Multi-Perspective Approach for Anomalous Behavior Detection and Repairing

Outlier and anomaly detection are widely used in several fields of study such as social networks, statistics, and knowledge discovery. In social networks, it is useful to detect structural abnormalities which are different from the typical behavior of the social network in order to maintain the network security and privacy. In this paper, we suggest a new approach for outlier and anomalous behavior detection in social networks based on combined graph pattern matching and constraint programming. For this purpose, we utilize the Constraint Programming (CP) techniques for matching the original graph data with the graph pattern data, to detect two formalized anomalies: anomalous nodes and anomalous edges. We also introduce a neighborhood constraint formalization that aims to precise the anomaly that replaced specific node as well as the changes that it made within the networks. Finally, we present our experimental results that show the effectiveness and efficiency of our approach in terms of computational time and matching accuracy.

As the second most visited website globally, YouTube serves as a central platform for video sharing, entertainment, and information dissemination. However, its expansive and highly active user base also facilitates problematic behavior, particularly among commenters. This study presents a methodology driven by social network analysis to detect and examine anomalous commenter behaviors, with a specific focus on commenter mobs that collaborate to artificially manipulate engagement metrics on videos. Additionally, the study seeks to characterize YouTube channels based on the prevalence of such behaviors, uncovering patterns of coordination among channels. The analysis utilizes a dataset comprising 47 YouTube channels, 26,901 videos, 1,377,902 commenters, and 2,496,558 comments, including 20 channels involved in disseminating misleading information about the U.S. Military and 27 additional channels, which serve as a control group to provide a baseline for normal behavior, helping to distinguish between anomalous and non-anomalous patterns more clearly. The methodology compares principal component analysis (PCA) with Graph2vec and uniform manifold approximation and projection (UMAP), in conjunction with K-means and hierarchical clustering, to identify and categorize anomalous behaviors across channels. Through comprehensive qualitative and quantitative analyses, the study identifies the themes of the videos where these anomalous behaviors occurred in comment sections. These findings provide valuable insights into the dynamics of online discourse and the mechanisms by which coordinated groups influence content and engagement on YouTube.

In this paper we propose an approach for behavior modeling and detection of certain types of anomalous behavior. This approach consists of three basic parts. First, we propose busy-idle rates, as the behavior features, to define a behavior model for a block of pixels. Second, given a training set of normal data only, we propose spectral clustering for classifying behaviors wherein block of pixels that exhibit similar behavior models are clustered together. Then a behavior model for each cluster is obtained using the histogram of the samples. Once the behavior models are obtained, we use these models to perform anomalous behavior detection in a test video of the same scene. Experimental results on video surveillance sequences show the effectiveness and speed of proposed method.

Abnormal activity detection from the video is a challenging task in day to day life. This work proposed the unsupervised approach to detect abnormal activity from video with auto indication. Here, proposed a new hybrid C-SVM deep learning based to fuse the extracted features, which integrates convolutional neural network (CNN) and SVM. Firstly, the video is preprocessed and extracted visual features by CNN. Next, SVM is used to learn the temporal features of visual features and added an attention mechanism to select important features. Finally, the video feature vector is obtained layer by layer to judge abnormal activity. An experiment is used to test the ability of the model on the standard dataset to recognize the abnormal activity, the result shows that our experiment demonstrates the high performance of recognition and outperforms the state-of-the-art algorithms.

A new approach for abnormal behavior detection was proposed using causality analysis and sparse reconstruction. To effectively represent multiple-object behavior, low level visual features and causality features were adopted. The low level visual features, which included trajectory shape descriptor, speeded up robust features and histograms of optical flow, were used to describe properties of individual behavior, and causality features obtained by causality analysis were introduced to depict the interaction information among a set of objects. In order to cope with feature noisy and uncertainty, a method for multiple-object anomaly detection was presented via a sparse reconstruction. The abnormality of the testing sample was decided by the sparse reconstruction cost from an atomically learned dictionary. Experiment results show the effectiveness of the proposed method in comparison with other state-of-the-art methods on the public databases for abnormal behavior detection.

A deep learning and edge computing integrated approach for fall behavior detection in buildings

These days Crowd behavior detection in video surveillance is a latest research area in the field of computer vision. It focuses on the demanding assignment of monitoring crowded events for outbreaks of violent behavior. Such scenes have a need of human assessor to monitor multiple video screens, presenting crowds of people in a frequently changing sea of activity. In this paper, we propose an innovative approach for real-time crowd behavior detection using SIFT feature extraction technique in Video Sequences. For any detection and classification the feature extraction and feature optimization is very important metrics. So in proposed work SIFT feature extraction technique are used in appropriate segmented for background subtraction in video sense. After that feature extraction is applied in all regions, but a suitable feature extraction is not possible. To overcome this problem we have used Genetic Algorithm to optimize the extracted feature set. A genetic algorithm is best optimization technique and also operates in large data set. At last performance metrics of proposed work is calculates. In which we can compared propose work with previous existing work. And we calculate the performance metrics like precision rate, recall rate, and accuracy. The real-time crowd behavior using SIFT feature extraction technique in Video Sequences is implemented using Image Processing Toolbox within Matlab Software.

We propose a novel method of abnormal crowd behavior detection in surveillance videos. Mainly, our work focuses on detecting crowd divergence behavior that can lead to serious disasters like a stampede. We introduce a notion of physically capturing motion in the form of images and classify crowd behavior using a convolution neural network (CNN) trained on motion-shape images (MSIs). First, the optical flow (OPF) is computed, and finite-time Lyapunov exponent (FTLE) field is obtained by integrating OPF. Lagrangian coherent structure (LCS) in the FTLE field represents crowd-dominant motion. A ridge extraction scheme is proposed for the conversion of LCS-to-grayscale MSIs. Lastly, a supervised training approach is utilized with CNN to predict normal or divergence behavior for any unknown image. We test our method on six real-world low- as well as high-density crowd datasets and compare performance with state-of-the-art methods. Experimental results show that our method is not only robust for any type of scene but also outperform existing state-of-the-art methods in terms of accuracy. We also propose a divergence localization method that not only identifies divergence starting (source) points but also comes with a new feature of generating a ‘localization mask’ around the diverging crowd showing the size of divergence. Finally, we also introduce two new datasets containing videos of crowd normal and divergence behaviors at the high density.

Detecting abnormal human behaviors in surveillance videos is crucial for various domains, including security and public safety. Many successful detection techniques based on deep learning models have been introduced. However, the scarcity of labeled abnormal behavior data poses significant challenges for developing effective detection systems. This paper presents a comprehensive survey of deep learning techniques for detecting abnormal human behaviors in surveillance video streams. We categorize the existing techniques into three approaches: unsupervised, partially supervised, and fully supervised. Each approach is examined in terms of its underlying conceptual framework, strengths, and drawbacks. Additionally, we provide an extensive comparison of these approaches using popular datasets frequently used in the prior research, highlighting their performance across different scenarios. We summarize the advantages and disadvantages of each approach for abnormal human behavior detection. We also discuss open research issues identified through our survey, including enhancing robustness to environmental variations through diverse datasets, formulating strategies for contextual abnormal behavior detection. Finally, we outline potential directions for future development to pave the way for more effective abnormal behavior detection systems.

Consensus reaching processes in group decision making attempt to reach a mutual agreement amongst experts before making a common decision.Classical consensus models are focused on problems where few decision makers participate.However, new societal and technological trends may require a large number of experts in such processes.In group decision making problems involving large groups, identifying and dealing with experts who present noncooperative behaviors during the consensus reaching process might become a particularly complex task.Such behaviors might bias the discussion process and prevent achieving an agreement.This paper presents a fuzzy clustering-based approach to detect and manage non-cooperative behaviors.Such an approach is integrated into a consensus model suitable to manage large groups of experts in group decision making problems.

At high-density crowd gatherings, people naturally escape from the region where any unexpected event happens. Escape in high-density crowds appears as a divergence pattern in the scene and timely detecting divergence patterns can save many human lives. In this paper, we propose to physically capture crowd normal and divergence motion patterns (or motion shapes) in form of images and train a shallow convolution neural network (CNN) on motion shape images for divergence behavior detection. Crowd motion pattern shape is obtained by extracting ridges of Lagrangian Coherent Structure (LCS) from the Finite-Time Lyapunov Exponent (FTLE) field and convert ridges into the grey-scale image. We also propose a divergence localization algorithm to pinpoint anomaly location(s). Experimentation is carried out on synthetic crowd datasets simulating normal and divergence behaviors at the high-density crowd. Comparison with state-of-the-art methods shows our method can obtain better accuracy for both divergence behavior detection and localization problems.KeywordsDivergenceFTLELCSMotion estimationImage shape

Recently, a great threat has been posed to information system security by malicious programs. Moreover, traditional anti-virus programs cannot detect them for power information systems due to uniqueness, complexity, and vulnerability. Deep learning techniques have been utilized in IDSs, which were developed to protect data and computer networks. This research contemplates the use of Bayesian neural network (BNN) and particle swarm optimisation (PSO) for improving intrusion detection systems in cyber security. The UNSW-NB15 dataset, which is utilised for system testing and training, is the source of the dataset employed in this work. The hybrid approach increases the precision and adaptability of identifying and resolving intrusions of networks by including the capabilities of probabilistic reasoning of BNN with the optimisation expertise of PSO. The experimental results show improved intrusion detection performance of the developed model. By contrasting these outcomes with existing models, they are verified in terms of precision, recall, F1 score, accuracy and FPR.

Abnormal behavior detection is an important issue in video surveillance. This paper presents an approach for abnormal behavior detection based on spatial-temporal features. First, the proposed method extracts moving objects from video sequence. Then, it tracks moving objects to detect their overlapping. Finally, a clutter-model is built up based on the changes of spatial-temporal feature to detect abnormal behavior. Experimental results show the effectiveness of the proposed approach.

Malware often contains hidden behavior which is only activated when properly triggered. Well known examples include: the MyDoom worm which DDoS’s on particular dates, keyloggers which only log keystrokes for particular sites, and DDoS zombies which are only activated when given the proper command. We call such behavior trigger-based behavior. Currently, trigger-based behavior analysis is often performed in a tedious, manual fashion. Providing even a small amount of assistance would greatly assist and speedup the analysis. In this chapter, we propose that automatic analysis of trigger-based behavior in malware is possible. In particular, we design an approach for automatic trigger-based behavior detection and analysis using dynamic binary instrumentation and mixed concrete and symbolic execution. Our approach shows that in many cases we can: (1) detect the existence of trigger-based behavior, (2) find the conditions that trigger such hidden behavior, and (3) find inputs that satisfy those conditions, allowing us to observe the triggered malicious behavior in a controlled environment. We have implemented MineSweeper, a system utilizing this approach. In our experiments, MineSweeper has successfully identified trigger-based behavior in real-world malware. Although there are many challenges presented by automatic trigger-based behavior detection, MineSweeper shows us that such automatic analysis is possible and encourages future work in this area.

This paper presents a new approach for automatic abnormal behavior detection in crowded scenes. Background subtraction algorithm, optical flow and connected component analysis are used to define the optical flow connected components (OFCC). An unsupervised normal behavior model is computed using the main magnitude and direction of each OFCC. Experimental results on the standards UCSD and UMN anomaly detection and localization benchmarks demonstrate the method performance compared to other approaches considering detection rate and processing time.