Hyperspectral anomaly detection method based on random histogram forest

Abstract

The present invention proposes a hyperspectral anomaly detection method based on random histogram forest, which mainly solves the problem of poor detection performance caused by random selection of samples and segmentation attributes in the prior art. The scheme includes: 1) preprocessing the hyperspectral image based on dimensionality transformation and normalization operation; 2) constructing a random histogram forest based on the kurtosis segmentation criterion to train and test all sample instances; 3) calculating the Mahalanobis distance of each sample instance and performing anomaly evaluation to obtain the detection result; 4) using a nonlinear operation with exponential constraints to fuse the detection results of the random histogram forest and the Mahalanobis distance to obtain the final detection result. The present invention can better utilize the characteristics of hyperspectral images, has good detection performance, effectively improves the accuracy and robustness of the anomaly detection algorithm, and has universal applicability to the application scenarios of hyperspectral anomaly detection.

Description

Technical Field

[0001] The present invention belongs to the field of machine learning technology, and further relates to hyperspectral anomaly detection, specifically a hyperspectral anomaly detection method based on random histogram forest, which can be used for network intrusion detection, medical care, marine survey and target recognition, etc. Background Art

[0002] Hyperspectral images contain both spatial and spectral information, thus providing more reference value for target recognition, classification and detection. Hyperspectral anomaly detection refers to the detection of pixels in hyperspectral images that are different from general observations. These pixels show abnormal characteristics in both spatial and spectral information. Due to the complex and diverse spectral characteristics of targets and backgrounds in hyperspectral images, and the serious imbalance problem in sample classification, traditional detection methods based on supervised learning often find it difficult to achieve good detection results. In contrast, unsupervised anomaly detection methods can detect abnormal pixels that are different from normal pixels without the need for prior knowledge and a large number of labeled samples, so they are widely used in hyperspectral anomaly detection.

[0003] In recent years, unsupervised anomaly detection methods can be divided into the following four categories: (1) methods based on statistical tests, such as probabilistic principal component analysis, histogram-based anomaly scores, and one-class support vector machines; (2) methods based on proximity, such as K nearest neighbors and local anomaly factors; (3) methods based on distance, such as Mahalanobis distance; (4) methods based on integration / isolation, such as isolation forests. Currently, the most commonly used unsupervised method in hyperspectral anomaly detection is isolation forests. Isolation forests consist of two main parts: training isolation forests and calculating anomaly scores. The process of training isolation forests is as follows: first, randomly select sample points from the training data as subsamples and put them into the root node; then randomly select an attribute and its split value to divide the subsamples into left and right branch spaces; then, for each branch space, repeat the above steps until the termination condition is met, such as reaching the maximum depth of the tree or the number of sample points in the branch space is less than or equal to a preset threshold; finally, the trained isolation forest is used to detect whether the new data point is an anomaly and calculate the anomaly score. However, the hyperspectral anomaly detection based on isolation forest still has the following problems: 1) Training sample selection problem: The training samples of isolation forest are randomly selected. If the number of samples in the training set is too small, or the distribution of the training samples is inconsistent with the distribution of the test set, the performance of isolation forest may be affected. 2) Sample distribution problem: In hyperspectral data, the distribution of normal samples and abnormal samples is usually uneven, which will affect the performance of isolation forest and increase the false alarm rate of detection. 3) Segmentation attribute selection problem: For a node, the isolation forest is segmented by randomly selecting an attribute instead of selecting the optimal attribute, which will result in the selected attribute not being able to distinguish abnormal points strongly enough, thus affecting the detection performance. Summary of the invention

[0004] The purpose of the present invention is to propose a hyperspectral anomaly detection method based on random histogram forest to solve the problems of the existing technology in training sample selection, sample distribution and segmentation attribute selection. Compared with the existing hyperspectral anomaly detection method based on isolation forest, the present invention better mines the spatial and spectral information of hyperspectral images by integrating the Mahalanobis distance and random histogram forest methods, and solves two problems: first, how to make full use of the spatial and spectral feature information of the training sample data to construct a random histogram forest and improve the model's ability to detect anomalies; second, for hyperspectral images, how to more significantly distinguish between background and anomalies to improve the accuracy of the model. The present invention can more effectively select training samples and deal with the problem of unbalanced sample distribution. At the same time, the new segmentation attribute selection and anomaly score calculation method adopted by the present invention not only has better detection performance, but also can better utilize the characteristics of hyperspectral images, and is suitable for various hyperspectral anomaly detection application scenarios.

[0005] The basic idea of ​​the present invention is as follows: first, the three-dimensional hyperspectral image is converted into a two-dimensional matrix, and the sample instances are normalized under each band attribute; second, all sample instances are used as input samples to construct a random histogram forest for training and testing to obtain the detection results; then, the Mahalanobis distance of each sample instance is calculated for anomaly evaluation to obtain the detection results; finally, the detection results of the random histogram forest and the Mahalanobis distance are fused based on a nonlinear operation with exponential constraints to obtain the final detection results.

[0006] The present invention achieves the above-mentioned purpose by the following specific steps:

[0007] (1) Hyperspectral image preprocessing:

[0008] (1.1) The hyperspectral image X∈R r×c×b Convert to a two-dimensional matrix Y∈R m×b , where r, c, b are the height, width and number of bands of the hyperspectral image respectively, and m = r × c is the number of image samples; (1.2) For a given two-dimensional matrix Y∈R m×b , according to the attribute value, the normalization operation is performed to obtain the sample normalization matrix where d i represents the attribute matrix of the i-th sample, d i ={d i1 ,d i2 ,…,d ib}∈[0,1],d ib Represents the pixel value of the bth band of the i-th sample;

[0009] (2) Construct a random histogram forest model, train and test it, and obtain the detection results:

[0010] (2.1) Normalize the sample matrix As the root node of each random histogram tree;

[0011] (2.2) Calculate the kurtosis and sum of kurtosis of all band attributes f∈b of the hyperspectral dataset, and add them up in sequence as the endpoints of the histogram interval;

[0012] (2.3) Randomly select an attribute kurtosis value and select the segmentation attribute f of the corresponding interval r ;

[0013] (2.4) The segmentation attribute f specified in step (2.3) r A split attribute value V is randomly selected between the maximum and minimum values ​​of;

[0014] (2.5) According to the selected segmentation attribute f rThe data space of the current node is divided into two branch spaces, left and right, by using the split attribute value V. Then, samples less than the split attribute value V are placed in the left branch space of the current parent node, and samples greater than or equal to the split attribute value V are placed in the right branch space of the current node, to obtain a leaf node.

[0015] (2.6) In the left and right branches of the current leaf node, loop through steps (2.3)-(2.5) for each node, and continuously construct new leaf nodes until a leaf node that satisfies at least one of the following conditions is generated: (a) contains only one sample; (b) contains only one type of sample; (c) reaches the maximum depth of the tree; then terminate the generation of leaf nodes and continue with step (2.7);

[0016] (2.7) All leaf nodes are regarded as boxes in the histogram, and the information entropy of each leaf node is calculated using the data density frequency, which is used as the abnormal score value of the corresponding sample instance;

[0017] (2.8) Loop through steps (2.3)-(2.7) t times to construct t random histogram trees to form a random histogram forest. Then, for each sample, calculate its anomaly score in each tree and take the average value as the final anomaly score of the sample, i.e., the detection result of the random histogram forest.

[0018] (3) The Mahalanobis distance algorithm is used to detect anomalies in the preprocessed hyperspectral image:

[0019] (3.1) Calculate the sample mean M∈R of each band b×1 And remove the mean of all samples of the hyperspectral spectrum to obtain the mean removal matrix H∈R m×b ;

[0020] (3.2) Calculate the mean removal matrix H∈R m×b The covariance matrix Q∈R b×b ;

[0021] (3.3) Calculate the mean removal matrix H∈R m×b The Mahalanobis distance is obtained to obtain the Mahalanobis distance test result;

[0022] (4) A nonlinear fusion operation with exponential constraints is used to fuse the detection results of the random histogram forest and the Mahalanobis distance to obtain the final detection result.

[0023] Compared with the prior art, the present invention has the following advantages:

[0024] First, since the present invention introduces kurtosis as a guide for detecting anomalies, that is, introduces kurtosis as a basis for selecting the segmentation attributes of trees in the random histogram forest, kurtosis is a characteristic number that characterizes the height of the peak of the probability density distribution curve at the average value. The larger the kurtosis value, the sharper the peak, and the more significant the effect of distinguishing anomalies; compared with the isolation forest, it has higher reliability in the selection of input samples and segmentation attributes, and can better mine the spatial information and spectral information of hyperspectral images;

[0025] Second, the present invention introduces the histogram data density frequency as a quantitative analysis method for evaluating abnormal situations. By using the data density frequency of sample instances in the information entropy calculation of leaf nodes in the random histogram forest, the problem of poor performance of anomaly detection in the isolation forest is solved when the number of samples and the number of anomalies are large, thereby effectively improving the accuracy of anomaly detection.

[0026] Third, the present invention adopts a method combining Mahalanobis distance based on nonlinear transformation of exponential constraints and random histogram forest to detect anomalies. By detecting from multiple angles, the defect of detecting anomalies from a single angle is overcome. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 Flow chart for realizing the method of the present invention;

[0028] Figure 2 The figure is a histogram of AUC values ​​corresponding to the present invention and the isolation forest method. DETAILED DESCRIPTION

[0029] In order to more clearly illustrate the beneficial effects and purposes of the present invention, the technical contents of the present invention are described in detail below with reference to the accompanying drawings.

[0030] See also Figure 1 The invention proposes a hyperspectral anomaly detection method based on random histogram forest, which uses the kurtosis segmentation criterion and the information entropy of the density histogram to train and test the random histogram forest model, and nonlinearly fuses the detection results of the random histogram forest with the detection results of the Mahalanobis distance, so as to further optimize the detection performance. Specifically, the method includes the following steps:

[0031] Step 1. Hyperspectral image preprocessing:

[0032] (1.1) The hyperspectral image X∈R r×c×b Convert to a two-dimensional matrix Y∈R m×b , where r, c, b are the height, width and number of bands of the hyperspectral image respectively, and m = r × c is the number of image samples; (1.2) For a given two-dimensional matrix Y∈R m×b , according to the attribute value, the normalization operation is performed to obtain the sample normalization matrix where di represents the attribute matrix of the i-th sample, d i ={d i1 ,d i2 ,…,d ib}∈[0,1],d ib Represents the pixel value of the bth band of the i-th sample;

[0033] Step 2. Build a random histogram forest model, train and test it, and obtain the detection results:

[0034] (2.1) Normalize the sample matrix As the root node of each random histogram tree;

[0035] (2.2) Calculate the kurtosis and sum of kurtosis of all band attributes f∈b of the hyperspectral dataset, and add them up in sequence as the endpoints of the histogram interval; the calculation of the kurtosis and sum of kurtosis of all band attributes f∈b of the hyperspectral dataset is implemented as follows:

[0036] (2.2.1) Calculate the kurtosis value of each band attribute f∈b in the hyperspectral data. The formula is as follows:

[0037]

[0038] Among them, X f is the attribute of any band of the hyperspectral spectrum, μ is the mean of the sample distribution in the hyperspectral band, σ is the standard deviation of the sample distribution in the hyperspectral band, and μ4 is the kurtosis;

[0039] (2.2.2) The sum of the kurtosis logarithms of all band attributes in the hyperspectral dataset is calculated according to the following formula: s :

[0040]

[0041] (2.3) Randomly select an attribute kurtosis value and select the segmentation attribute f of the corresponding interval r , the steps are as follows:

[0042] (2.3.1) From X f ~U[0,F s ] randomly select a hyperspectral band attribute kurtosis total value g:

[0043] g=X f ~U[0,F s ],

[0044] Used to score higher than average kurtosis values ​​in hyperspectral data The band attribute f∈b is assigned a higher probability value;

[0045] (2.3.2) According to the g value randomly selected in step (2.3.1), determine the segmentation attribute f to be selected r , the expression is as follows:

[0046]

[0047] Among them, F(X k ) represents the kurtosis value of the k-th band attribute in the hyperspectral data.

[0048] (2.4) The segmentation attribute f specified in step (2.3) r A split attribute value V is randomly selected between the maximum and minimum values ​​of;

[0049] (2.5) According to the selected segmentation attribute f r The data space of the current node is divided into two branch spaces, left and right, by using the split attribute value V. Then, samples less than the split attribute value V are placed in the left branch space of the current parent node, and samples greater than or equal to the split attribute value V are placed in the right branch space of the current node, to obtain a leaf node.

[0050] (2.6) In the left and right branches of the current leaf node, loop through steps (2.3)-(2.5) for each node, and continuously construct new leaf nodes until a leaf node that satisfies at least one of the following conditions is generated: (a) contains only one sample; (b) contains only one type of sample; (c) reaches the maximum depth of the tree; then terminate the generation of leaf nodes and continue with step (2.7);

[0051] (2.7) All leaf nodes are regarded as boxes in the histogram, and the information entropy of each leaf node is calculated using the data density frequency, which is used as the abnormal score value of the corresponding sample instance; the information entropy of each leaf node is calculated, and the implementation steps are as follows:

[0052] (2.7.1) The leaf node information entropy P(L) of each random histogram tree is obtained according to the following formula:

[0053]

[0054] Where n is the number of all different instance samples of the hyperspectral spectrum, and S(L) represents a set of different instance samples associated with the leaf node L;

[0055] (2.7.2) The larger the abnormal score of the hyperspectral sample, the higher the abnormal probability. It is necessary to transform the leaf node information entropy of the random histogram tree into a form that can reflect the abnormal probability. By performing normalized logarithmic processing on the leaf node information entropy, the abnormal probability distribution is obtained, and the formula is as follows:

[0056]

[0057] Among them, RHT i (p) is the abnormal score value of the p-th instance sample in the i-th random histogram tree, L j is the jth leaf node under the i-th random histogram tree; S(L j ) represents the leaf node L j A set of different instance samples associated with each other. j ), the smaller the cardinality of , the fewer sample instances the leaf nodes in the random histogram tree contain, which proves that the greater the deviation between the divided samples and the normal samples under the specified band attributes, the greater the probability that the pth instance sample is considered an outlier.

[0058] (2.7.3) Calculate the average anomaly score of sample p under t random histogram trees, total RHT(p), according to the following formula:

[0059]

[0060] (2.8) Loop through steps (2.3)-(2.7) t times to construct t random histogram trees to form a random histogram forest. Then, for each sample, calculate its anomaly score in each tree and take the average value as the final anomaly score of the sample, i.e., the detection result of the random histogram forest.

[0061] Step 3. Use the Mahalanobis distance algorithm to perform anomaly detection on the preprocessed hyperspectral image:

[0062] (3.1) Calculate the sample mean M∈R of each band b×1 And remove the mean of all samples of the hyperspectral spectrum to obtain the mean removal matrix H∈R m×b ;

[0063] (3.2) Calculate the mean removal matrix H∈R m×b The covariance matrix Q∈R b×b ;

[0064] (3.3) Calculate the mean removal matrix H∈R m×b The Mahalanobis distance is calculated to obtain the Mahalanobis distance test result; the calculation formula is as follows:

[0065]

[0066] Among them, A i is the Mahalanobis distance anomaly score of the i-th sample instance of the hyperspectral spectrum, H i ∈R b×1 is the band attribute vector of the i-th sample instance, M∈R b×1 is the band mean vector, Q∈R b×b is the sample covariance matrix; the abnormal score value of the Mahalanobis distance of all hyperspectral samples is the Mahalanobis distance detection result.

[0067] Step 4. Use a nonlinear fusion operation with exponential constraints to fuse the detection results of the random histogram forest and the Mahalanobis distance to obtain the final detection result. Introducing the covariance matrix in the Mahalanobis distance can eliminate the interference of the correlation between the attributes of the hyperspectral bands.

[0068] The nonlinear fusion operation is implemented as follows:

[0069] (4.1) Based on the detection results of Mahalanobis distance, an exponential constrained nonlinear transformation function is constructed, and the expression is as follows:

[0070] k=1-e -γ×A

[0071] Where k∈R r×c represents the exponential constraint nonlinear transformation coefficient, γ is the exponential coefficient, and in this embodiment, the coefficient is set to 15; A∈R r×c represents the anomaly detection result of Mahalanobis distance;

[0072] (4.2) Using the exponential constrained nonlinear transformation function as the coefficient of the random histogram forest detection result, the random histogram forest and Mahalanobis distance fusion detection result J∈R is obtained. r×c :

[0073]

[0074] Among them, J∈R r×c Represents the random histogram forest and Mahalanobis distance fusion detection result; k∈R r×c represents the coefficients of the exponentially constrained nonlinear transformation based on the Mahalanobis distance; Indicates the multiplication operation of corresponding elements in the array; RHT∈R r×c Represents the anomaly detection result of the random histogram forest, that is, the average value of the anomaly detection result matrix obtained by all samples in all random trees.

[0075] Reference Figure 2 By comparing the area under the curve (AUC) value of the present invention with that of the isolation forest on the public hyperspectral anomaly detection datasets abu-urban-1, abu-beach-4 and abu-urban-3, it can be seen that the AUC value of the present invention is the highest, which indicates that the present invention can detect hyperspectral anomaly pixels more accurately. The higher the AUC value, the better the anomaly detection performance, as shown in Table 1:

[0076] Table 1 AUC value comparison table of the present invention and the isolated forest detection results

[0077]

[0078] According to the results in Table 1, it can be seen that compared with the isolated forest, the hyperspectral abnormal pixel detection effect of the present invention has significant advantages and the detection performance is optimal.

[0079] Parts of the present invention that are not described in detail belong to common knowledge among those skilled in the art.

[0080] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Obviously, for professionals in this field, after understanding the content and principles of the present invention, they may make various modifications and changes in form and details without departing from the principles and structures of the present invention. However, these modifications and changes based on the ideas of the present invention are still within the scope of protection of the claims of the present invention.

Claims

1. A hyperspectral anomaly detection method based on random histogram forest, characterized in that: The kurtosis segmentation criterion and the information entropy of the density histogram are used to train and test the random histogram forest model, and the detection results of the random histogram forest are nonlinearly fused with the detection results of the Mahalanobis distance to further optimize the detection performance. The specific steps include: (1) Hyperspectral image preprocessing: (1.1) The hyperspectral image X∈R r×c×b Convert to a two-dimensional matrix Y∈R m×b , where r, c, b are the height, width and number of bands of the hyperspectral image respectively, and m = r × c is the number of image samples; (1.2) For a given two-dimensional matrix Y∈R m×b , according to the attribute value, the normalization operation is performed to obtain the sample normalization matrix where d i represents the attribute matrix of the i-th sample, d i ={d i1 ,d i2 ,…,d ib }∈[0,1],d ib Represents the pixel value of the bth band of the i-th sample; (2) Construct a random histogram forest model, train and test it, and obtain the detection results: (2.1) Normalize the sample matrix As the root node of each random histogram tree; (2.2) Calculate the kurtosis and sum of kurtosis of all band attributes f∈b of the hyperspectral dataset, and add them up in sequence as the endpoints of the histogram interval; (2.3) Randomly select an attribute kurtosis value and select the segmentation attribute f of the corresponding interval r ; (2.4) The segmentation attribute f specified in step (2.3) r A split attribute value V is randomly selected between the maximum and minimum values ​​of; (2.5) According to the selected segmentation attribute f r The data space of the current node is divided into two branch spaces, left and right, by using the split attribute value V. Then, samples less than the split attribute value V are placed in the left branch space of the current parent node, and samples greater than or equal to the split attribute value V are placed in the right branch space of the current node, to obtain a leaf node. (2.6) In the left and right branches of the current leaf node, loop through steps (2.3)-(2.5) for each node, and continuously construct new leaf nodes until a leaf node that satisfies at least one of the following conditions is generated: (a) contains only one sample; (b) contains only one type of sample; (c) reaches the maximum depth of the tree; then terminate the generation of leaf nodes and continue with step (2.7); (2.7) All leaf nodes are regarded as boxes in the histogram, and the information entropy of each leaf node is calculated using the data density frequency, which is used as the abnormal score value of the corresponding sample instance; (2.8) Loop through steps (2.3)-(2.7) t times to construct t random histogram trees to form a random histogram forest. Then, for each sample, calculate its anomaly score in each tree and take the average value as the final anomaly score of the sample, i.e., the detection result of the random histogram forest. (3) The Mahalanobis distance algorithm is used to detect anomalies in the preprocessed hyperspectral image: (3.1) Calculate the sample mean M∈R of each band b×1 And remove the mean of all samples of the hyperspectral spectrum to obtain the mean removal matrix H∈R m×b ; (3.2) Calculate the mean removal matrix H∈R m×b The covariance matrix Q∈R b×b ; (3.3) Calculate the mean removal matrix H∈R m×b The Mahalanobis distance is obtained to obtain the Mahalanobis distance test result; (4) A nonlinear fusion operation with exponential constraints is used to fuse the detection results of the random histogram forest and the Mahalanobis distance to obtain the final detection result.

2. The method according to claim 1, characterized in that: In step (2.2), the kurtosis and sum of kurtosis of all band attributes f∈b of the hyperspectral dataset are calculated as follows: (2.2.1) Calculate the kurtosis value of each band attribute f∈b in the hyperspectral data. The formula is as follows: Among them, X f is the attribute of any band of the hyperspectral spectrum, μ is the mean of the sample distribution in the hyperspectral band, σ is the standard deviation of the sample distribution in the hyperspectral band, and μ4 is the kurtosis; (2.2.2) The sum of the kurtosis logarithms of all band attributes in the hyperspectral dataset is calculated according to the following formula: s :

3. The method according to claim 1, characterized in that: In step (2.3), select the segmentation attribute f of the corresponding interval r , the steps are as follows: (2.3.1) From X f ~U[0,F s ] randomly select a hyperspectral band attribute kurtosis total value g: g=X f ~U[0,F s ], Used to score higher than average kurtosis values ​​in hyperspectral data The band attribute f∈b is assigned a higher probability value; (2.3.2) According to the g value randomly selected in step (2.3.1), determine the segmentation attribute f to be selected r , the expression is as follows: Among them, F(X k ) represents the kurtosis value of the k-th band attribute in the hyperspectral data.

4. The method according to claim 1, characterized in that: In step (2.7), the information entropy of each leaf node is calculated. The implementation steps are as follows: (2.7.1) The leaf node information entropy P(L) of each random histogram tree is obtained according to the following formula: Where n is the number of all different instance samples of the hyperspectral spectrum, and S(L) represents a set of different instance samples associated with the leaf node L; (2.7.2) By performing normalized logarithmic processing on the leaf node information entropy, the abnormal probability distribution is obtained, and the formula is as follows: Among them, RHT i (p) is the abnormal score value of the p-th instance sample in the i-th random histogram tree, L j is the jth leaf node under the i-th random histogram tree; S(L j ) represents the leaf node L j A set of different instance samples associated with each other; (2.7.3) Calculate the average anomaly score of sample p under t random histogram trees, total RHT(p), according to the following formula:

5. The method according to claim 1, characterized in that: The Mahalanobis distance test result in step (3.3) is obtained according to the following formula: Among them, A i is the Mahalanobis distance anomaly score of the i-th sample instance of the hyperspectral spectrum, H i ∈R b×1 is the band attribute vector of the i-th sample instance, M∈R b×1 is the band mean vector, Q∈R b×b is the sample covariance matrix; the abnormal score value of the Mahalanobis distance of all hyperspectral samples is the Mahalanobis distance detection result.

6. The method according to claim 1, characterized in that: The nonlinear fusion operation in step (4) is implemented as follows: (4.1) Based on the detection results of Mahalanobis distance, an exponential constrained nonlinear transformation function is constructed, and the expression is as follows: k=1-e -γ×A Where k∈R r×c represents the exponential constraint nonlinear transformation coefficient, γ is the exponential coefficient, A∈R r×c represents the anomaly detection result of Mahalanobis distance; (4.2) Using the exponential constrained nonlinear transformation function as the coefficient of the random histogram forest detection result, the random histogram forest and Mahalanobis distance fusion detection result J∈R is obtained. r×c : Among them, J∈R r×c Represents the random histogram forest and Mahalanobis distance fusion detection result; k∈R r×c represents the coefficients of the exponentially constrained nonlinear transformation based on the Mahalanobis distance; Indicates the multiplication operation of corresponding elements in the array; RHT∈R r×c Represents the anomaly detection results of random histogram forest.

Images