Detection Of Anomalous Behavior Research Articles

무인 점포 실시간 이상 행동 감지를 위한 Transformer 기반지능형 CCTV 시스템

The rapid expansion of unmanned retail stores has raised critical security concerns, thereby necessitating the development and implementation of robust protective measures. The absence of real-time monitoring systems in these environments has heightened the vulnerability to risks such as theft and property damage. Although closed-circuit television (CCTV) systems have been deployed to retrospectively investigate criminal activities, these systems are often insufficient in preventing incidents. This study introduces a Transformer-based intelligent CCTV system designed for the real-time detection of anomalous behaviors within unmanned retail environments. Unlike conventional systems that rely on basic machine learning models, our proposed system leverages human joint position data extracted from CCTV footage to classify a range of anomalous behaviors, including theft, falls, and property damage. Additionally, extensive hyperparameter optimization was performed to maximize the model's effectiveness in these specific environments. Our System enhances the system's usability by enabling real-time identification of anomalous behavior, complete with location data, timestamps, and corresponding video frame sequences.

Correction to “Expanding the Lognormal Response Time Model Using Profile Similarity Metrics to Improve the Detection of Anomalous Testing Behavior”

Correction to “Expanding the Lognormal Response Time Model Using Profile Similarity Metrics to Improve the Detection of Anomalous Testing Behavior”

Detection and Analysis of Anomalous Behavior in On-Orbit Satellites Using AI Algorithms

The increasing deployment of satellites for essential applications necessitates robust anomaly detection to maintain their operational integrity. Traditional methods, which depend on manual monitoring and predefined thresholds, often prove inadequate in the complex space environment. This paper investigates the application of Artificial Intelligence (AI) algorithms to improve the detection and analysis of anomalous behavior in on-orbit satellites. AI, especially through machine learning (ML) and deep learning (DL), provides advanced capabilities for processing extensive telemetry data and identifying intricate patterns. By leveraging historical data, AI systems can establish normal operational parameters and detect deviations indicating potential anomalies. Techniques such as supervised and unsupervised learning are employed to develop models with high predictive accuracy. Furthermore, AI facilitates root cause analysis by correlating anomalies with operational conditions or external factors, enabling effective corrective measures. The integration of AI also promotes autonomous satellite operations, which are crucial for deep-space missions. This advancement enhances satellite reliability and safety, supporting sustainable and progressive space exploration. In this research, machine learning algorithms were employed to develop the proposed anomaly detection system. The system aims to detect subtle failures in the spacecraft’s attitude dynamics system, particularly in the reaction wheel subsystem, by learning solely from the spacecraft's nominal behavioral data. The system was developed from a small satellite's attitude dynamics control system, which may exhibit bearing failures in the reaction wheels. Two types of anomaly detection systems were introduced: a two-sided learning anomaly detection system and a one-sided learning anomaly detection system. For this study, a two-sided learning anomaly detection system was developed using the Logistic Regression (LR) method. This provided a foundation for the training process using a machine learning approach. By learning from both nominal and failure behaviors of the satellite, the system was designed to detect small reaction wheel friction failures effectively.

Anomalous Network Behaviour Detection in Interoperable Health Systems using Machine Learning in Resource Limited Areas

The connection of devices in distributed environments produces and shares a vast amount of data useful for different organisational decision-making. In healthcare service organisations, for example, multiple e-health systems from different departments or facilities connect and share health data and information. During sharing, proper management is important to ensure the information is secure against intruders. Machine learning as a non-conventional security technique can be used along conventional techniques like firewalls, antivirus and intrusion detection systems to predict future network threats and other anomalies using historical backgrounds and other features. However, some machine learning algorithms have complex computation thus requiring resourceful systems in terms of network bandwidth, CPU power, memory, and storage capacity. In resource-constrained environments, therefore, special consideration is needed to ensure that the analysis of the big data is successful and that the benefits associated with them are effectively obtained. In this paper, a Machine Learning algorithm was selected among four algorithms whose performance was compared through various performance metrics. Classification accuracy, Mean Absolute Error (MAE), Root Mean Square Error (RMSE), and Relative Absolute Error (RAE) among other performance metrics were used to compare the ANN, Random forest, Decision trees, and Naïve byes classification algorithms using an extract from CICDDOS2019 dataset. Using the Weka version 3.8.6, the algorithms were compared to choose the best one to classify the data. By using three computers with different resources, the experiments were carried out to determine the performance of those machine learning algorithms. The result revealed that the random forest produced a good average classification performance in resource-limited systems since it surpassed other algorithms in classifying the data at an average of 99 per cent with a low average mean absolute error of 0.0001. Furthermore, as an ensemble that classifies with multiple decision trees algorithm, it likewise uses reasonable time to build and test the model therefore recommended for resource-limited systems.

Anomalous behavior detection based on optimized graph embedding representation in social networks

Anomalous behaviors in social networks can lead to privacy leaks and the spread of false information. In this paper, we propose an anomalous behavior detection method based on optimized graph embedding representation. Specifically, the user behavior logs are first extracted into a social network user behavior temporal knowledge graph, based on which the graph embedding representation method is used to transform the network topology and temporal information in the user behavior knowledge graph into structural embedding vectors and temporal information embedding vectors, and the hybrid attention mechanism is used to merge the two types of vectors to obtain the final entity embedding to complete the prediction and complementation of the temporal knowledge graph of user behavior. We use graph neural networks, which use the temporal information of user behaviors as a time constraint and capture both user behavioral and semantic information. It converts the two parts of information into vectors for concatenation and linear transformation to obtain a comprehensive representation vector of the whole subgraph, as well as joint deep learning models to evaluate abnormal behavior. Finally, we perform experiments on the Yelp dataset to validate that our method achieves a 9.56% improvement in the F1-score.

Detection and prediction of anomalous behaviors of enterprise’s employees based on data-mining and optimization algorithm

Internal employees have always been at the core of organizational security management challenges. Once an employee exhibits behaviors that threaten the organization, the resulting damage can be profound. Therefore, analyzing reasonably stored behavioral data can equip managers with effective threat monitoring and warning solutions. Through data-mining, a knowledge graph for internal threat data is deduced, and models for detecting anomalous behaviors and predicting resignations are developed. Initially, data-mining is employed to model the knowledge ontology of internal threats and construct the knowledge graph; subsequently, using the behavioral characteristics, the BP neural network is optimized with the Sparrow Search Algorithm (SSA), establishing a detection model for anomalous behaviors (SBP); additionally, behavioral sequences are processed through data feature vectorization. Utilizing SBP, the LSTM network is further optimized, creating a predictive model for employee behaviors (SLSTM); ultimately, SBP detects anomalous behaviors, while SLSTM predicts resignation intentions, thus enhancing detection strategies for at-risk employees. The integration of these models forms a comprehensive threat detection technology within the organization. The efficacy and practicality of detecting anomalous behaviors and predicting resignations using SBP and SLSTM are demonstrated, comparing them with other algorithms and analyzing potential causes of misjudgment. This work has enhanced the detection efficiency and update speed of abnormal employee behaviors, lowered the misjudgment rate, and significantly mitigated the impact of internal threats on the organization.

Residual Attention based Long-Short Term Memory with Self Gated Rectified Linear Unit for Anomalous Behavior Detection

Residual Attention based Long-Short Term Memory with Self Gated Rectified Linear Unit for Anomalous Behavior Detection

A Review of Anomalous Behavior Detection in Internet of Vehicles

The intelligent transportation system with the Internet of Vehicles as its core is gradually penetrating into the lives of urban residents, but it has also exposed security threats such as remote control of vehicles and leakage of personal information of car owners. Compared to the security issues at the level of vehicle end devices and vehicle networking service platforms, the article focuses on the security issues of abnormal behavior in vehicle networking. Based on this, the article reviews the relevant research on abnormal behavior detection mechanisms in the Internet of Vehicles environment in recent years. Firstly, the definition of abnormal behavior was analyzed, and the basic framework for detecting abnormal behavior was provided; Then, the classification of abnormal behavior detection mechanisms was discussed from three aspects: deep learning based abnormal behavior detection, spatiotemporal fusion based abnormal behavior detection, and visual based abnormal behavior detection; Finally, the unresolved technical issues and future research trends in the current abnormal behavior detection mechanism for the Internet of Vehicles were summarized.

Ship Anomalous Behavior Detection in Port Waterways Based on Text Similarity and Kernel Density Estimation

The navigational safety of ships on waterways plays a crucial role in ensuring the operational efficiency of ports. Ship anomalous behavior detection is an important method of water traffic surveillance that can effectively identify abnormal ship behavior, such as sudden acceleration or deceleration. In order to detect potential anomalous ship behavior in real time, a method for ship anomalous behavior detection in waterways is proposed based on text similarity and kernel density estimation. Under the assumption of known traffic patterns entering and leaving the port, this method can identify ship behaviors that violate traffic patterns in real time. Firstly, kernel density estimation is applied to construct a traffic pattern density model for ship trajectories entering and leaving the port, used to estimate the density values of ship motion states. Simultaneously, a semantic transformation method is used to convert traffic pattern trajectory into pattern trajectory text, which is used to identify the ship’s traffic pattern. Subsequently, the historical trajectory data of the target ship are transformed into textual trajectories, and text similarity is used to identify ship inbound and outbound traffic patterns. Furthermore, the constructed traffic pattern density model is used to estimate real-time density values of the state of ship motion, and the trajectory points that exceed the threshold of the anomaly factor are marked as anomalies. Finally, the effectiveness of the proposed method is validated using simulation data, and the results indicate an accuracy of more than 90% for the comprehensive detection of anomalous behavior. This study, approaching the detection of potential ship anomalous behavior from the perspective of port traffic patterns, enriches the methods of ship anomalous behavior detection in port waterways.

A survey on social network’s anomalous behavior detection

The onset of Web 3.0 has catalyzed the rapid advancement of social networking, transforming platforms into essential elements deeply embedded within the fabric of daily life. Researchers have proposed several methods for detecting anomalous behaviors in various scenarios. This article provides a comprehensive review of current research and the latest developments in anomalous behavior detection within social networks. We present a hierarchical three-layer categorization scheme based on the distinct characteristics of base-level detection technologies and various datasets. First, anomaly detection based on user behavioral characteristics can intuitively reflect deviations in individual behavior. However, it may overlook the overall network structure’s impact. Second, detecting anomalies within a network’s topological structure highlights structural significance, but may overlook the subtle nuances of individual behavior. Finally, the coordinated fusion method, which blends individual behavioral characteristics and the network’s topological structure, addresses the multifaceted nature of anomalies, yielding a more thorough and accurate anomaly detection strategy. This paper provides an overview and assesses the performance of three anomaly detection methods. Furthermore, we explore the challenges associated with social network anomaly detection and the potential pathways for further research.

Expanding the Lognormal Response Time Model Using Profile Similarity Metrics to Improve the Detection of Anomalous Testing Behavior

AbstractThe Lognormal Response Time (LNRT) model measures the speed of test‐takers relative to the normative time demands of items on a test. The resulting speed parameters and model residuals are often analyzed for evidence of anomalous test‐taking behavior associated with fast and poorly fitting response time patterns. Extending this model, we demonstrate the connection between the existing LNRT model parameters and the “level” component of profile similarity, and we define two new parameters for the LNRT model representing profile “dispersion” and “shape.” We show that while the LNRT model measures level (speed), profile dispersion and shape are conflated in model residuals, and that distinguishing them provides meaningful and useful parameters for identifying anomalous testing behavior. Results from data in a situation where many test‐takers gained preknowledge of test items revealed that profile shape, not currently measured in the LNRT model, was the most sensitive response time index to the abnormal test‐taking behavior patterns. Results strongly support expanding the LNRT model to measure not only each test‐taker's level of speed, but also the dispersion and shape of their response time profiles.

Application of Distributed Graphs for Facilitation of Scalable Botnet Detection and Response

Botnets pose a significant threat to modern network environments, exploiting compromised devices to carry out malicious activities such as distributed denial-of-service attacks, spam campaigns, and data theft. Traditional centralized detection systems often struggle to handle the scale and complexity of botnet attacks, leading to delays in detection and response. In response to these challenges, this paper explores the application of distributed graphs for facilitating scalable botnet detection and response. Distributed graphs offer a promising approach for modelling and analyzing complex network structures, enabling efficient detection of botnet propagation patterns and anomalous behaviour across distributed computing environments. The paper presents an overview of distributed graph-based botnet detection systems, discussing their architecture, design considerations, and key concepts such as graph partitioning, vertex-centric computation, and message passing in distributed graph algorithms. Case studies illustrate the practical application of distributed graph-based botnet detection in diverse network environments, highlighting success stories, challenges encountered, and lessons learned from deploying distributed graph systems in production cybersecurity operations. Finally, the paper discusses challenges and open research questions in the field of distributed graph-based botnet detection, addressing issues such as graph partitioning strategies, fault tolerance, privacy-preserving techniques, and integration with other security tools. It proposes potential avenues for future research and development in scalable botnet detection using distributed graphs, emphasizing the importance of adaptive threat response, collaboration with industry partners, and continuous improvement in detection algorithms for enhancing cybersecurity resilience against botnet attacks.

Threat Detection and Response Using AI and NLP in Cybersecurity

Introduction: In an age of rapid technical innovation and a growing digital world, protecting sensitive data from cyberattacks is crucial. The dynamic and complicated nature of these attacks requires novel cybersecurity solutions. Methods: This study analyses how Artificial Intelligence (AI) and Natural Language Processing (NLP) strengthen cybersecurity. The qualitative research approach is followed to gather data through a literature review of relevant scholarly articles and conduct interviews with cybersecurity specialists. Results: Recent AI advances have greatly enhanced the detection of anomalous patterns and behaviors in huge datasets, a key threat identification tool. NLP has also excelled at detecting malevolent intent in textual data, such as phishing efforts. AI and NLP enable adaptive security policies, enabling agile responses to evolving security issues. Expert interviews confirm that AI and NLP reduce false positives, improve threat intelligence, streamline network security setups, and improve compliance checks. These technologies enable responsive security policies, which give a strategic edge against developing security threats. AI and NLP's predictive skills could revolutionize cybersecurity by preventing threats. Conclusion: This study shows that AI and NLP have improved cybersecurity threat detection, automated incident response, and adaptive security policies. Overcoming threat detection, aggressive attacks and data privacy issues is essential to properly leveraging these advances and strengthening cyber resilience in a changing digital landscape.

Secure Enhancement for MQTT Protocol Using Distributed Machine Learning Framework.

The Message Queuing Telemetry Transport (MQTT) protocol stands out as one of the foremost and widely recognized messaging protocols in the field. It is often used to transfer and manage data between devices and is extensively employed for applications ranging from smart homes and industrial automation to healthcare and transportation systems. However, it lacks built-in security features, thereby making it vulnerable to many types of attacks such as man-in-the-middle (MitM), buffer overflow, pre-shared key, brute force authentication, malformed data, distributed denial-of-service (DDoS) attacks, and MQTT publish flood attacks. Traditional methods for detecting MQTT attacks, such as deep neural networks (DNNs), k-nearest neighbor (KNN), linear discriminant analysis (LDA), and fuzzy logic, may exist. The increasing prevalence of device connectivity, sensor usage, and environmental scalability become the most challenging aspects that novel detection approaches need to address. This paper presents a new solution that leverages an H2O-based distributed machine learning (ML) framework to improve the security of the MQTT protocol in networks, particularly in IoT environments. The proposed approach leverages the strengths of the H2O algorithm and architecture to enable real-time monitoring and distributed detection and classification of anomalous behavior (deviations from expected activity patterns). By harnessing H2O's algorithms, the identification and timely mitigation of potential security threats are achieved. Various H2O algorithms, including random forests, generalized linear models (GLMs), gradient boosting machine (GBM), XGBoost, and the deep learning (DL) algorithm, have been assessed to determine the most reliable algorithm in terms of detection performance. This study encompasses the development of the proposed algorithm, including implementation details and evaluation results. To assess the proposed model, various evaluation metrics such as mean squared error (MSE), root-mean-square error (RMSE), mean per class error (MCE), and log loss are employed. The results obtained indicate that the H2OXGBoost algorithm outperforms other H2O models in terms of accuracy. This research contributes to the advancement of secure IoT networks and offers a practical approach to enhancing the security of MQTT communication channels through distributed detection and classification techniques.

Detection of attacks in Internet of Things networks using machine learning methods

The increase in the volume of digital data generated, in particular, by smart devices of the Internet of Things, has made research related to the application of machine learning methods to detect anomalies in network traffic - the presence of network attacks - relevant. For this purpose, the article proposes a unified approach to detecting attacks at various levels of the Internet of Things network architecture, based on machine learning methods. The article investigates that at the level of a wireless sensor network, the detection of an attack is related to the detection of anomalous behavior of an Internet of Things device, in which the deviation of the behavior of an Internet of Things device from its profile can be considered as a compromise of the device. Building profiles of smart IoT devices is based on statistical characteristics, such as the intensity and duration of packet transmission, the proportion of relayed packets, etc. It has been studied that at the level of a local or global wired network of the Internet of Things, data aggregation takes place, the analysis of which is also performed by machine learning methods. Trained classifiers can become part of a network attack detection system that makes decisions about node compromise "on the fly". Models of network attack classifiers at the level of a wireless sensor network, and at the level of a local or global wired network are experimentally selected. The best results in terms of completeness and accuracy estimates are demonstrated by the random forest method for a wired local and (or) global network and by all considered methods for a wireless sensor network. Practical significance: the proposed classifier models can be used in the design of attack detection systems in Internet of Things networks.

Anomalous Behavior Detection in Trajectory Data of Older Drivers.

Given a road network and a set of trajectory data, the anomalous behavior detection (ABD) problem is to identify drivers that show significant directional deviations, hard-brakings, and accelerations in their trips. The ABD problem is important in many societal applications, including Mild Cognitive Impairment (MCI) detection and safe route recommendations for older drivers. The ABD problem is computationally challenging due to the large size of temporally-detailed trajectories dataset. In this paper, we propose an Edge-Attributed Matrix that can represent the key properties of temporally-detailed trajectory datasets and identify abnormal driving behaviors. Experiments using real-world datasets demonstrated that our approach identifies abnormal driving behaviors.

Adversarial Data Augmentation for HMM-based Anomaly Detection.

In this work, we concentrate on the detection of anomalous behaviors in systems operating in the physical world and for which it is usually not possible to have a complete set of all possible anomalies in advance. We present a data augmentation and retraining approach based on adversarial learning for improving anomaly detection. In particular, we first define a method for generating adversarial examples for anomaly detectors based on Hidden Markov Models (HMMs). Then, we present a data augmentation and retraining technique that uses these adversarial examples to improve anomaly detection performance. Finally, we evaluate our adversarial data augmentation and retraining approach on four datasets showing that it achieves a statistically significant performance improvement and enhances the robustness to adversarial attacks. Key differences from the state-of-the-art on adversarial data augmentation are the focus on multivariate time series (as opposed to images), the context of one-class classification (in contrast to standard multi-class classification, and the use of HMMs (in contrast to neural networks).

Weakly-Supervised Video Anomaly Detection with MTDA-Net

Weakly supervised anomalous behavior detection is a popular area at present. Compared to semi-supervised anomalous behavior detection, weakly-supervised learning both eliminates the need to crop videos and solves the problem of semi-supervised learning’s difficulty in handling long videos. Previous work has used graph convolution or self-attention mechanisms to model temporal relationships. However, these methods tend to model temporal relationships at a single scale and lack consideration of the aggregation problem for different temporal relationships. In this paper, we propose a weakly supervised anomaly detection framework, MTDA-Net, with emphasis on modeling different temporal relationships and enhanced semantic discrimination. To this end, we construct a new plug-and-play module, MTDA, which uses three branches, Multi-headed Attention (MHA), Temporal Shift (TS), and Dilated Aggregation (DA), to extract different temporal sequences. Specifically, the MHA branch can globally model the video information and project the features into different semantic spaces to enhance the expressiveness and discrimination of the features. The DA branch extracts temporal information of different scales via dilated convolution and captures the temporal features of local regions in the video. The TS branch can fuse the features of adjacent frames on a local scale and enhance the information flow. MTDA-Net can learn the temporal relationships between video segments on different branches and learn powerful video representations based on these relationships. The experimental results on the XD-Violence dataset show that MTDA-Net can significantly improve the detection accuracy of abnormal behaviors.

Interpretation of Bridge Health Monitoring Data from Satellite InSAR Technology

This paper presents a study on applying satellite Interferometric Synthetic Aperture Radar (InSAR) technology for the remote monitoring of road bridges and interpreting the results from a structural standpoint. The motivation behind this study arises from the widespread deterioration observed in many road bridges worldwide, leading to the need for large-scale, economic, and effective structural health monitoring (SHM) techniques. While traditional contact-type sensors have cost sustainability limitations, remote sensing techniques, including satellite-based InSAR, offer interesting alternative solutions. The objective of this study is three-fold: (i) to process InSAR data specifically for road bridges in operational conditions through the Multi-Temporal InSAR technique and extract displacement time series of reflective targets on their decks; (ii) to interpret the observed millimetric bridge displacements to verify the consistency with expected response to environmental loads and the possibility to detect unexpected behaviours; and (iii) to investigate the correlation between bridge displacements and environmental loads as temperature and river water flow variations. The study focuses on the multi-span prestressed concrete A22 Po River Bridge in Italy, utilising a dataset of X-Band HIMAGE mode Stripmap images acquired over eight years by the satellite constellation COSMO-SkyMed. The study demonstrates the effectiveness of InSAR-based SHM in detecting temperature-induced displacements and identifying different bridge spans simply by studying the sign of the correlation between displacements and temperature variation. It also reveals an unexpected behaviour in a portion of the bridge retrofitted to prevent scour issues a few years before the dataset start date. Furthermore, the correlation between pier displacements and river level variations underscores the importance of considering environmental factors and the geotechnical characteristics of the foundation soils in bridge monitoring. The results obtained from this study are significant with a view to using this satellite InSAR-based monitoring for early detection of anomalous bridge behaviour on a large scale.

Targeted mining of contiguous sequential patterns

In recent years, sequential pattern mining (SPM) has been applied in many domains, including recommender systems, fraud detection, and other related industries. Target-oriented SPM (TSPM) has been proposed to improve the interpretability of SPM by addressing the issue that too many irrelevant or meaningless sequential patterns are often discovered, which facilitates data analysis. Nevertheless, current TSPM research does not consider contiguity to identify sequential patterns, despite the fact that it is an important feature of sequence data. Contiguity has significant implications in applications such as bioinformatics and network intrusion detection, as it can aid the detection of periodic patterns and anomalous behaviors. Therefore, this paper proposes a novel problem of target-oriented contiguous sequential pattern mining (TCSPM) and introduces two algorithms, called TCSPM and TCSPM+. TCSPM utilizes a compact data structure called sequence chain and relies on a sequence chain pruning strategy to reduce the search space. In addition, TCSPM applies a reverse matching technique to quickly search for targeted contiguous sequences. TCSPM+ is an optimized version of TCSPM that utilizes sequence segmentation operations and a query sequence pruning strategy to further improve performance. Extensive experiments on both real and synthetic datasets demonstrate that TCSPM is an efficient algorithm for discovering targeted contiguous sequential patterns (TCSPs). TCSPM+ substantially enhances the performance of TCSPM in terms of runtime, memory usage, and scalability, outperforming TCSPM by an order of magnitude on some datasets.