by Beatrix Koltai, Gergely Ács, and András Gazdag (Budapest University of Technology and Economics)
In telemonitoring, false alarms from medical devices can overwhelm doctors and desensitize care teams to critical issues. How could we reliably detect subtle yet critical changes in a patient’s health status without false alarms or missed anomalies? By correlating data across multiple sensors, our solution improves detection accuracy and results in fewer false positives. Utilizing federated learning, our model is collaboratively trained across multiple hospitals, each with potentially limited data. This improves the model’s performance without centralising sensitive patient data.
In telemonitoring, remote medical devices gather sensitive clinical data to detect abnormal changes, potentially life-threatening indicators of a sudden shift in a patient’s health status, known as anomalies. These data could be used to train machine learning models to solve this anomaly detection task. We applied a similar approach within the SECURED project. [L1] While traditional solutions trigger alarms based on changes in individual sensor readings, our approach leverages correlations between multiple sensor data streams.
This approach results in fewer false positives and false negatives, because it detects patterns that might be missed when relying on a single data stream. By correlating these signals across sensors, the system can also identify the warning signs sooner.
Anomaly detection exploiting multi-sensor data correlation
Our approach, which applies a similar concept presented in our previous paper [3], consists of two interconnected models:
- Forecasting Model: A time series forecasting model that predicts the subsequent sensor measurement based on prior readings of all the correlating sensors.
- Detection Model: Anomalies are flagged by the detection model when the difference between the predicted and actual values of any sensor exceeds a predefined detection threshold.
In other words, an anomaly is detected if any sensor’s measurement is “unpredictable” based on prior measurements, using a model trained on data predominantly from healthy patients (see Figure 1).
Figure 1: Illustration of the combined prediction of sensor data and anomaly detection when the measurement of one sensor is significantly different from its prediction.
The forecasting model is a Temporal Convolutional Network (TCN) [1] combined with a linear output layer that simultaneously predicts the next measurement of all sensors from their previous measurements while exploiting correlations across sensors. Convolutional networks, which form the basis of a TCN, are highly effective for structured data such as images and time series that exhibit local spatial correlation.
Two-dimensional convolutional filters can capture such local dependencies across different sensor signals, extracting meaningful features for predicting future measurements. By stacking multiple convolutional layers, these networks can progressively model broader, global dependencies in the data capturing complex patterns over larger contexts. TCNs employ dilated convolutions to model both short-range long-range dependencies in a sequence while maintaining efficiency and parallelism in training [2].
Dataset preparation
After cleaning and anonymizing an initial data set from medical devices taken in a real environment, the dataset consisted of five time series of eleven patients, each from a different device. Such a time series corresponds to one sensor’s readings.
Measurements were normalized and resampled to one-second intervals by keeping the very first measurement of every second, ensuring uniformity across data streams.
The optimal time range for each patient, where data coverage across sensors is highest, is identified and retained. Training samples are then generated using a three-minute sliding window, with the final value in each window as the prediction target. Windows lacking sensor data are discarded, while gaps in partially missing data are filled using linear interpolation.
Federated learning
In practice, hospitals often lack sufficient data to train accurate predictive models and are reluctant to share it due to GDPR concerns. As a result, centralized training of an anomaly detection model using shared data is not feasible.
Federated Learning (FL) offers a solution by training models collaboratively without directly sharing training data. Since hospitals can access only the shared model and not each other’s data, the risk of unintended information leakage is reduced, while achieving better accuracy than training models on local data alone.
To showcase the viability of federated learning for anomaly detection in telemonitoring, the forecasting model is trained by federated learning.
It is simulated by partitioning the preprocessed dataset randomly among clients in an independent and identically distributed (IID) setting. Each client participates in every federated round, performing one local training epoch on the shared forecasting model. For demonstration, the server calibrates the threshold for the detection model using held-out data in a supervised manner. A measurement value is labeled as anomalous if the difference from its preceding value exceeds a predefined ground-truth value, tau (τ). For each sensor, a distinct detection threshold is calibrated to maximize the F1-score on the labelled held-out data.
After calibration, the detection model, along with the collaboratively trained forecasting model, is tested on a separate dataset that was not used for either calibration or training.
Results and future work
We compare FL with centralized training, when one client has all the data. Figure 2 shows that the F1-score for anomaly detection approaches 1 when the number of clients is fewer than three and remains above 0.8 even with 10 clients, where centralized training corresponds to a single-client scenario. This indicates that Federated Learning (FL) incurs only a 10% degradation in detection accuracy. These findings demonstrate that FL is a promising approach for anomaly detection in telemonitoring. However, further evaluation with larger datasets and non-IID settings is needed to confirm its robustness and generalisability.
Figure 2 - Illustration of the F1-score results of the detection for different numbers of clients, with different ground-truth thresholds.
Link:
[L1] https://secured-project.eu
References:
[1] Y. Liu et al., “Time series prediction based on temporal convolutional network,” in Proc. IEEE/ACIS 18th International Conference on Information Systems (ICIS), 2019, doi: 10.1109/ICIS46139.2019.8940265.
[2] Y. He and J. Zhao, “Temporal convolutional networks for anomaly detection in time series,” J. Phys.: Conf. Ser., vol. 1213, p. 042050, 2019.
[3] B. Koltai, A. Gazdag and G. Ács, “Supporting CAN Bus Anomaly Detection with Correlation Data”, in Proc. of the 10th Int. Conf. on Information Systems Security and Privacy ICISSP; 2024, doi: 10.5220/0012360400003648
Please contact:
Beatrix Koltai
CrySyS Lab, HIT, VIK, BME, Hungary
bkoltai (at) crysys.hu
