Ellipsoidal neighbourhood outlier factor for distributed anomaly detection in resource constrained networks

• Detecting anomalies in data is challenging on resource constrained networks.
• A hyperEllipsoidal Neighborhood Outlier Factor (ENOF) is proposed.
• A distributed algorithm using hypersellipsoidal clusters and ENOF scheme is proposed.
• Capable of identifying local and global anomalies at individual node levels.
• Achieves superior detection capabilities with minimal communication overhead.

Anomaly detection in resource constrained wireless networks is an important challenge for tasks such as intrusion detection, quality assurance and event monitoring applications. The challenge is to detect these interesting events or anomalies in a timely manner, while minimising energy consumption in the network. We propose a distributed anomaly detection architecture, which uses multiple hyperellipsoidal clusters to model the data at each sensor node, and identify global and local anomalies in the network. In particular, a novel anomaly scoring method is proposed to provide a score for each hyperellipsoidal model, based on how remote the ellipsoid is relative to their neighbours. We demonstrate using several synthetic and real datasets that our proposed scheme achieves a higher detection performance with a significant reduction in communication overhead in the network compared to centralised and existing schemes.