40. SBAI - Simpósio Brasileiro de Automação Inteligente, São Paulo, SP, 08-10 de Setembro de 1999

A NEURAL NETWORK BASED INTRUDER DETECTION SYSTEM

Javíer R. Peláez & Marcelo G. SimõesUniversity of São Paulo, PMC-Mechatronics

fjavier@usp.br , mgs@usp.brAv. Prof. Mello Moraes, 2231 CEP 05508-900 - São Paulo - SP

2.0PERATIONS' SYSTEM OVERVIEW

Figure I shows that, during the test phase, beside each point,two numbers are written. The fírst number indicates lhemoment (in minutes) the person walks over lhe point location.

A neural network approach was chosen for the development ofthis system for two reasons. The fust one is lhe robustnessdemonstrated by neural networks in the pattern recognitionfield. The second one is that neural networks, once trained hasa very quickIy, quite immediate, response in recognizing tasks.This quick reaction is very important when the security of anapartment or building is at risk.

Figure 1. On line trajectory recognition. Near each pointthe first number indicates the instant and the second the

identification made by the neural network.The second is the code of the most probable person walkingover that point according to lhe neural network. The neuralnetwork guess is given online, and is corrected when morepoints of each trajectory are given. For that reason lhe neuralnetwork guess is refined during lhe course of the trajectory.

1210

.,.2 .' senlrl nce

Kitebcn

s -rccm ... , IW:ller- CIo.c

I.7 , .a 5 .9 ,. , .., ,

DcJ roo m

oo

ru

A simuIation was done for evaluating lhe possibilities of lheabove described system. In the simulation, differenttrajectories are input using lhe mouse over a house sketch. Theprogram was previously informed about lhe identity of thepersons that perambulates according to each trajectory. Eachtrajectory is associated to lhe identity of each waIker bytraining a neural network. After training, the performance ofthe system is tested by using other trajectories similar to thetraining ones. This ís also done by inputting , using the PCmouse, lhe sequence of points of lhe new trajectories.

12

Keywords: Security systems, neural networks, . trajectorygenerator.

Burglar aIarms are a common item in many houses of severalcountries. They allow the owner to program the system in orderto connect or disconnect sensors installed in several parts of thehouse in a determined timctable. The most common types ofsensors are infrared motion detectors, doors and windowsopening detectors and glass break detectors. When oneentrance is violated these system immediately communicatesthe event to a central alarm station or, alternatively, by phone,to the own user. Unfortunately, due to lhe inaccuracy of somesensors many of these events are false alarms that, in the longrun, makes lhe operator insensible to posterior reaI ones.During lhe last years many of these sensors have become muchmore sophisticated, and are capable of swelling and shrinkingtheir sensitivity to overcome problems like temperaturefluctuation, movement of littIe animaIs like birds or squirrels,or accumulation of dust in the sensors. Despite of theseimprovements, their robustness and smartness are far fromost of users' expectations. A persons' trajectory recognizerembedded in lhe systems' board would be able to use sensors'information not onIy for giving lhe remote operator aninformation about lhe presence of a person at home but also aninformation about lhe identity of that person. In other cases itwould be able to monitor baby-sitters positions with respect tolhe babies, in the case they are suspects of doing anunprofessionaI, or potentialIy dangerous job with the children.At present many parents are very much concerned about thisproblem that have had an important place in the media[l] .

1.1NTRODUCTION

Abstract: Most security systems are not able to identify thedifferent ways peopIe walk around inside a building. Moreoverinfrared detection systems lacks reliability and usually aretriggered by spurious events Iike heaters, animais, etc. Theneed of having a more robust and selective security systemhave led us to propose a neural network based security systemthat is able to rapidly detect a possible intruder with aminimum computational effort so that lhe system could beembedded in a cheap electronic board. Our system is composedof lhe next modules: a) A path generator b)A SOFMcompetitive network and c) A Widrow -Hoff patternassociator.

156

40. SBAI- Simpósio Brasileiro de Automação Inteligente , São Paulo, SP. 08·10 de Setembro de 1999

3.MAIN MODULES 4. PERFORMANCE ASSESSMENTFigure 2 shows the main modules that form the trajector, recognizer.

QI QTrajcctories QTrajectory ClassificationGenerator

. (SOFM)

CíassLabelling

(LinearNetwork)

In this section lhe system is trained to evaluate its performancein two different situalions which are the cause of manpeople's concern nowadays : burglary and baby-sittersupervisiono Four different volunteers were invited to sit infront of the cornputer and draw several trajectories using themouse . Each volunteer inputted tive trajectories for the caseof burglar detection and four trajectories for baby-siltersupervisiono Each trajectory consisted in 10 points with aninterval of one minute between successive positions.

Figure 2. System's main modules

3.1 Trajectory generator.This module saves every position of the trajectory givíngmore importance to the latest ones. This ís accomplished byaltering the values of a certain matrix T. This matrix reflectsthe status of a grid of sensors, each of them situated in aposition (i,j). Without any person perambulating the place thismatrix is zero . This matrix is filled along time, summíng avalue of I to the coordínate of the matrix that reflects theperson's position at that moment. When a person is quiet , avalue of I is added many times to the element of the matrixcorresponding to the person 's location. We use the hypcrbolíctangent in the equation for avoiding values bigger than 1 in thematrix. We have also placed a fading factor ç , typically ç=0.8, that multiplíes the whole matrix T at instam l-I forobtaining matrix T at time t. These explanations aresummarized in the next iterative equalíons:

T.t==!J =OI,)

T.t .=ÇT.t-:1 .O<ç <II,) I.)

T(i(t).j(t))= lanh(T(i(t ),j(t )}t-I)

In this way we obtaín a trajectory in whích the last point is Iand previous points have smaller values.

3.2 Trajectories classificationOnce we have generated the trajectories, this module classifiesthern into several clusters according to a distance criteria. Theclassification was obtained by means of a SOFM (SelfOrganizing Feature Map) [2)[3] neural network. The number ofneurons used in the SOFM competitive layer is, at least, equalto the number of ways we would like to classify persons'trajectories. This is because one type of person canperambulate dífferently in different situations . For example, aburglar can enter a housc in very different ways. Therefore lhetypes of trajectories are not always equal to the different typesofpersons.

3.3 Class labelingIn order to correcl\y associate various clusters of trajectories tothe same person we use a Widrow-Hoff [4] mie based neuralnetwork. We have selected this model instead of morecomplicated ones because patterns exiting SOFM network areorthogonal. Mapping orthogonal inputs into any kind 01'outputs is a relatively simple task for which a Widrow-Hoffmie based neural network is sufticient.

157

4.1 Application to burglars' trajectoriesidentificationEach volunteer imagined five types of trajectories belonging tothe next types of person entering the house:

1. A mother

2. A grandfather

3. A child.

4. A house rnaid

5. A burglar

The SOFM net was trained repeating the training set (5x5patterns) 2000 times .

After training, another 6 different volunteers were invited to sitin front of lhe computer and enter testing patterns to assessystem's performance. Each person entered one testin glrajectory for each of lhe above tive categories.

4.1.1 Wrong identification rate along time.

As was explained in section 2 each trajectory is forrned by tenpoints corresponding to ten successive minutes. When clickingany one of them , the neural network guess the identity of theperson until that time. When clicking the initial points of thetrajectory, the percentage of wrong identifications is high, butwhen more points are inputted the identification is moreaccurate. This fact is represented in Figure 3 in which each rowcorresponds to any of the tive type of persons entering thehouse and each column to lhe minute in which the recognitionattempt was done by lhe network. As it can be seen the numberof wrong identifications diminish with the passed time and , inthe case of the identification of the burglar (row 5) thepercentage of errors is very low from the very beginning.

Figure 3. Identification error during each type of person'strajectories.

40. SBAI- Simpósio Brasileiro de Automação Inteligente , São Paulo, SP, 08-10 de Setembro de 1999

4.1.2 Correlation rate between identifications.This measure allows us to know if the identification of any ofthe patterns has a bias towards other, for example identifying aburglar when the maid was entering the house. As can be seenin figure 4 only auto -correlations without any significant biaswas detected. Therefore lhe probability of false alarms biasedin a certain direction is minimal ,

Figure 4. Correlation between errors in'personsidentification.

4.2 Application to baby-sitter supervisionoIn this case lWO trajectories are input by each volunteer: onecorresponding to lhe baby sitter and one to lhe baby. Eachvolunleer imagined 4 situations:

1. Baby sitter near baby

2. Baby sitter seeing TV and baby playing in room.

3. Babysitter seeing TV and baby sleeping in roa

4. Baby sitter preparing meal.

4.2.2 Correlation rate among identifications.As it happens in lhe other case no significanl bias betweenidentifications was detected .

Figure 6. Correlation between errors in babysittersupervisiono

5. CONCLUSSIONSIn this paper we presented a neural network based intruderdetection system, capable of perfonn monitoring tasks, assupervising baby-sitters' work. It consists of three modules.The first one keeps lhe track of the moving person, the secondc1assifies lhe differenl tracks, and the third associates each oneof the classes to the person that produces them. The detectionerror rale diminishes through time, when each person's trackbecomes longer in both burglar and babysitters monitoringoperations. In both systems the probability of an error bias,namely to produce lhe same error over the same type ofpauern, is not significant.

6. REFERENCES

The SOFM net was trained repeating lhe training set (4x4patterns) 2000 times.

After training, another 7 different volunleers were invited to si!in front of the computer and enter testing patterns to assessystem's performance. Each person enlered one testingtrajectory for each of lhe above four categories.

4.2.1 Wrong identification rate along timeIn this case the percentage of errors is more uniformldistributed mainly to lhe fact of not having an initial positionfor each trajectory . Despite of this, in the last minutes thepercenlage of errar in identifícation is quite low.

Figure 5. Identification errors for babysitters monitoringtask.

158

[I]

[2]

[3]

[4]

SafeSiuers http://www.safesittcr.org/

Kohonen T., 1990, The Self-Organizing Map . Proceedings oflhe Institute of Electrical andlilectronics Ellgineers,78:1464-1480

Kohonen T., 1982, Self-organized formation of topo1ogical1correct feature maps. Biological Cybernetics 43:59-69

Widrow,G.,& Hoff, M.E., 1960, Adaptive switching circuits.Institute of Radio Engineers, WeSlem Electronic Show andConvention, Convention Record, Part 4, 96-104.