University campus.The experiment allows participants to find the specified room within the workplace.A total of 12 student volunteers are invited to participate and divided into two groups.Members of group 1 are familiar with the environment, while members of group 2 are not.About  the building which is shown in Figure 8.The deployed sensor node is TelosW and the sample position of sensor node is represented in Figure 9. Two experiments are conducted to validate the effectivity of DetectingAct, and six tasks, which need participants to start from specific rooms and find other specific rooms in the workplace, are designed.For example, task 522-523 represents that the participant should start from NO.522 room and find NO.523 room.Furthermore, the specified room is randomly appointed in order to ensure the fairness of the results.In the first experiment, each participant in group 2 is invited to accomplish the assigned tasks.In the second experiment, participants of group 1 are asked to repeat the same tasks under a different experimental condition.
Training.Before the beginning of the experiment, the detection system is set up by using a real-world trajectory dataset which is generated by three weeks of normal daily life in the test bed of group 1.Based on the collected data and proposed DFPMA, 762 activity patterns are extracted.After that, the related knowledge is distributedly stored into each sensor node by utilizing NPCA and DKSM, and the details are shown in Table 7.
Familiarity and Unfamiliarity.In the first experiment, each participant must finish the six tasks alone without prompting or interference.Their trajectories with durations are tracked to implement the real-time abnormal activity detection by utilizing DAADA as shown in Algorithm 5. From Table 8, we can see that, in practice, the numbers of sensors that participants triggered in the same task mostly have significant difference; in other words, the unfamiliar participant International Journal of Distributed Sensor Networks (stranger) makes an uncommon trajectory which is different from the regular pattern; therefore, it can decide whether the activity is normal.Taking task 516-500 as an example, Figure 10(a) illustrates the detection process in details.The participant's trajectory is detected in real-time to match the approximate normal patterns.According to the first four triggered sensors, the present trajectory indicates a great possibility of pattern 2 stored in sensors.However, from 12.5 seconds it deflects from the previous possibility of pattern 2 and mismatches any normal patterns.So this activity is labeled as abnormal at the 5th sensor.
Normal versus Interfered Experimental Condition.In the second experiment, participants of group 1 are required to simulate abnormal situation.The real abnormal phenomena, such as illness and tumble, are difficult to simulate.Therefore, some disturbances, such as giving a call to a random participant during the task or arranging some publicity announcement column in the corridor, are added into the task to distract the participant's attention for simulating the approximate abnormal phenomenon.Due to employing distributed method instead of centralized computing which collects data and detects abnormality only after accomplishing the whole activity, our algorithm real-timely detects abnormality without waiting for the completion of activities, so that the performance of real-time is greatly enhanced by DetectingAct.Therefore, the interferences are randomly generated without too former or too later to avoid deliberate effect on the efficiency of detection.The result is shown in Table 9, which illuminates that the same tasks have the same number of triggered sensors whether the experimental condition is normal or interfered, but the durations are obviously different when the participant is interfered.Depending on the difference, the activities can be efficiently decided whether it is normal or abnormal by using DetectingAct.Taking task 523-507 as an example, Figure 10 .According to the consecutive sequence of trigged sensor and interfere, the present trajectory closely matched one of the normal patterns (pattern 2).However, when the participant is interfered after the 11th sensor, the trajectory keeps to be the same as before, but the duration significantly changed; then, this activity is

Conclusion
Based on the spatiotemporal information of data, this paper defines activity model and proposes DetectingAct which takes full advantage of computing and storage resources in each sensor node to detect abnormal activity.According to the definition of activity, we introduce the mining algorithm, the compression algorithm, and the storage mechanism to mine, compress, and store normal activity patterns.To detect abnormality distributedly, we apply the protocol AADP and the algorithm DAADA.The real experiment and the simulation experiments prove the feasibility and performance of DetectingAct.

Figure 1 :
Figure 1: Basic structure of smart environment.Based on the position of sensors, sensors are divided into FUNCTIONAL sensors and REGULAR sensors.The lines represent the activity of trajectory and the tuples in the line express the ID and the duration of sensor.

Figure 2 :
Figure 2: Rule base: the three levels of duration.
FP-Tree.Frequent-pattern Tree, or FP-Tree in short, is an extended prefix-tree structure storing crucial, quantitative International Journal of Distributed Sensor Networks

Figure 3 :
Figure 3: Difference between two types of FP-Tree.(a) The right one is trajectory-based FP-Tree and (b) the left one is duration-dependent FP-Tree.

Figure 5 :
Figure 5: The simulation smart environment with motion sensor installed.

Figure 6 :
Figure 6: The result of contrast test in simulation experiment.

Figure 8 :
Figure 8: Motion sensor network deployment in a smart workplace environment.The sensor node position and SensorID are shown.

Figure 9 :
Figure 9: The smart environment example deployed with motion sensors.
as an example that   1 =  18 →  19 →  19 →  21 , but   2 =  18 →  16 →  19 →  19 →  21 ; actually, they represent the same activity.This shows that some tiny differences are in trajectories which represent the same activity.Hence,    cannot be defined by only one specified trajectory data set and the trajectory variation, which is measured by T V, is introduced to describe these tiny differences in trajectories.Then, the variation between two trajectories,    and    , is computed using  V (   ,    ) |   −    | represents the count of item   that   ∈    and   ∉    .|||− |   || expresses the difference in length between    and    .(,    ) calculates the difference in sequence between    and    , and the details are shown in Algorithm 1.As mentioned above,  1 and  3 in Figure1are not the same activity due to the significant difference of duration in  18 .Although another   = {( 18 , 11), ( 19 , 15), ( 10 , 25), ( 21 , 13)} is not exactly the same with  1 , the difference between the duration of them is slim.In fact  1 and   are the same activity, so some tiny difference of duration between the two same activities is reasonable.Thus,      ,    : trajectory set Output: S : the difference in sequence between    and    .(1) extract the subset     ⊆    and     ⊆    in which the items correspond to the items in    ∩    ; (2) S  = 0; (3) for  ← 1 to size of     do (4) if     [] ̸ =     [] then    ,    ,    ,    ,  Output: D V: the difference in duration between    and    .(1) extract the subset     ⊆    and     ⊆    in which the items correspond to the items in    ∩    ; (2) D V = 0; (3) for  ← 1 to size of     do (4) get    ,  M  ,  L  from     [] and    ,  M  ,  L  from     [];  is defined to measure the similarity, and if A  ≤ ,   is considered similar to   .Consider - (  ,   ) =  V (   ,    ,   ,   ) = MIN (         −         ,         −         ) +                   −                   +  (   ,    ) = T V.(ii) Duration Variation. cannot be defined by only one specified duration data set, and the duration variation, which is measured by D V, is introduced to describe these tiny differences in durations.Then, the variation between two activities' durations,    and    , is calculated using Algorithm 2 where  is the duration threshold.Based on (1) and Algorithm 2, A  in (2) is introduced to measure activity variation.The variation Input: Input: (5) if        −        >  or      M  −  M      >  or      L  −  L      >  then threshold

Table 1 :
Definitions of variables related to Algorithm 3.   ,   ,     is the current triggered sensor and   is the corresponding duration probability.  is the type of   (FUNCTIONAL sensor or REGULAR sensor)   ,   ,

Table 3 :
The  V  of  16 .
for AADP to record the present activity and it is composed of the previous triggered sensor set    and corresponding duration probability    .Assuming that one user follows the activity  1 in Figure1and when the sensor 19 is triggered, it first executes the detection algorithm, which takes advantage of the knowledge in the sensor and the data in state-change message, to decide whether the current activity is normal

Table 4 :
Definitions of variables related to Algorithm 5.   ,   ,     is the current sensor,   is the duration probability of   , and   is the current activity    ,    They are all extracted from the latest -ℎ message (Step 1 in Figure Normal patterns of sensor 19

Table 5 :
Ground truth versus discovered abnormalities.

Table 7 :
The number of patterns stored in sensor.

Table 8 :
The number of sensors triggered by familiar versus stranger.

Table 9 :
Duration and number of sensors triggered in normal versus interfered (Normal versus Interfered).Task504B-521 shows similar result.From Figures11(a) and 11(b), it can be seen that, in practice, experimental results demonstrate the effectiveness and suitability of our approach.
labeled abnormal at the 12th sensor.