Search

Anomaly detection is a frequently discussed topic in manufacturing. However, the issues of anomaly detection are typically attributed to the manufacturing process or equipment itself. In practice, the sensor responsible for collecting data and monitoring values may fail, leading to a biased detection result – false alarm. In such cases, replacing the sensor is necessary instead of performing equipment maintenance. This study proposes an effective framework embedded with autoencoder-based control limits that can dynamically distinguish sensor anomaly from process anomaly in real-time. We conduct a simulation numerical study and an empirical study of semiconductor assembling manufacturers to validate the proposed framework. The results show that the proposed model outperforms other benchmark methods and can successfully identify sensor failures, even under conditions of (1) large variations in process values or sensor values and (2) heteroscedasticity effect. This is particularly beneficial in various practical applications where sensors are used for numerical measurements and support equipment maintenance. [ABSTRACT FROM AUTHOR]

In modern large-scale industrial processes, data are often high dimensional time-dependent due to the frequent sampling, dynamic nature and large number of variables. Appropriate monitoring of such processes allows for efficient decision-making that can improve the baseline of manufacturing companies either through decreasing production costs or enhancing production efficiency. Various latent variable-based control charts have been proposed for addressing high dimensional data; however, many of these methods assume that the data are independent and normally distributed. The violation of these assumptions results in an increased false alarm rate, in addition to the deterioration in the performance of such methods. In this study, we propose a Variational Autoencoder-Long Short Term Memory (VAE-LSTM) deep learning based $ {T^2} $ T 2 chart that integrates the unique features of both VAE and LSTM for intelligent fault detection of time-dependent high dimensional processes. The effectiveness and applicability of the proposed model are demonstrated through extensive simulations, an open-source online dataset, and a real case study. [ABSTRACT FROM AUTHOR]

In many industrial manufacturing processes, the quality of products can depend on the relative amount between two quality characteristics X and Y. Often, this calls for the on-line monitoring of the ratio Z = X / Y as a quality characteristic itself by means of a control chart. A large number of control charts monitoring the ratio have been investigated in the literature under the assumption of independent normal observations of the two quality characteristics. In practice, due to the high frequency in sensor data collection, both autocorrelation and cross-correlation between consecutive observations can exist for X and Y and should be modelled to protect against the false alarm rate inflation when implementing a control chart for monitoring the ratio Z = X / Y. In this paper, we tackle this problem by investigating the performance of the Phase II Shewhart-type RZ control chart monitoring the ratio of two normal variables whose relationship is captured by a bivariate time series autoregressive model VAR(1), which can also account for the cross-correlation between the two quality characteristics. With the numerical study, we discuss how the design and the statistical performance of the Shewhart-type RZ control chart change with the VAR(1) model's parameters. We also provide an example to illustrate the use of the Shewhart-type RZ control chart with bivariate time series of observations in a furnace process. [ABSTRACT FROM AUTHOR]

Summary: Anomaly event recognition and identification has a crucial part in several areas, particularly in night vision environments. Conventional techniques of event recognition are hugely based upon data extracted from certain images for classification purposes. This needs users to select suitable features to establish the feature depictions for actual images per definite situations. Manual feature selection is laborious as well as heuristic tasks and the features obtained in this manner generally have worse robustness. Here, a Faster Region‐based Convolutional fused Social Generative Adversarial Network (FRC‐SGAN) is designed for anomaly event recognition in a night vision environment. At the cloud, key frame extraction, pre‐processing, feature extraction, human detection (HD) and anomalous event recognition are carried out. Initially, input video from the database is subjected to perform pre‐processing. The visibility enhancement is utilized for pre‐processing. Thereafter, features like ResNet features, texture features and statistical features are extracted. Then, HD is accomplished by DeepJoint segmentation with chord distance. Finally, anomalous detection is done by FRC‐SGAN that is the incorporation of Fast Regional Convolutional Neural Network (FR‐CNN) and Social Generative Adversarial Network (SGAN). In addition, FRC‐SGAN acquired 90.8% of accuracy, 89.7% of precision, and 89.2% of recall. [ABSTRACT FROM AUTHOR]

In the paper an example of an integrated software-defined network (SDN) system with heterogeneous technological instances based on the Linux platform will be shown. For this purpose, two research testing stands with a POX controller and OVS (Open vSwitch) switches were used. In the first testing stand, the research based on the ICMP traffic was done while in the second one, MQTT traffic was analysed. The capabilities of these systems were examined in terms of responding to detected incidents and traffic anomalies. In particular, their appropriate responses to anomalies were tested, as well as the possibility of continuous monitoring of packet transfer between separate network components. The aim of the paper is to investigate the effectiveness of SDN in enhancing the security and adaptability of critical infrastructure systems. For isolation and optimised resource management, some components, such as POX or the MQTT broker, were run in Docker containers. The test environment used both hardware cases and prepared software, enabling comprehensive design and testing of networks based on the OpenFlow protocol used in SDN architecture, enabling the separation of control from traffic in computer networks. The results of this research make it possible to implement anomaly detection solutions in critical infrastructure systems that will adapt on the fly to changing conditions that arise, for example, in the case of an attack on such infrastructure or physical damage to it at a selected node. [ABSTRACT FROM AUTHOR]

Summary: This study addresses the challenge of data imbalance and class overlap in machine learning for intrusion detection, proposing that targeted algorithmic adjustments can significantly enhance model performance. Our hypothesis contends that an ensemble framework, adeptly integrating novel threshold‐adjustment algorithms, can improve classification sensitivity and specificity. To test this, we developed an ensemble model comprising Balanced Bagging (BB), eXtreme Gradient Boosting (XGBoost), and Random Forest (RF), fine‐tuned using grid search for BB and XGBoost, and augmented with the Hellinger metric for RF to tackle data imbalance. The innovation lies in our algorithms, which adeptly adjust the discrimination threshold to rectify the class overlap problem, enhancing the model's ability to discern between negative and positive classes. Utilizing the UNSW‐NB15 dataset, we conducted a comparative analysis for binary and multi‐category classification. Our ensemble model achieved a binary classification accuracy of 97.80%, with a sensitivity rate of 98.26% for detecting attacks, and a multi‐category classification accuracy and sensitivity that reached up to 99.73% and 97.24% for certain attack types. These results substantially surpass those of existing models on the same dataset, affirming our model's superiority in dealing with complex data distributions prevalent in network security domains. [ABSTRACT FROM AUTHOR]

This paper explores the correlation between soil radon and thoron concentrations and seismic events at Chite fault in Aizawl over a three year period using SSNTDs. The data analysis was done using STL method which decomposes a time series into three components: seasonal, trend, and remainder. Elevated residual concentrations of these gases were observed prior to the M5.4 earthquake that occurred at a distance of 123.9 km from the monitoring station, suggesting a potential link between gas emanation and seismicity. The results of the study demonstrated the effectiveness of the STL method in detecting anomalies in diverse time series datasets. [ABSTRACT FROM AUTHOR]

Conventional autoverification rules evaluate analytes independently, potentially missing unusual patterns of results indicative of errors such as serum contamination by collection tube additives. This study assessed whether multivariate anomaly detection algorithms could enhance the detection of such errors. Multivariate Gaussian, k-nearest neighbours (KNN) distance, and one-class support vector machine (SVM) anomaly detection models, along with conventional limit checks, were developed using a training dataset of 127,451 electrolyte, urea, and creatinine (EUC) results, with a 5 % flagging rate targeted for all approaches. The models were compared with limit checks for their ability to detect atypical EUC results from samples spiked with additives from collection tubes: EDTA, fluoride, sodium citrate, or acid citrate dextrose (n=200 per contaminant). The study additionally assessed the ability of the models to identify 127,449 single-analyte errors, a potential weakness of multivariate models. The KNN distance and SVM models outperformed limit checks for detecting all contaminants (p-values <0.05). The multivariate Gaussian model did not surpass limit checks for detecting EDTA contamination but was superior for detecting the other additives. All models surpassed limit checks for identifying single-analyte errors, with the KNN distance model demonstrating the highest overall sensitivity. Multivariate anomaly detection models, particularly the KNN distance model, were superior to the conventional approach for detecting serum contamination and single-analyte errors. Developing multivariate approaches to autoverification is warranted to optimise error detection and improve patient safety. [ABSTRACT FROM AUTHOR]

Patient-based real-time quality control (PBRTQC) is an alternative tool for laboratories that has gained increasing attention. Despite the progress made by using various algorithms, the problems of data volume imbalance between in-control and out-of-control results, as well as the issue of variation remain challenges. We propose a novel integrated framework using anomaly detection and graph neural network, combining clinical variables and statistical algorithms, to improve the error detection performance of patient-based quality control. The testing results of three representative analytes (sodium, potassium, and calcium) and eight independent variables of patients (test date, time, gender, age, department, patient type, and reference interval limits) were collected. Graph-based anomaly detection network was modeled and used to generate control limits. Proportional and random errors were simulated for performance evaluation. Five mainstream PBRTQC statistical algorithms were chosen for comparison. The framework of a patient-based graph anomaly detection network for real-time quality control (PGADQC) was established and proven feasible for error detection. Compared with classic PBRTQC, the PGADQC showed a more balanced performance for both positive and negative biases. For different analytes, the average number of patient samples until error detection (ANPed) of PGADQC decreased variably, and reductions could reach up to approximately 95 % at a small bias of 0.02 taking calcium as an example. The PGADQC is an effective framework for patient-based quality control, integrating statistical and artificial intelligence algorithms. It improves error detection in a data-driven fashion and provides a new approach for PBRTQC from the data science perspective. [ABSTRACT FROM AUTHOR]

Host load prediction is essential in computing to improve resource utilization and for achieving service level agreements. However, due to variations in load and the inefficiency of feature extraction, prediction of load on hosts in fog computing an immense challenge. A predictive model with variable load patterns can better estimate future resource needs, which is crucial for capacity planning, service-level goals and energy efficiency. To improve workload prediction accuracy, proposed framework proposes a time-series-based multivariate ensemble model using anomaly detection techniques. In the proposed work, virtual machines are deployed on different platforms and numerous parameters such as CPU utilization, number of cores, RAM, allocated memory, available memory, disk I/O and network I/O are extracted. There may exist inconsistencies in load prediction due to the enormous volume of data. To reduce redundancy in data, various anomaly detection techniques are utilized. The performance of the proposed ensemble model is compared with various time series models using Mean Absolute Error, Mean Squared Error, Root Mean Squared Error and Mean Absolute Percentage Error (MAPE) and Accuracy. Moreover, the effectiveness of the proposed ensemble model is demonstrated on the generated dataset and performance is measured based on the performance evaluation metrics. The ensemble model exhibits higher accuracy in workload prediction as compared to the current state-of-the-art models, it achieves the lowest MAPE and provides an accuracy of about 88%. [ABSTRACT FROM AUTHOR]

The Industrial Internet of Things (IIoT) infrastructure is inherently complex, often involving a multitude of sensors and devices. Ensuring the secure operation and maintenance of these systems is increasingly critical, making anomaly detection a vital tool for guaranteeing the success of IIoT deployments. In light of the distinctive features of the IIoT, graph-based anomaly detection emerges as a method with great potential. However, traditional graph neural networks, such as Graph Convolutional Networks (GCNs) and Graph Attention Networks (GATs), have certain limitations and significant room for improvement. Moreover, previous anomaly detection methods based on graph neural networks have focused only on capturing dependencies in the spatial dimension, lacking the ability to capture dynamics in the temporal dimension. To address these shortcomings, we propose an anomaly detection method based on Spatio-Temporal Gated Attention Networks (STGaAN). STGaAN learns a graph structure representing the dependencies among sensors and then utilizes gated graph attention networks and temporal convolutional networks to grasp the spatio-temporal connections in time series data of sensors. Furthermore, STGaAN optimizes the results jointly based on both reconstruction and prediction loss functions. Experiments on public datasets indicate that STGaAN performs better than other advanced baselines. We also visualize the learned graph structures to provide insights into the effectiveness of graph-level anomaly detection. [ABSTRACT FROM AUTHOR]

With the advancement of technology, real-world networks have become vulnerable to many attacks such as cyber-crimes, terrorist attacks, and financial frauds. Accuracy and scalability are the two principal but contrary characteristics for algorithms detecting such attacks (or events) in these time-varying networks. However, existing approaches confirm to either of these two prerequisites. Hence, we propose two algorithms designated as GraphAnomaly and GraphAnomaly-CS, both satisfying these two requirements together. Given a stream of time-evolving real-world network edges, the proposed algorithms first extract the local structure of network graphs by identifying the relationship between egonets and their properties, and then use this information in Chi-square statistics to discover (1) anomalous time-points at which many network nodes deviate from their normal behavior and (2) those nodes and features that majorly contribute to the change. The proposed algorithms are (a) accurate: upto 7 to 12% more accurate than state-of-the-art methods; (b) speedy: process millions of edges within a few minutes; (c) scalable: scale linearly with the number of edges and nodes in the network graph; (d) theoretically sound: providing theoretical guarantees on the false positive probability of algorithms; We show theoretically and experimentally that the proposed algorithms successfully detect anomalies in time-evolving edge streams. We have selected six baselines, five evaluation metrics, and six real-world network datasets from three different network classes for empirical analysis. The experimental results show that both algorithms are efficient at detecting anomalies in networks that reduce false positives and false negatives in the results, especially in successive time-points. Furthermore, algorithms discover the maximum number of critical events from real-world networks, demonstrating their effectiveness over baselines. [ABSTRACT FROM AUTHOR]

An outlier probability is the probability that an observation is an outlier. Typically, outlier detection algorithms calculate real-valued outlier scores to identify outliers. Converting outlier scores into outlier probabilities increases the interpretability of outlier scores for domain experts and makes outlier scores from different outlier detection algorithms comparable. Although several transformations to convert outlier scores to outlier probabilities have been proposed in the literature, there is no common understanding of good outlier probabilities and no standard approach to evaluate outlier probabilities. We require that good outlier probabilities be sharp, refined, and calibrated. To evaluate these properties, we adapt and propose novel measures that use ground-truth labels indicating which observation is an outlier or an inlier. The refinement and calibration measures partition the outlier probabilities into bins or use kernel smoothing. Compared to the evaluation of probability in supervised learning, several aspects are relevant when evaluating outlier probabilities, mainly due to the imbalanced and often unsupervised nature of outlier detection. First, stratified and weighted measures are necessary to evaluate the probabilities of outliers well. Second, the joint use of the sharpness, refinement, and calibration errors makes it possible to independently measure the corresponding characteristics of outlier probabilities. Third, equiareal bins, where the product of observations per bin times bin length is constant, balance the number of observations per bin and bin length, allowing accurate evaluation of different outlier probability ranges. Finally, we show that good outlier probabilities, according to the proposed measures, improve the performance of the follow-up task of converting outlier probabilities into labels for outliers and inliers. [ABSTRACT FROM AUTHOR]

The COVID-19 pandemic has significantly impacted healthcare systems, particularly altering the operations of emergency departments (EDs). This study evaluates ED operational efficiency during and after the pandemic using a hybrid approach that combines Agent-Based Simulation (ABS) and Discrete Event Simulation (DES), integrated with an anomaly detection system. The simulations provide a comprehensive analysis of patient flow, resource utilization, and treatment processes, while the anomaly detection system identifies unusual operational patterns and potential crises in real-time. Key performance metrics, including average dwelling time, wait times, treatment times, and staff utilization, were analyzed. Results show substantial differences between the pandemic and post-pandemic periods: during the pandemic, the ABS model recorded an average dwelling time of 44.3 minutes with 60% staff utilization, while the DES model showed 122.2 minutes with 110.1% utilization. Post-pandemic, the ABS model improved to a dwelling time of 24.5 minutes and 70% staff utilization, and the DES showed reductions to 69.2 minutes and 49.5% utilization. Moreover, integrating anomaly detection further enhanced the ED's ability to manage operational disruptions proactively, reducing response times and improving overall efficiency. This study underscores the importance of combining simulation and anomaly detection to enhance ED preparedness and resilience for future healthcare crises. [ABSTRACT FROM AUTHOR]

Address issues such as the inadequate consideration of inter-feature correlations in existing intrusion detection methods and the need for improved detection accuracy on high-dimensional discrete datasets, a network intrusion detection method MBGAN based on spatial features and generative adversarial networks was proposed. Initially, a transformation approach was devised to convert one-dimensional data into two-dimensional grayscale images, enabling convolutional kernels to capture richer contextual information. Subsequently, a bidirectional generative adversarial network model was employed for anomaly detection. The model was trained using network traffic images, incorporating the minimum Wasserstein distance and gradient penalty techniques to mitigate mode collapse and instability during generative adversarial network training. Experimental verification showed that the detection accuracy of the proposed method on the NSL-KDD, UNSW-NB15 and CICIDIS2017 datasets was 97. 4%, 92. 3% and 94. 8%, the recall rates were 97. 2%, 93. 1% and 95. 6%, and the F1 were 97. 3%, 93. 0% and 95. 2%, respectively, which were better than those of other methods. [ABSTRACT FROM AUTHOR]

With the increasing amount of devices connected to the huge net known as the internet, it is not surprising the corresponding growth of cyber attacks. The era of the Internet of Things (IoT) has proved to be an environment in which malicious activities have been able to proliferate with great comfort. Due to this kind of threat, having powerful machine learning-based classifiers is almost a critical need nowadays. Besides, to properly face new and previously unseen attacks unsupervised learners need to be involved. An unsupervised network threat detector is provided in this work. The proposed approach is based on three steps. The main one is a novel anomaly score, which relies on modeling the tails of the empirical distributions and on an interpretation of the well-known Bayes theorem. A step for an unsupervised feature selection and another one for data reduction are also considered, both aimed at gaining robustness of the procedure. All three steps are in a completely unsupervised way, facilitating an ad hoc scenario deploying. The whole method showed good performance reaching 98.44 % and 98.14 % in the F1-score over different datasets. The obtained results are competitive with other state-of-the-art methods. [ABSTRACT FROM AUTHOR]

In the field of attribute network anomaly detection, current research methodologies, such as reconstruction and contrastive learning, frequently face challenges including the minimal differentiation in embedding representations of normal and anomalous nodes, an excessive dependence on local information, and a susceptibility to noise from adjacent nodes. To overcome these limitations, this paper presents a novel approach: the Enhanced Multi-view Anomaly Detection on Attribute Networks by Truncated Singular Value Decomposition (EMTSVD) method. EMTSVD leverages TSVD to generate improved views of both attributes and structures. Through the use of a low-rank approximation matrix, EMTSVD effectively filters out noise and isolates critical structural and attribute information. This isolated information is subsequently incorporated into the node embedding representations, significantly enhancing the differentiation between normal and anomalous nodes. Moreover, EMTSVD employs an attention mechanism to integrate multiple views, effectively minimizing spatial feature redundancy and further diminishing the effects of noise disturbances. Empirical evidence highlights EMTSVD's adeptness at accurately identifying essential node information within networks. By bolstering the distinction in embedding representations between normal and anomalous nodes, EMTSVD markedly advances the precision of anomaly detection in attribute networks. [ABSTRACT FROM AUTHOR]

In this study, we evaluate a proactive battery EV safety assessment method using abnormal feature detection and neural networks. Four sophisticated algorithms --Isolation Timberland, One-Class SVM, Autoencoder and also LSTM-- were performed to assess their applicability in detecting anomalous battery behavior. The Isolation Woodland algorithm showed a balanced accuracy recall trade-off of the values 0.85 and 0.92 respectively One class SVM demonstrated highly sharp results with an accuracy and recall values of 0.78 and 0.8, respectively. The autoencoder, that used a large amount of learning and won with 0.92 accuracy score and an F1-score - 0.89 The LSTM structure, programmed for sequential information, indicated a great execution with a 0.94 review and the F1-score of 0. A comparative study has shown that these algorithms can provide alot flexibility in sending based on the clear requirements. [ABSTRACT FROM AUTHOR]

ABSTRACT Anomaly detection, vital for identifying deviations from normative data patterns, is particularly crucial in sensor‐driven real‐world applications, which predominantly involve temporal data in the form of time series. Traditional evaluation of anomaly detection methods has relied on public benchmark datasets. Yet, recent revelations have uncovered inherent flaws and inadequacies in these datasets, casting doubt on the perceived progress in the field. To address this challenge, the UCR Time Series Anomaly Archive has been recently proposed—a meticulously curated database comprising 250 time series—designed to provide a robust and error‐free benchmark for anomaly detection research. This paper comprehensively evaluates state‐of‐the‐art anomaly detection techniques using the UCR Time Series Anomaly Archive. Our findings demonstrate the efficacy of current methods in accurately detecting anomalies across an important portion of datasets without additional optimization, underscoring the archive's utility as a foundational baseline for future research and development in anomaly detection methodologies. [ABSTRACT FROM AUTHOR]