526 IEEE JOURNAL ON SELECTED AREAS IN COMMUNICATIONS, VOL. 39, NO. 2, FEBRUARY 2021 Markov Models for Anomaly Detection in Wireless Body Area Networks for Secure Health Monitoring Osman Salem , Khalid Alsubhi , Member, IEEE, Ahmed Mehaoua , and Raouf Boutaba, Fellow, IEEE Abstract—The use of Wireless Body Area Networks (WBANs) in healthcare for pervasive monitoring enhances the lives of patients and allows them to fulfill their daily life activities while being monitored. Various non-invasive sensors are placed on the skin to monitor several physiological attributes, and the measured data are transmitted wirelessly to a centralized processing unit to detect changes in the health of the monitored patient. However, the transferred data are vulnerable to various sources of interfer- ence, sensor faults, measurement faults, injection and alteration by malicious attackers, etc. In this article, we propose a change point detection model based on a Markov chain for centralized anomaly detection in WBANs. The model is derived from the Root Mean Square Error (RMSE) between the forecasted and measured values for whole attributes. The RMSE transforms the monitored attributes into a univariate times series which is divided into overlapping sliding window. The joint probability of the sequence of RMSE values in each sliding window is calculated to decide whether a change has occurred or not. When an effec- tive change is detected over k consecutive windows, the number of deviated attributes is used to distinguish faulty measurements from a health emergency. We apply our proposed approach on real physiological data from the Physionet database and compare it with existing approaches. Our experimental results prove the effectiveness of our proposed approach, as it achieves high detection accuracy with a low false alarm rate (5.2%). Index Terms— Faulty measurements, forecasting, ARIMA, outlier, Markov chain, healthcare, WBANs. I. I NTRODUCTION W ITH the increase of average lifetimes, the number of elderly people is exponentially increasing in Europe and currently creating an overload in the medical sector, encumbering hospitals with persons under monitoring and increasing the waiting times for surgical operations. To prevent such problems, researchers and doctors are investigating new solutions for remote and pervasive vital signs monitoring through the use of biomedical sensors. Several sensors are Manuscript received November 12, 2019; revised April 12, 2020; accepted April 16, 2020. Date of publication September 29, 2020; date of current version January 15, 2021. This work was supported in part by the Deanship of Scientific Research (DSR) at King Abdulaziz University, Jeddah, under Grant KEP-KEP-6-611-39. (Corresponding author: Osman Salem.) Osman Salem and Ahmed Mehaoua are with LIPADE Laboratory, University of Paris Descartes, 75270 Paris, France (e-mail: osman.salem@ parisdescartes.fr; ahmed.mehaoua@parisdescartes.fr). Khalid Alsubhi is with the Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia (e-mail: kalsubhi@kau.edu.sa). Raouf Boutaba is with the David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, ON N2L 3G1, Canada (e-mail: rboutaba@uwaterloo.ca). Color versions of one or more of the figures in this article are available online at https://ieeexplore.ieee.org. Digital Object Identifier 10.1109/JSAC.2020.3020602 placed on the body of the patient to monitor various physi- ological attributes, and to transmit the measured values to a portable central unit which processes the received physiolog- ical data for the prediction or early detection of diseases. The Internet of Medical Things (IoMT) is the collection of wireless medical devices which can capture, store, analyze and transmit data to healthcare IT systems. Various medical sensors are available in the market that are able to measure different physiological attributes [1] such as Heart Rate (HR), Oxygenation Ratio (SpO2), body temperature (T ◦ ), Pulse, Blood Pressure (BP), Respiration Rate (RR), Galvanic Skin Ratio (GSR), Electrocardiogram (ECG), Electroencephalo- gram (EEG), Electromyogram (EMG), etc. Such wearable vital-signs monitoring sensors have important impacts on public health, overloading in hospitals, and healthcare costs. The values measured by biosensors are transmitted to a central Local Processing Unit (LPU) using different wireless technologies for real-time analysis and early diagnosis of diseases. The LPU is modernizing the involvement of doctors by providing pre-diagnostic in IoMT for decision-making support. Sensors have already proven their utility in different fields of medicine, such as EEG for the detection of epileptic seizures [2], [3], ECG for the early detection of cardiovascular disease [4], EMG for Human Machine Interface (HMI) [5], etc. The pervasive monitoring and local processing of data in the LPU for epileptic seizure detection allows raising alarms for family or healthcare professionals upon the detection of seizure onset when the patient cannot call for help, especially if they are living an independent life or are isolated and out of the sight of other persons. The heart attack detection system allows reperfusion at earlier stages and can prevent serious heart damage. The HMI helps amputees or disabled persons to control devices and to accomplish some daily life tasks using muscle contractions, body movements, or other physiological attributes. While WBANs have numerous advantages, their disadvan- tages range from poor reliability to a high susceptibility to security attacks [6] after deployment. The wireless transmis- sion of data between the sensors and the LPU makes them susceptible to various sources of interference and to attacks such as forgeries and modifications. Furthermore, sensors are prone to both hardware and software issues such as impaired components, sensor calibration, battery exhaustion, or dislocation. The data acquisition process is also subject to faulty measurements, faulty sensors, and improperly attached devices [7]. This leads to unexpected results, false alarms, wrong diagnoses, and unreliable monitoring systems. 0733-8716 © 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See https://www.ieee.org/publications/rights/index.html for more information. Authorized licensed use limited to: University of Waterloo. Downloaded on March 05,2021 at 05:11:18 UTC from IEEE Xplore. Restrictions apply.