"Learning Models of Normal Behavior and Anomalous Patterns from Time-Series of Human Activity"

Modern sensor technologies allow us to capture rich data sets related to human behavior. A common form of this data is aggregated time-series of counts, e.g., how many people enter and exit a building every 5 minutes, how many vehicles pass over a particular point on a road, how many users access a Web site, and so on. In this talk we will describe a general framework for separating normal patterns from anomalous events in such  data. Events are characterized as local "bursts" of activity that look anomalous relative to normal hourly and daily patterns of behavior. The difficulty with this approach (as is the case with any outlier detection problem) is how to identify what is normal and what is anomalous, given no labeled training data. I will describe a statistical learning framework to address this problem, where we model normal behavior by an inhomogeneous Poisson process, which is in turn modulated by a hidden Markov model for bursty events. The model and learning algorithms will be described within the general framework of graphical models. Experimental results will be illustrated using large real-world data sets collected over several months, involving people entering and exiting a UC Irvine campus building and data from freeway traffic sensors in the Southern California area. The talk will conclude with a brief discussion of open problems and ongoing work in this area, including linking these models to census data and satellite imagery data.