Anomalous Activity Research Articles

Comprehensive Analysis and Evaluation of Anomalous User Activity in Web Server Logs

In this study, we present a novel machine learning framework for web server anomaly detection that uniquely combines the Isolation Forest algorithm with expert evaluation, focusing on individual user activities within NGINX server logs. Our approach addresses the limitations of traditional methods by effectively isolating and analyzing subtle anomalies in vast datasets. Initially, the Isolation Forest algorithm was applied to extensive NGINX server logs, successfully identifying outlier user behaviors that conventional methods often overlook. We then employed DBSCAN for detailed clustering of these anomalies, categorizing them based on user request times and types. A key innovation of our methodology is the incorporation of post-clustering expert analysis. Cybersecurity professionals evaluated the identified clusters, adding a crucial layer of qualitative assessment. This enabled the accurate distinction between benign and potentially harmful activities, leading to targeted responses such as access restrictions or web server configuration adjustments. Our approach demonstrates a significant advancement in network security, offering a more refined understanding of user behavior. By integrating algorithmic precision with expert insights, we provide a comprehensive and nuanced strategy for enhancing cybersecurity measures. This study not only advances anomaly detection techniques but also emphasizes the critical need for a multifaceted approach in protecting web server infrastructures.

Anomaly Detection IDS for Detecting DoS Attacks in IoT Networks Based on Machine Learning Algorithms.

Widespread and ever-increasing cybersecurity attacks against Internet of Things (IoT) systems are causing a wide range of problems for individuals and organizations. The IoT is self-configuring and open, making it vulnerable to insider and outsider attacks. In the IoT, devices are designed to self-configure, enabling them to connect to networks autonomously without extensive manual configuration. By using various protocols, technologies, and automated processes, self-configuring IoT devices are able to seamlessly connect to networks, discover services, and adapt their configurations without requiring manual intervention or setup. Users' security and privacy may be compromised by attackers seeking to obtain access to their personal information, create monetary losses, and spy on them. A Denial of Service (DoS) attack is one of the most devastating attacks against IoT systems because it prevents legitimate users from accessing services. A cyberattack of this type can significantly damage IoT services and smart environment applications in an IoT network. As a result, securing IoT systems has become an increasingly significant concern. Therefore, in this study, we propose an IDS defense mechanism to improve the security of IoT networks against DoS attacks using anomaly detection and machine learning (ML). Anomaly detection is used in the proposed IDS to continuously monitor network traffic for deviations from normal profiles. For that purpose, we used four types of supervised classifier algorithms, namely, Decision Tree (DT), Random Forest (RF), K Nearest Neighbor (kNN), and Support Vector Machine (SVM). In addition, we utilized two types of feature selection algorithms, the Correlation-based Feature Selection (CFS) algorithm and the Genetic Algorithm (GA) and compared their performances. We also utilized the IoTID20 dataset, one of the most recent for detecting anomalous activity in IoT networks, to train our model. The best performances were obtained with DT and RF classifiers when they were trained with features selected by GA. However, other metrics, such as training and testing times, showed that DT was superior.

Distributed and explainable GHSOM for anomaly detection in sensor networks

The identification of anomalous activities is a challenging and crucially important task in sensor networks. This task is becoming increasingly complex with the increasing volume of data generated in real-world domains, and greatly benefits from the use of predictive models to identify anomalies in real time. A key use case for this task is the identification of misbehavior that may be caused by involuntary faults or deliberate actions. However, currently adopted anomaly detection methods are often affected by limitations such as the inability to analyze large-scale data, a reduced effectiveness when data presents multiple densities, a strong dependence on user-defined threshold configurations, and a lack of explainability in the extracted predictions. In this paper, we propose a distributed deep learning method that extends growing hierarchical self-organizing maps, originally designed for clustering tasks, to address anomaly detection tasks. The SOM-based modeling capabilities of the method enable the analysis of data with multiple densities, by exploiting multiple SOMs organized as a hierarchy. Our map-reduce implementation under Apache Spark allows the method to process and analyze large-scale sensor network data. An automatic threshold-tuning strategy reduces user efforts and increases the robustness of the method with respect to noisy instances. Moreover, an explainability component resorting to instance-based feature ranking emphasizes the most salient features influencing the decisions of the anomaly detection model, supporting users in their understanding of raised alerts. Experiments are conducted on five real-world sensor network datasets, including wind and photovoltaic energy production, vehicular traffic, and pedestrian flows. Our results show that the proposed method outperforms state-of-the-art anomaly detection competitors. Furthermore, a scalability analysis reveals that the method is able to scale linearly as the data volume presented increases, leveraging multiple worker nodes in a distributed computing setting. Qualitative analyses on the level of anomalous pollen in the air further emphasize the effectiveness of our proposed method, and its potential in determining the level of danger in raised alerts.

Novel person detection and suspicious activity recognition using enhanced YOLOv5 and motion feature map

Person and suspicious activity detection is a major challenge for image-based surveillance systems. However, the accuracy of person detection is affected by several factors, such as the presence of the person, his trajectory, posture, complex background, and object distortion. In this work, we developed a person-focused dataset that includes various behaviors of students in an educational institution, such as cheating, theft of lab equipment, fights, and threatening situations. This dataset ensures consistent and standardized identification annotations for individuals, making it suitable for detection, tracking, and behavioral analysis of individuals. In addition, we have increased the detection accuracy through an improved architecture called YOLOv5 and introduced an efficient method for detecting global and local anomalous behaviors. This method extracts motion features that accurately describe the person’s movement, speed, and direction. To evaluate the effectiveness of our proposed approach, we validated it against our proposed database and publicly available benchmark datasets. Our method achieves state-of-the-art detection accuracy, namely 96.12%, with an error rate of 6.68% compared to existing methods. The empirical results show a significant improvement in anomalous activity detection. Our paper concludes with a summary and a discussion of possible future research directions.

A System for Monitoring Animals Based on Behavioral Information and Internal State Information.

Managing the risk of injury or illness is an important consideration when keeping pets. This risk can be minimized if pets are monitored on a regular basis, but this can be difficult and time-consuming. However, because only the external behavior of the animal can be observed and the internal condition cannot be assessed, the animal's state can easily be misjudged. Additionally, although some systems use heartbeat measurement to determine a state of tension, or use rest to assess the internal state, because an increase in heart rate can also occur as a result of exercise, it is desirable to use this measurement in combination with behavioral information. In the current study, we proposed a monitoring system for animals using video image analysis. The proposed system first extracts features related to behavioral information and the animal's internal state via mask R-CNN using video images taken from the top of the cage. These features are used to detect typical daily activities and anomalous activities. This method produces an alert when the hamster behaves in an unusual way. In our experiment, the daily behavior of a hamster was measured and analyzed using the proposed system. The results showed that the features of the hamster's behavior were successfully detected. When loud sounds were presented from outside the cage, the system was able to discriminate between the behavioral and internal changes of the hamster. In future research, we plan to improve the accuracy of the measurement of small movements and develop a more accurate system.

Effects of Stratospheric Warming on Ural blocking Events in Winter

AbstractUtilizing the Open Integrated Forecasting System, the responses of Ural blocking (UB) to different stratospheric warming scenarios are investigated. Numerical results show that stratospheric warming with moderate strength in minor patterns prolongs the UB duration and enhances its intensity, while strong stratospheric warming in minor patterns tends to shorten its duration and weaken its intensity, even leading to the collapse of the UB events. Further diagnosis reveals that the planetary wave activity flux propagates downward from the stratosphere to the troposphere after stratospheric warming. Moreover, the convergence of planetary wave activity flux is a key factor for UB enhancement and maintenance. In addition, the weakened meridional temperature gradients, decelerated zonal westerly winds, and a reduced meridional potential vorticity gradient (PVy) result in UB enhancement in response to stratospheric warming with moderate strength. As stratospheric warming strengthens, planetary wave activity flux diverges, westerly winds in the tropospheric mid‐latitudes accelerate and the PVy in the Ural sector enlarges, which further weakens UB. Regarding the stratospheric perturbations in major patterns, they have similar influences on UB events, that is, UB enhances with moderate stratospheric warming and weakens with strong warming. However, the strengthened warming would trigger UB re‐enhancement, which is closely associated with anomalous activities of tropospheric synoptic‐scale waves induced by stratospheric perturbations. These results reveal UB events respond differently to stratospheric warming with various intensities and patterns in the short term, which makes a contribution to understanding stratosphere‐troposphere coupling.

Edge-Computing-Enabled Abnormal Activity Recognition for Visual Surveillance

Due to the ever increasing number of closed circuit television (CCTV) cameras worldwide, it is the need of the hour to automate the screening of video content. Still, the majority of video content is manually screened to detect some anomalous incidence or activity. Automatic abnormal event detection such as theft, burglary, or accidents may be helpful in many situations. However, there are significant difficulties in processing video data acquired by several cameras at a central location, such as bandwidth, latency, large computing resource needs, and so on. To address this issue, an edge-based visual surveillance technique has been implemented, in which video analytics are performed on the edge nodes to detect aberrant incidents in the video stream. Various deep learning models were trained to distinguish 13 different categories of aberrant incidences in video. A customized Bi-LSTM model outperforms existing cutting-edge approaches. This approach is used on edge nodes to process video locally. The user can receive analytics reports and notifications. The experimental findings suggest that the proposed system is appropriate for visual surveillance with increased accuracy and lower cost and processing resources.

Anomalous thermal activation of green upconversion luminescence in Yb/Er/ZnGdO self-assembled microflowers for high-sensitivity temperature detection.

Non-contact optical temperature detection has shown a great promise in biological systems and microfluidics because of its outstanding spatial resolution, superior accuracy, and non-invasive nature. However, the thermal quenching of photoluminescence significantly hinders the practical applications of optical temperature probes. Herein, we report thermally enhanced green upconversion luminescence in Yb/Er/ZnGdO microflowers by a defect-assisted thermal distribution mechanism. A 1.6-fold enhancement in green emission was demonstrated as the temperature increased from 298 K to 558 K. Experimental results and dynamic analysis demonstrated that this behavior of thermally activating green upconversion luminescence originates from the emission loss compensation, which is attributed to thermally-induced energy transfer from defect levels to the green emitting level. In addition, the Yb/Er/ZnGdO microflowers can act as self-referenced radiometric optical thermometers. The ultrahigh absolute sensitivity of 1.61% K-1 and an excellent relative sensitivity of 15.5% K-1 based on the 4F9/2/2H11/2(2) level pair were synchronously achieved at room temperature. These findings provide a novel strategy for surmounting the thermal quenching luminescence, thereby greatly promoting the application of non-contact sensitive radiometric thermometers.

The Diverse Impacts of El Niño on Northeastern Canada and Greenland Surface Air Temperatures

Abstract El Niño is known to affect Arctic temperature. However, the robustness of the observed relationship between El Niño and Arctic temperature remains debated. Here we reexamine the impacts of El Niño on the Arctic temperature in boreal winter [December–February (DJF)] using reanalysis datasets and atmospheric model experiments. This study shows that extreme El Niño events are accompanied by significant boreal winter cooling over northeastern Canada and Greenland (NECG), while moderate eastern Pacific (MEP) El Niño events are accompanied by significant boreal winter warming in this region. For central Pacific (CP) El Niño events, a cold signal appears in NECG, but with no statistical significance. During extreme El Niño winters, a positive Pacific–North America (PNA)-like pattern is seen in the Pacific, and anomalously negative 200-hPa geopotential height (Z200) strengthening occurs over NECG, which is a response to anomalous strong wave activity originating in the tropical Pacific. El Niño–induced circulation anomalies can further induce NECG cooling via cold temperature advection and decreased downward longwave radiation. In contrast, for the MEP El Niño, the subtropical jet extends zonally from the North Pacific to the North Atlantic, which is accompanied by increased baroclinicity anomalies and favors the propagation of synoptic eddies into the Atlantic, leading to a negative North Atlantic Oscillation (NAO)-like pattern. This in turn could further enhance the positive Z200 anomalies over NECG, resulting in anomalous warming in NECG through warm temperature advection and enhanced downward longwave radiation. A series of atmospheric model experiments simulates the observed circulation changes and associated warming over NECG. Significance Statement This work investigates the different impacts of the three El Niño types on regional Arctic wintertime temperature anomalies based on observations and model experiments. The impacts of El Niño events on northeastern Canada and Greenland temperatures during boreal winter show distinct differences between extreme El Niño and moderate EP El Niño events. These distinct differences can be attributed to the different atmospheric circulation patterns induced by different SST patterns, which can lead to warm (cold) temperature advection and enhanced (decreased) downward longwave radiation. These results highlight the different impacts of extreme and moderate EP El Niños on Arctic temperatures and provide an improved understanding of the impact of El Niños on the Arctic climate.

Investigation of the impact effectiveness of adversarial data leakage attacks on the machine learning models

Machine learning solutions have been successfully applied in many aspects, so it is now important to ensure the security of the machine learning models themselves and develop appropriate solutions and approaches. In this study, we focused on adversarial attacks. The vector of this type of attack is aimed at distorting the results of machine models. In this study, we selected the IoTID20 and CIC-IoT-2023 datasets used to detect anomalous activity in IoT networks. For this data, this work examines the effectiveness of the influence of adversarial attacks based on data leakage on ML models deployed in cloud services. The results of the study highlight the importance of continually updating and developing methods for detecting and preventing cyberattacks in the field of machine learning, and application examples within the experiments demonstrate the impact of adversarial attacks on services in IoT networks.

Recognition and detection of unusual activities in ATM using dual-channel capsule generative adversarial network

Real-time detection of human activity has become essential for monitoring and security of public spaces such as bank ATMs and workplaces, due to daily rise in criminal activities. Currently, monocular CCTV cameras that only record RGB video are used for monitoring such restricted areas. In addition to RGB data, the RGB + D sensor also offers depth information about the scene. To overcome the issue of online recognition of anomalous activities in Bank ATMs, a supervised deep learning method utilizing Dual-Channel Capsule Generative Adversarial Network (DCCGAN) and RGB + D sensor is proposed. The input RGB + D Dataset is given to super pixel motion detection method to find the region of interest (ROI). Motion detection is a significant stage examination of wide scene for background subtraction and foreground detection. After arranging the motion detection, its region is positioned frame by frame. Then, the detected ROI is given to fast discrete curvelet transform with the wrapping (FDCT-WRP) method. FDCT-WRP feature extraction method. These extracting features are supplied to Deep Convolutional Spiking neural network (DCSNN), which realize the object. RGB and depth video segments are used to create motion templates from the RGB + D data online video stream. These templates are trained on DCCGANs to identify distrustful events in current activity and categorized as normal and abnormal. Additionally, a unique RGB + D dataset is employed because there was no existing dataset available for analyzing human activity in ATMs. The proposed DUA-DCCGAN-ATM approach is assessed on qualitative with quantitative statistical evaluation parameters and identify suspect occurrence with 0.932 precision and 98.2 % accuracy. The detailed statistical analysis exemplifies that the proposed technique can identify distrustful events in a real-time online manner prior completing the anomalous activity.

Analysis of corporate network cyber threats based on parallel processing of Netflow data

Public services of various organizations are subject to constant cyber attacks, which increases information security risks. Network traffic analysis is an important task to ensure the safe operation of network infrastructure, including corporate networks. This paper provides an overview of the main approaches for analyzing network traffic, provides related works, and points out the shortcomings of existing works. One method is to analyze network traffic data using the Netflow protocol, which allows traffic data to be stored at the L3 layer of the OSI model. A feature of the study is the use of long observation periods. When storing data over long time intervals, the logs become large, which requires parallelization for primary data processing. The authors developed a cross-platform software package for distributed processing of network activity logs, which was used to analyze the network activity of the corporate network of the Krasnoyarsk Scientific Center for 2021–2022. A diagram of the software package is shown, its capabilities and operating features are described. Data sources for analysis and processing methods are provided. In this paper the authors formulated and formalized heuristic criteria for the anomaly of network traffic, which identify the presence of possible network attacks, and extracted datasets on the network activity of various application-level protocols. For the obtained data sets, statistical indicators were calculated, information about anomalous network activity was obtained for two years. In this work we tested the previously proposed method for comparing the cyber threats risks for different time intervals, which showed a significant increase in risks for 50% of indicators in 2022. Comparisons of monthly intervals over different years showed similar increases in risk. Thus, the method has shown its efficiency and can be used in other areas in which there are groups of criteria for independent indicators. The authors proposed plans for further development of methods for analyzing network activity.

Network intrusion detection system by learning jointly from tabular and text‐based features

AbstractNetwork intrusion detection systems (NIDS) play a critical role in maintaining the security and integrity of computer networks. These systems are designed to detect and respond to anomalous activities that may indicate malicious intent or unauthorized access. The need for robust NIDS solutions has never been more pressing in today's digital landscape, characterized by constantly evolving cyber threats. Deploying effective NIDS can be challenging, particularly in accurately identifying network anomalies amid the ever‐increasing sophisticated and difficult‐to‐detect cyber threats. The motivation for our research stems from the recognition that while NIDS studies have made significant strides, there remains a crucial need for more effective and accurate methods to detect network anomalies. Commonly used features in NIDS studies include network logs, with some studies exploring text‐based features such as payload. However, traditional machine and deep learning models may need to be improved in learning jointly from tabular and text‐based features. Here, we present a new approach that integrates both tabular and text‐based features to improve the performance of NIDS. Our research aims to address the existing limitations of NIDS and contribute to the development of more reliable and efficient network security solutions by introducing more effective and accurate methods for detecting network anomalies. Our internal experiments have revealed that the deep learning approach utilizing tabular features produces favourable results, whereas the pre‐trained transformer approach needs to perform sufficiently. Hence, our proposed approach, which integrates both feature types using deep learning and pre‐trained transformer approaches, achieves superior performance. These findings indicate that integrating both feature types using deep learning and pre‐trained transformer approaches can significantly improve the accuracy of network anomaly detection. Moreover, our proposed approach outperforms the state‐of‐the‐art methods in terms of accuracy, F1‐score, and recall on commonly used NIDS datasets consisting of ISCX‐IDS2012, UNSW‐NB15, and CIC‐IDS2017, with F1‐scores of 99.80%, 92.37%, and 99.69%, respectively, indicating its effectiveness in detecting network anomalies.

Detecting Global Events with Bayesian Changepoint Detection on Flight Data

As a means of enhancing the intelligence community’s ability to be prepared and prompt in the detection of global events, we present a Bayesian changepoint detection methodology to detect anomalous activity in open-source flight data. We demonstrate a computationally inexpensive methodology to monitor a geographic location for changes in flight activity over time and demonstrate its utility in a case study of the 2022 Russian invasion of Ukraine. Beyond flight data, the methodology described in this paper shows the potential to generate near real-time situational awareness using open-source time series data streams. This paper was previously published and presented in the Donald R. Keith Memorial Capstone Conference at USMA in May of 2023.

Anomalous peroxidase activity of cytochrome c is the primary pathogenic target in Barth syndrome.

Barth syndrome (BTHS) is a life-threatening genetic disorder with unknown pathogenicity caused by mutations in TAFAZZIN (TAZ) that affect remodeling of mitochondrial cardiolipin (CL). TAZ deficiency leads to accumulation of mono-lyso-CL (MLCL), which forms a peroxidase complex with cytochrome c (cyt c) capable of oxidizing polyunsaturated fatty acid-containing lipids. We hypothesized that accumulation of MLCL facilitates formation of anomalous MLCL-cyt c peroxidase complexes and peroxidation of polyunsaturated fatty acid phospholipids as the primary BTHS pathogenic mechanism. Using genetic, biochemical/biophysical, redox lipidomic and computational approaches, we reveal mechanisms of peroxidase-competent MLCL-cyt c complexation and increased phospholipid peroxidation in different TAZ-deficient cells and animal models and in pre-transplant biopsies from hearts of patients with BTHS. A specific mitochondria-targeted anti-peroxidase agent inhibited MLCL-cyt c peroxidase activity, prevented phospholipid peroxidation, improved mitochondrial respiration of TAZ-deficient C2C12 myoblasts and restored exercise endurance in a BTHS Drosophila model. Targeting MLCL-cyt c peroxidase offers therapeutic approaches to BTHS treatment.

Performance evaluation of metaheuristics-tuned recurrent neural networks for electroencephalography anomaly detection.

Electroencephalography (EEG) serves as a diagnostic technique for measuring brain waves and brain activity. Despite its precision in capturing brain electrical activity, certain factors like environmental influences during the test can affect the objectivity and accuracy of EEG interpretations. Challenges associated with interpretation, even with advanced techniques to minimize artifact influences, can significantly impact the accurate interpretation of EEG findings. To address this issue, artificial intelligence (AI) has been utilized in this study to analyze anomalies in EEG signals for epilepsy detection. Recurrent neural networks (RNNs) are AI techniques specifically designed to handle sequential data, making them well-suited for precise time-series tasks. While AI methods, including RNNs and artificial neural networks (ANNs), hold great promise, their effectiveness heavily relies on the initial values assigned to hyperparameters, which are crucial for their performance for concrete assignment. To tune RNN performance, the selection of hyperparameters is approached as a typical optimization problem, and metaheuristic algorithms are employed to further enhance the process. The modified hybrid sine cosine algorithm has been developed and used to further improve hyperparameter optimization. To facilitate testing, publicly available real-world EEG data is utilized. A dataset is constructed using captured data from healthy and archived data from patients confirmed to be affected by epilepsy, as well as data captured during an active seizure. Two experiments have been conducted using generated dataset. In the first experiment, models were tasked with the detection of anomalous EEG activity. The second experiment required models to segment normal, anomalous activity as well as detect occurrences of seizures from EEG data. Considering the modest sample size (one second of data, 158 data points) used for classification models demonstrated decent outcomes. Obtained outcomes are compared with those generated by other cutting-edge metaheuristics and rigid statistical validation, as well as results' interpretation is performed.

Network Intrusion Detection Using Autoencode Neural Network

In today's interconnected digital landscape, safeguarding computer networks against unauthorized access and cyber threats is of paramount importance. NIDS play a crucial role in identifying and mitigating potential security breaches. This research paper explores the application of autoencoder neural networks, a subset of deep learning techniques, in the realm of Network Intrusion Detection.Autoencoder neural networks are known for their ability to learn and represent data in a compressed, low-dimensional form. This study investigates their potential in modeling network traffic patterns and identifying anomalous activities. By training autoencoder networks on both normal and malicious network traffic data, we aim to create effective intrusion detection models that can distinguish between benign and malicious network behavior.The paper provides an in-depth analysis of the architecture and training methodologies of autoencoder neural networks for intrusion detection. It also explores various data preprocessing techniques and feature engineering approaches to enhance the model's performance. Additionally, the research evaluates the robustness and scalability of autoencoder-based NIDS in real-world network environments. Furthermore, ethical considerations in network intrusion detection, including privacy concerns and false positive rates, are discussed. It addresses the need for a balanced approach that ensures network security while respecting user privacy and minimizing disruptions. operation. This approach compresses the majority samples & increases the minority sample count in tough samples so that the IDS can achieve greater classification accuracy.

The Role of Underlying Boundary Forcing in Shaping the Recent Decadal Change of Persistent Anomalous Activity over the Ural Mountains

The Role of Underlying Boundary Forcing in Shaping the Recent Decadal Change of Persistent Anomalous Activity over the Ural Mountains

Numerical Feature Selection and Hyperbolic Tangent Feature Scaling in Machine Learning-Based Detection of Anomalies in the Computer Network Behavior

Anomaly-based intrusion detection systems identify the computer network behavior which deviates from the statistical model of typical network behavior. Binary classifiers based on supervised machine learning are very accurate at classifying network data into two categories: normal traffic and anomalous activity. Most problems with supervised learning are related to the large amount of data required to train the classifiers. Feature selection can be used to reduce datasets. The goal of feature selection is to select a subset of relevant input features to optimize the evaluation and improve performance of a given classifier. Feature scaling normalizes all features to the same range, preventing the large size of features from affecting classification models or other features. The most commonly used supervised machine learning models, including decision trees, support vector machine, k-nearest neighbors, weighted k-nearest neighbors and feedforward neural network, can all be improved by using feature selection and feature scaling. This paper introduces a new feature scaling technique based on a hyperbolic tangent function and damping strategy of the Levenberg–Marquardt algorithm.

Smart Surveillance: A Review & Survey Through Deep Learning Techniques for Detection & Analysis

Big data applications are consuming most of the space in industry and research area. Among the widespread examples of big data, the role of video streams from CCTV cameras is equally important as other sources like social media data, sensor data, agriculture data, medical data and data evolved from space research. Surveillance videos have a major contribution in unstructured big data. CCTV cameras are implemented in all places where security having much importance. Manual surveillance seems tedious and time consuming. Security can be defending in different terms in different contexts like theft identification, violence detection, chances of explosion etc. In crowded public places the term security covers almost all type of abnormal events. Among them violence detection is difficult to handle since it involves group activity. The anomalous or abnormal activity analysis in a crowd video scene is very difficult due to several real world constraints. The paper includes a deep rooted survey which starts from object recognition, action recognition, crowd analysis and finally violence detection in a crowd environment. Majority of the papers reviewed in this survey are based on deep learning technique. Various deep learning methods are compared in terms of their algorithms and models. The main focus of this survey is application of deep learning techniques in detecting the exact count, involved persons and the happened activity in a large crowd at all climate conditions. Paper discusses the underlying deep learning implementation technology involved in various crowd video analysis methods. Real time processing, an important issue which is yet to be explored more in this field is also considered. Not many methods are there in handling all these issues simultaneously. The issues recognized in existing methods are identified and summarized. Also, future direction is given to reduce the obstacles identified. The survey provides a bibliographic summary of papers from Science-direct, IEEE Xplore and ACM digital library.