Anomaly Classification Research Articles

Intelligent anomaly identification in cyber-physical inverter-based systems

Modern cyber-physical systems have become more autonomous and distributed with the inclusion of advanced control architectures and communication networks. Power electronics-based inverters that employ extensive communication structures are integral part of such systems. The controllers for inverter-based systems rely on communication networks that make them vulnerable to cyber-physical anomalies. The cyber anomalies occur due to malicious attacks targeting the communication layer and physical anomalies are caused by power system faults in the physical layer of the microgrid. In this work, an intelligent anomaly identification (IAI) technique for such systems is presented utilizing data driven artificial intelligence tools that employ multi class support vector machines (MSVM) for anomaly classification and localization. The effects of cyber anomalies such as false data injection and denial of service attacks that target the communication network are considered in this work. In addition, the physical anomalies due to power system faults are also considered. The proposed technique utilizes statistical features extracted from measurements for optimal learning of a dual of MSVM classifiers. The mean absolute percentage error is used as a performance metric and the results are validated by comparing to artificial neural network, Naive Bayes classification and using real time simulations in OPAL-RT.

Congenital anomalies in children with postneonatally acquired cerebral palsy: an international data linkage study.

To describe the major congenital anomalies present in children with postneonatally acquired cerebral palsy (CP), and to compare clinical outcomes and cause of postneonatally acquired CP between children with and without anomalies. Data were linked between total population CP and congenital anomaly registers in five European and three Australian regions for children born 1991 to 2009 (n=468 children with postneonatally acquired CP; 255 males, 213 females). Data were pooled and children classified into mutually exclusive categories based on type of congenital anomaly. The proportion of children with congenital anomalies was calculated. Clinical outcomes and cause of postneonatally acquired CP were compared between children with and without anomalies. Major congenital anomalies were reported in 25.6% (95% confidence interval [CI] 21.7-29.9) of children with postneonatally acquired CP. Cardiac anomalies, often severe, were common and present in 14.5% of children with postneonatally acquired CP. Clinical outcomes were not more severe in children with congenital anomalies than those without anomalies. Cause of postneonatally acquired CP differed with the presence of congenital anomalies, with cerebrovascular accidents predominating in the anomaly group. Congenital anomalies were likely associated with cause of postneonatally acquired CP in 77% of children with anomalies. In this large, international study of children with postneonatally acquired CP, congenital anomalies (particularly cardiac anomalies) were common. Future research should determine specific causal pathways to postneonatally acquired CP that include congenital anomalies to identify opportunities for prevention. One-quarter of children with postneonatally acquired cerebral palsy (CP) have a major congenital anomaly. Cardiac anomalies, often severe, are the most common anomalies. Causes of postneonatally acquired CP differ between children with and without congenital anomalies.

PGGAN-Based Anomaly Classification on Chest X-Ray Using Weighted Multi-Scale Similarity

To use artificial intelligence to assist in diagnoses applications, a model to utilize quality data is required, which results in massive time and cost. In medical data, data imbalance occurs because the amount of data with lesions is less than that without lesions. To overcome this limitation, this study proposes a progressive growth of generative adversarial networks (PGGAN)-based anomaly classification on chest X-rays using weighted multi-scale similarity. An anomaly detection method is applied to learn the distribution of normal images to solve the problem of data imbalance. The use of PGGAN, which is a model that generates high-resolution images by gradually adding layers, enables to find image characteristics on a multi-scale and define the similarity between an original image and a generated image. The anomaly score is calculated by applying the weighted arithmetic mean to a resolution-by-resolution similarity. The threshold is defined after the analysis of the F1-score, and then the classification performance is evaluated. The accuracy of the proposed model was assessed using a confusion matrix and compared with that of a conventional classification model, and the efficiency was demonstrated through ablation studies. The classification accuracy of the test dataset was 0.8525. Compared to a U-net-based disease classifier with low-resolution which accuracy was 0.8410, the performance of the proposed model was 0.8507, exhibited an improvement.

SPS Model: a significant algorithm to reduce the time and computer memory required in geostatistical simulations

In geochemical anomaly classification, different mathematical-statistical models have been applied. The final classified map provides only one scenario. This model is not certain enough since every model provides several thresholds which are almost different from each other meaning dissimilarity and spatial uncertainty of the classified maps. Spatial uncertainty of the models could be quantified considering the difference between the associated geochemical scenarios simulated (called: ‘realizations’) by geostatistical simulation (GS) methods. However, the main problem with GS methods is that these methods are significantly time-consuming, and CPU- and memory-demanding. To improve such problems, in this research, the method of “scaling and projecting sample-locations (SPS)” is developed. Based on the SPS theory, first of all, the whole sample-locations were projected (centralized) and scaled into a box coordinated between (0,0) to (150,0) and (0,0) to (0,100), for example (they can be equal though), with the cell-size of 1 m2. Therefore, the time consumed and the memory demanded to generate a large number of realizations, for example, 1000 realizations based on the non-scaled/non-projected (NS/NP) and scaled/projected (S/P) sample locations per case-study were quantified. In this study, the turning bands simulation (TBSIM) were applied to geochemical datasets of three different case studies to take the area scales, regularity/irregularity and density of the samples into account. The comparison between NS/NP and S/P results statistically demonstrated the same results, however, the process and outputs of the S/P samples took a significantly shorter time and consumed a remarkably lower computer-memory. Therefore, experts are able to easily run this algorithm using any normal computer.

Spiking Neural Network Learning Models for Spike Sequence Learning and Data Classification

Supervised learning in Spiking Neural Network (SNN) is a hotbed for researchers due to the advantages temporal coded networks provide over that of rate-coded networks with respect to efficiency in information processing and transfer rates. Supervised learning in rate-coded networks though well established, it is difficult to directly apply such models to SNN due to difference in information coding schemes. In this paper, we seek to exploit the advantages of spiking neural networks for spike sequence learning in order to establish two (2) models; batch and sequential learning models for solving data classification tasks. The models are built using the least squares approach leveraging on its approximation abilities. The first set of experiments are on spikesequence learning in which an extensive evaluation of the model is performed using different inputoutput firing rates and learning periods. Results from these experiments show that the proposed model for spike sequence learning produced better performance than some existing models derived for spike sequence learning, particularly, at higher learning periods. The proposed models for data classification are also tested on some selected benchmark datasets most of which had imbalance class distributions and also on real-world road condition datasets for anomaly classification collected by the authors as part of a larger study. While the proposed models generalised very well to all datasets including those with the class imbalance problem where F1and Recall values above 0.90 were recorded, some well-know machine learning algorithms applied to the datasets yielded lower F1 and Recall values and in some cases recorded 0.0 Recall.

Anomaly Classification in People Counting and Occupancy Sensor Systems

People counting and occupancy sensor systems are used in diverse smart building applications like lighting controls, HVAC controls and workspace management. Anomalies in people counting and occupancy sensor data can result in undesirable application behavior. We address the problem of anomaly classification of sensor data using 3-class random forest classifiers in this work. We specifically consider sensor deployment scenarios where sensor fields-of-view may overlap. Depending on the sensor type, we devise signal features in time, frequency and spatio-temporal domains. The proposed random forest classifiers are evaluated using people counting and binary occupancy sensor data in an office environment, and are shown to have higher true positive rate and a lower false positive rate in comparison to an unsupervised {k} -means method and a random forest classifier with a single signal energy feature.

Performance analysis of network traffic capture tools and machine learning algorithms for the classification of applications, states and anomalies

Network analytics is of key importance for the proper management of network resources as the rate of Internet traffic continues to rise. The aim of this paper is to investigate the performance of different network traffic capture tools for extracting features and to evaluate the performance of eight Machine Learning (ML) algorithms in the classification of (1) applications; (2) states and (3) anomalies. Six Internet applications were considered along with four PC states and two network anomalies. The network was monitored by three traffic capture tools: PRTG, Colasoft Capsa and Wireshark and classification was performed using the Weka Toolkit. The performance of the eight ML classifiers was determined based on several metrics. The Colasoft Capsa feature set gave the highest accuracy for the classification of applications while same was achieved with features from PRTG for the classification of the four states considered. For anomaly classification, the ML algorithms showed almost similar classification behavior when the Colasoft Capsa or PRTG feature set was used.

Neutron noise-based anomaly classification and localization using machine learning

Neutron noise-based anomaly classification and localization using machine learning

Anomaly Classification Using Genetic Algorithm-based Random Forest Model for Network Attack Detection

Anomaly classification based on network traffic features is an important task to monitor and detect network intrusion attacks. Network-based intrusion detection systems (NIDSs) using machine learning (ML) methods are effective tools for protecting network infrastructures and services from unpredictable and unseen attacks. Among several ML methods, random forest (RF) is a robust method that can be used in ML-based network intrusion detection solutions. However, the minimum number of instances for each split and the number of trees in the forest are two key parameters of RF that can affect classification accuracy. Therefore, optimal parameter selection is a real problem in RF-based anomaly classification of intrusion detection systems. In this paper, we propose to use the genetic algorithm (GA) for selecting the appropriate values of these two parameters, optimizing the RF classifier and improving the classification accuracy of normal and abnormal network traffics. To validate the proposed GA-based RF model, a number of experiments is conducted on two public datasets and evaluated using a set of performance evaluation measures. In these experiments, the accuracy result is compared with the accuracies of baseline ML classifiers in the recent works. Experimental results reveal that the proposed model can avert the uncertainty in selection the values of RF’s parameters, improving the accuracy of anomaly classification in NIDSs without incurring excessive time.

Bayesian anomaly detection and classification for noisy data

Statistical uncertainties are rarely incorporated into machine learning algorithms, especially for anomaly detection. Here we present the Bayesian Anomaly Detection And Classification (BADAC) formalism, which provides a unified statistical approach to classification and anomaly detection within a hierarchical Bayesian framework. BADAC deals with uncertainties by marginalising over the unknown, true, value of the data. Using simulated data with Gaussian noise as an example, BADAC is shown to be superior to standard algorithms in both classification and anomaly detection performance in the presence of uncertainties. Additionally, BADAC provides well-calibrated classification probabilities, valuable for use in scientific pipelines. We show that BADAC can work in online mode and is fairly robust to model errors, which can be diagnosed through model-selection methods. In addition it can perform unsupervised new class detection and can naturally be extended to search for anomalous subsets of data. BADAC is therefore ideal where computational cost is not a limiting factor and statistical rigour is important. We discuss approximations to speed up BADAC, such as the use of Gaussian processes, and finally introduce a new metric, the Rank-Weighted Score (RWS), that is particularly suited to evaluating an algorithm’s ability to detect anomalies.

Unsupervised Anomaly Detection Using Style Distillation

Autoencoders (AEs) have been widely used for unsupervised anomaly detection. They learn from normal samples such that they produce high reconstruction errors for anomalous samples. However, AEs can exhibit the over-detection issue because they imperfectly reconstruct not only anomalous samples but also normal ones. To address this issue, we introduce an outlier-exposed style distillation network (OE-SDN) that mimics the mild distortions caused by an AE, which are termed as style translation. We use the difference between the outputs of the OE-SDN and AE as an alternative anomaly score. Experiments on anomaly classification and segmentation tasks show that the performance of our method is superior to existing methods.

A Many Objective-Based Feature Selection Model for Anomaly Detection in Cloud Environment

With the development of cloud computing technology (CCT), the processing of network traffic data becomes particularly important. However, the existing intrusion detection systems (IDS) are not efficient enough in analyzing network traffic data for anomaly detection. Therefore, this paper proposes a new data processing model for network anomaly detection. The model can simultaneously optimize the number of features (NF), accuracy, recall, false alarm rate (FAR) and precision. In order to better solve the model, an integrating dominance algorithm (MaOEA-ABC) with adaptive selection probability is proposed. In model, firstly, MaOEA-ABC is used to obtain the optimal feature subset by optimizing the above five objectives. Then, K-Nearest Neighbor (KNN) is used for network anomaly classification according to the optimal feature subset. Finally, MaOEA-ABC is compared with the existing standard MaOEAs algorithm (NSGA-III, EFR-RR, MaOEA-RD and PICEAg). The experimental results show that the approach can reduce the number of features on the basis of ensuring accuracy and FAR, thereby reducing the cost of detection.

PredictDeep: Security Analytics as a Service for Anomaly Detection and Prediction

As businesses embrace digitization, the Internet of Everything (IoE) begins to take shape and the Cloud continues to empower new innovations for big data -at the heart, Cloud analytic applications gain increasing momentum. Such applications have remarkable benefits for big data processing, making it easy, fast, scalable, and cost-effective; albeit, they pose many security risks. Security breaches causing anomalous activities due to malicious, vulnerable, or misconfigured analytic applications are considered the top security risks to big “sensitive” data. The risk is further expanded from the coupling of data analytics with the Cloud. Towards maintaining secure and trustworthy applications, effective anomaly detection and prediction become crucial tasks to be offered by Cloud providers. This paper presents, PredictDeep, a novel security analytics framework for anomaly detection and prediction. The proposed framework leverages log data collected from monitoring systems with graph analytics and deep learning techniques to add intelligence for detecting and predicting known and unknown patterns of security anomalies. It represents the collected data and transforms them into a graph model. The graph model captures the analytical activities as well as their interrelation. In this sense, such a model provides informed insight of the monitored application, understanding its behavior, and revealing anomalous patterns. Different from existing traditional rule-based machine learning and statistics-based approaches, our solution takes the benefits of incorporating not only available node attributes but also graph structure and context information to extract rich features that boost the anomaly classification and prediction. We leverage graph embeddings to represent the nodes and relationships in the graph model as feature vectors to learn and predict anomalies in an inductive way utilizing recent advanced deep graph neural network techniques. This design augments our solution with robustness and computational efficiency. Extensive experiments are conducted over an open-source Hadoop log dataset. The evaluation results demonstrate that PredictDeep is a viable solution and very effective.

FastICA and total variation algorithm for geochemical anomaly extraction

Because the ore-forming system in the crust of the Earth is a highly nonlinear system, geochemical anomaly classification is very important for improving the accuracy of metallogenic prediction. Further, since the distribution of the geochemical elements usually presents nonlinear characteristics due to the complexity and uncertainty of geology factors, the traditional linear data processing method has limited applications for an ore-forming system. The FastICA algorithm is applied to preprocessed geochemical data to reduce the interference information between elements. On the basis of obtaining the separated geochemical elements, the continuity of the spatial distribution of geochemical elements is considered, and combined with the application of the total variation (TV) in image processing; thus the total variation is introduced when processing geochemical data for anomaly analysis to eliminate the influence of singular geochemical data values. To measure the spatial distribution of geochemical elements, assays of the 1:10000 soil geochemical data in the area of Dachaidan in the Qinghai province of China are processed. The elemental anomaly zoning sequences are divided into three levels of anomaly: 85%, 90% and 95%. The anomaly isograms of Au and Cu processed by FastICA and the total variation algorithm predict the geological background of the study area better than the traditional cumulative frequency method. These results indicate that the application of the FastICA algorithm and the total variation algorithm to process geochemical data processing is valid and effective.

Fetal Ultrasound Image Evaluation of Chromosomal Anomaly Detection and Classification Using Conditional Rooted Neural Network (CRNN)

In this work, a computerized scheme of Chromosomal anomaly recognition and classification of Chromosomal abnormality such as Trisomy (T) T-13, T-18 and T-21 (Patau, Edwards and Down syndrome) based on Conditionally Rooted neural network (CRNN) with wavelet Filter. CRNN is used to estimate the chromosomal anomaly features separation from fetal provisions. The clear template of feature estimation from the first-trimester fetus of ultrasound images will be used to train the CRNN Neural Network. The software has successfully identified and classified the region of chromosomal anomaly. The evaluations show that our CRNN technique can attain good denoising and classification performance in comparison with existing methods. In this experiment, the results indicate that our proposed method can detect and classify the trisomy factors measurement from the US image regions precisely and robustly against speckle noise. The classification of Fetus US image datasets was done using CRNN classifier, and the accuracy of classification was found to be Highly efficient resolution for Chromosomal anomaly detection.

Hierarchical Anomaly Detection and Multimodal Classification in Large-Scale Photovoltaic Systems

Operation anomalies are common phenomena in large-scale solar farms. Effective anomaly detection and classification is essential for improving operation reliability and electricity generation. However, this is a challenging task due to the high complexity and wide variety of frequently occurring anomalies. Furthermore, existing preinstalled supervisory control and data acquisition systems (SCADA) can only provide a limited amount of information regarding the healthy condition of solar farms, making accurate anomaly detection and classification difficult. This paper presents a data-driven anomaly detection and classification solution, which can accurately detect and classify diverse photovoltaic system anomalies. The proposed solution does not require additional equipment or non-SCADA data collection. More specifically, the proposed work consists of two methods: 1) a hierarchical context-aware anomaly detection method using unsupervised learning; and 2) a multimodal anomaly classification method. The proposed solution has been deployed in two large-scale solar farms (39.36 and 21.62 MWp). Multimonth operation demonstrates the effectiveness, robustness, and cost and computation efficiency of the proposed solution.

Genetic Quantitative Techniques Combined with Continuous Electromagnetic Profiling to Identify Subtle Oil and Gas Reservoirs

Subtle reservoir exploration could not be commonly carried out by costly conventional methods especially when subtle reservoirs are becoming smaller in surfaces and reserves. The epochal genetic quantitative techniques were proved to be suitable for the subtle reservoir prospecting, but the anomaly grade classification method did not match the quantitative data qualitative dividing. And the combination of genetic quantitative techniques and geophysical exploration methods to the prospecting application for subtle reservoirs still need more studies. For the questions, 194 topsoil samples and 237.05 km continuous electromagnetic profiling (CEMP) lines were arranged in typical subtle reservoirs in the Suganhu Basin. The realtime-PCR technique was used to get methanotrophic, propanotrophic functional gene pmoA and prmA quantitative data. The results showed that the classification method using cumulative probability distribution curves with regression analyses could be used to classify the genetic quantitative anomalies by the equation of y = az. The genetic quantitative anomalies and source strata thickness showed positive correlation along the section lines in the east of study areas. Integrated studies between genetic quantitative anomalies and CEMP results in the stereoscopic direction indicated three promising areas in the Suganhu Basin. This research is expected to be extended to the same type of reservoirs prospecting work.

Data-Driven Blood Glucose Pattern Classification and Anomalies Detection: Machine-Learning Applications in Type 1 Diabetes.

BackgroundDiabetes mellitus is a chronic metabolic disorder that results in abnormal blood glucose (BG) regulations. The BG level is preferably maintained close to normality through self-management practices, which involves actively tracking BG levels and taking proper actions including adjusting diet and insulin medications. BG anomalies could be defined as any undesirable reading because of either a precisely known reason (normal cause variation) or an unknown reason (special cause variation) to the patient. Recently, machine-learning applications have been widely introduced within diabetes research in general and BG anomaly detection in particular. However, irrespective of their expanding and increasing popularity, there is a lack of up-to-date reviews that materialize the current trends in modeling options and strategies for BG anomaly classification and detection in people with diabetes.ObjectiveThis review aimed to identify, assess, and analyze the state-of-the-art machine-learning strategies and their hybrid systems focusing on BG anomaly classification and detection including glycemic variability (GV), hyperglycemia, and hypoglycemia in type 1 diabetes within the context of personalized decision support systems and BG alarm events applications, which are important constituents for optimal diabetes self-management.MethodsA rigorous literature search was conducted between September 1 and October 1, 2017, and October 15 and November 5, 2018, through various Web-based databases. Peer-reviewed journals and articles were considered. Information from the selected literature was extracted based on predefined categories, which were based on previous research and further elaborated through brainstorming.ResultsThe initial results were vetted using the title, abstract, and keywords and retrieved 496 papers. After a thorough assessment and screening, 47 articles remained, which were critically analyzed. The interrater agreement was measured using a Cohen kappa test, and disagreements were resolved through discussion. The state-of-the-art classes of machine learning have been developed and tested up to the task and achieved promising performance including artificial neural network, support vector machine, decision tree, genetic algorithm, Gaussian process regression, Bayesian neural network, deep belief network, and others.ConclusionsDespite the complexity of BG dynamics, there are many attempts to capture hypoglycemia and hyperglycemia incidences and the extent of an individual’s GV using different approaches. Recently, the advancement of diabetes technologies and continuous accumulation of self-collected health data have paved the way for popularity of machine learning in these tasks. According to the review, most of the identified studies used a theoretical threshold, which suffers from inter- and intrapatient variation. Therefore, future studies should consider the difference among patients and also track its temporal change over time. Moreover, studies should also give more emphasis on the types of inputs used and their associated time lag. Generally, we foresee that these developments might encourage researchers to further develop and test these systems on a large-scale basis.

3D geochemical modeling for subsurface targets of Dashui Au deposit in Western Qinling (China)

Three dimensional (3D) geochemical modeling was used to identify deposit scale exploration targets combining the geological (110 boreholes and 6 tunnels with 709 assay borehole samples) dataset and 374 litho-geochemical samples in the Dashui Au deposit (China). The Dashui Au deposit, located in the Western Qinling orogenic belt, is a magmatic-hydrothermal type large Au deposit discovered in recent years. The methodologies are summarized as follows: (1) the 3D geological bodies (ore bodies, granitic stocks/dikes, fault fractures, and alteration zones) modeling using GOCAD software. (2) 3D deposit-scale geological modeling in mining zones combination the deposit-scale plane maps, cross sections, longitudinal sections, tunnel planes, borehole datasets, and the range of 3D model is 2.3 × 0.55 × 0.6 km3. (3) The ordinary kriging and discrete smooth interpolation (DSI) interpolation methods were used to analyze the distribution trend of Au grade features combined with borehole and the primary litho-geochemical halos dataset, and the Cu/Pb ratio model is analyzed and constructed by metallogenic model/rule using primary geochemical halos data with DSI interpolation method. (4) The concentration-volume (C–V) fractal method is used to analyze the anomaly classification of grade and Cu/Pb ratio in 3D space using GeoCube software. The results show as follows: (1) the high Au grade value zones are associated with ore-bearing intrusion and the NW- and NE-trending fault structures; (2) the high Au value blocks of Cu/Pb ratio can be used to delineate ore-bearing magmatic fluids channel and mineralization zones; (3) the integrated exploration criteria are Cu/Pb ratio, the NE- and NW-trending faults, and intrusions in the Dashui deposits, the potential targets at depth are located in the southwest and southeast zones under the mining levels of No. 2, No. 170, No. 20, and No. 35 Au orebodies, and the Au resource is >172 t (the depth is <1000 m) in the study area.

AIDIS: Detecting and classifying anomalous behavior in ubiquitous kernel processes

Targeted attacks on IT systems are a rising threat against the confidentiality, integrity, and availability of critical information and infrastructures. With the rising prominence of advanced persistent threats (APTs), identifying and understanding such attacks has become increasingly important. Current signature-based systems are heavily reliant on fixed patterns that struggle with unknown or evasive applications, while behavior-based solutions usually leave most of the interpretative work to a human analyst.In this article we propose AIDIS, an Advanced Intrusion Detection and Interpretation System capable to explain anomalous behavior within a network-enabled user session by considering kernel event anomalies identified through their deviation from a set of baseline process graphs. For this purpose we adapt star structures, a bipartite representation used to approximate the edit distance between two graphs. Baseline templates are generated automatically and adapt to the nature of the respective operating system process.We prototypically implemented smart anomaly classification through a set of competency questions applied to graph template deviations and evaluated the approach using both Random Forest and linear kernel support vector machines. The determined attack classes are ultimately mapped to a dedicated APT attacker/defender meta model that considers actions, actors, as well as assets and mitigating controls, thereby enabling decision support and contextual interpretation of ongoing attacks.