Anomaly Detection Framework Research Articles

Wavelet-Based Computational Intelligence for Real-Time Anomaly Detection and Fault Isolation in Embedded Systems

In today’s technologically advanced landscape, sensors feed critical data for accurate decision-making and actions. Ensuring the integrity and reliability of sensor data is paramount to system performance and security. This paper introduces an innovative approach utilizing discrete wavelet transforms (DWT) embedded within microcontrollers to scrutinize sensor data meticulously. Our methodology aims to detect and isolate malfunctions, misuse, or any anomalies before they permeate the system, potentially causing widespread disruption. By leveraging the power of wavelet-based analysis, we embed computational intelligence directly into the microcontrollers, enabling them to monitor and validate their outputs in real-time. This proactive anomaly detection framework is designed to distinguish between normal and aberrant sensor behaviors, thereby safeguarding the system from erroneous data propagation. Our approach significantly enhances the reliability of embedded systems, providing a robust defense against false data injection attacks and contributing to overall cybersecurity.

Consistency-constrained unsupervised video anomaly detection framework based on Co-teaching

Intelligent video surveillance continues to be a vibrant research domain within the field of computer vision. However, existing representation learning frameworks primarily focus on static information extraction frame by frame such as appearance features, they often overlook the valuable dynamic information like optical flow feature inherent in the video data, which is most essential characteristics of sequence data. To mining dynamic features and bridge this gap, our paper introduces a novel anomaly detection framework that balance dynamic information with static information and construct a relationship between appearance features and corresponding optical flow features, where we sets strong consistency constraints, which reduce the loss between dynamic information and corresponding static information, and we leverages collaborative teaching network to ensure a consistent representation of both static and dynamic information for predict. The proposed framework consists of two sets of encoder–decoder pairs complemented by a memory storage module. Operating in parallel with the dual encoder network is a Co-teaching network, with the shared memory module serving as the cornerstone for collaborative training. The Consistency constrained condition guarantees the strong consistency of dynamic and static information in the learned representations. In our experimental phase, we present compelling results that showcase the superior performance of our algorithm across three publicly available datasets.

An explainable unsupervised anomaly detection framework for Industrial Internet of Things

Industrial Internet of Things (IIoT) systems require effective anomaly detection techniques to ensure optimal operational efficiency. However, constructing a suitable anomaly detection framework for IIoT poses challenges due to the scarcity of labeled data. Additionally, most existing anomaly detection frameworks lack interpretability. To tackle these issues, an innovative unsupervised framework based on time series data analysis is proposed. This framework initially detects anomalous patterns in IIoT sensor data by extracting local features. An improved Time Convolutional Network (TCN) and Kolmogorov–Arnold Network (KAN) based Variational Auto-Encoder (VAE) is then constructed to capture long-term dependencies. The framework is trained in an unsupervised manner and interpreted using Explainable Artificial Intelligence (XAI) techniques. This approach offers insightful explanations regarding the importance of features, thereby facilitating informed decision-making and enhancements. Experimental results demonstrate that the framework is capable of extracting informative features and capturing long-term dependencies. This enables efficient anomaly detection in complex, dynamic industrial systems, surpassing other unsupervised methods.

FIAD: Graph anomaly detection framework based feature injection

Anomaly detection on attributed networks is widely used in the real world, such as in spam, and fraud detection. Due to the scarcity of anomaly data in the real world, anomaly detection methods typically use unsupervised techniques to detect anomalies. In recent years, methods based on graph neural networks and autoencoders have performed significantly better than previous methods with injected anomalies. But the current node-based injection methods increase the abnormality of some nodes, which is not conducive to learning more fine-grained anomalous knowledge, appealing to build a more general-purpose anomaly detector. In this paper, we propose a dimension-based method which injects anomalies into feature information by dimension: Feature-Injected Anomaly Detection framework (FIAD). A unique loss function and algorithmic process are developed that significantly enhance the performance by injecting features. Experimental evaluations on seven datasets, comprising four benchmark and three real-world datasets, demonstrate that our proposed method outperforms previous approaches, achieving state-of-the-art results.

Multifaceted anomaly detection framework for leachate monitoring in landfills

The imperative to preserve environmental resources has transcended traditional conservation efforts, becoming a crucial element for sustaining life. Our deep interconnectedness with the natural environment, which directly impacts our well-being, emphasizes this urgency. Contaminants such as leachate from landfills are increasingly threatening groundwater, a vital resource that provides drinking water for nearly half of the global population. This critical environmental threat requires advanced detection and monitoring solutions to effectively safeguard our groundwater resources. To address this pressing need, we introduce the Multifaceted Anomaly Detection Framework (MADF), which integrates Electrical Resistivity Tomography (ERT) with advanced machine learning models—Isolation Forest (IF), One-Class Support Vector Machines (OC-SVM), and Local Outlier Factor (LOF). MADF processes and analyzes ERT data, employing these hybrid machine learning models to identify and quantify anomaly signals accurately via the majority vote strategy. Applied to the Chaling landfill site in Zhuzhou, China, MADF demonstrated significant improvements in detection capability. The framework enhanced the precision of anomaly detection, evidenced by higher Youden Index values (≈ 6.216%), with a 30% increase in sensitivity and a 25% reduction in false positives compared to traditional ERT inversion methods. Indeed, these enhancements are crucial for effective environmental monitoring, where the cost of missing a leak could be catastrophic, and for reducing unnecessary interventions that can be resource-intensive. These results underscore MADF's potential as a robust tool for proactive environmental management, offering a scalable and adaptable solution for comprehensive landfill monitoring and pollution prevention across varied environmental settings.

Skip-patching spatial–temporal discrepancy-based anomaly detection on multivariate time series

Anomaly detection in the Industrial Internet of Things (IIoT) is a challenging task that relies heavily on the efficient learning of multivariate time series representations. We introduce Skip-patching and Spatial–Temporal discrepancy mechanisms to improve the efficiency of detecting anomalies. Traditional feature extraction is hindered by redundant information in limited datasets. The situation is that feature generation from stable operational processes results in low-quality representations. To address this challenge, we propose the Skip-Patching mechanism. This approach involves selectively extracting features from partial data patches, prompting the model to learn more meaningful knowledge through self-supervised learning. It also effectively doubles the training sample size by creating independent sub-groups of patches. Despite the complex spatial and temporal relationships in IIoT systems, existing methods mainly extracted features from a single domain, either temporal or spatial (sensor-wise), or simply cascaded two features, i.e., one after one, which limited anomaly detection capabilities. To address this, we introduce the Spatial–Temporal Association Discrepancy component, which leverages discrepancies between spatial and temporal features to enhance latent representation learning. Our Skip-Patching Spatial–Temporal Anomaly Detection (SSAD) framework combines these two components to provide a more diverse and comprehensive learning process. Tested across four multivariate time series anomaly detection benchmarks, SSAD demonstrates superior performance, confirming the efficacy of combining Skip-patching and Spatial–Temporal features to enhance anomaly detection in IIoT systems.

An Intelligent Model of Anomaly Detection and Anomaly Localization in Images Using Hybrid Heuristic Adaptive Multiscale Attention-Based DenseNet and Cascaded Variational Autoencoder

Anomaly detection and localization become necessary since humans are unable to spot visual frauds. Since it differs from the normal representation of shapes, colors, textures, size, and location, it does not have the potential to be employed in such practical applications. Hence, the automatic anomaly detection and localization framework is suggested for supporting situations like industrial systems, healthcare systems and so on. The detection and localization are the most intriguing and challenging concerns in image processing. In general, anomalies can manifest themselves in diverse ways. Detection is the process of providing information about whether an image contains modifications or not. On the other hand, localization is defined as locating the anomalies in images. Several traditional models have been deployed, but they still lack such constraints to evade performance enhancement. To sort out this issue, a novel adaptive method is recommended for anomaly detection and localization in images. Initially, the source images are acquired from standard public data sources. Once the required images are collected, such abnormal or anomalous activities are detected by adopting the new method known as Adaptive Multiscale Attention-based DenseNet (AMA-DeNet), where the hyperparameters are tuned by a hybrid algorithm known as the Hybrid Chimp Grasshopper Optimization Algorithm (HCGOA). Subsequently, the final stage is localizing the anomalies in the detected images. This is to be accomplished by using the Cascaded Variational Autoencoder (CVA), in which parameters are optimally chosen by HCGOA. After implementation, the experimental results are computed across diverse validating measures. Hence, the extensive results elucidate that the recommended model contains the potential to detect the abnormalities in the images accurately, thereby enhancing the efficiency of the new system.

Anomaly detection in the veterinary antibiotic prescription surveillance system (IS ABV)

Antibiotic resistance is one of the major concerns in veterinary and human medicine and poses a considerable threat to both human and animal health. It has been shown that over- or misuse of antibiotics is one of the primary drivers of antibiotic resistance. To develop the surveillance of antibiotic use, Switzerland introduced the "Informationssystem Antibiotika in der Veterinärmedizin" (IS ABV) in 2019, mandating electronic registration of antibiotic prescriptions by all veterinarians in Switzerland. However, initial data analysis revealed a considerable amount of implausible data entries, potentially compromising data quality and reliability. These anomalies may be caused by input errors, inaccuracies, incorrect or aberrant master data or data transmission and make analysis impossible. To address this issue efficiently, we propose a two-stage anomaly detection framework utilizing machine learning algorithms. In this study, our primary focus was on cattle treatments with either single or group therapy, as they were the species with the highest prescription volume. However, not all outliers are necessarily incorrect; some may be legitimate but unusual antibiotic treatments. Thus, expert review plays a crucial role in distinguishing outliers, that are correct from actual errors. Initially, relevant prescription variables were extracted and pre-processed with a custom-built scaler. A set of unsupervised algorithms calculated the probability of each data point and identified the most likely outliers. In collaboration with experts, we annotated anomalies and established anomaly thresholds for each production type and active substance. These expert-annotated labels were then used to fine-tune the final supervised classification algorithms. With this methodology, we identified 22,816 anomalies from a total of 1,994,170 prescriptions in cattle (1.1 %). Cattle with no further specified production type had the most (2 %) anomalies with 7758 out of 379,995. The anomalies were consistently identified and comprised prescriptions with too high and too low dosages. Random Forest achieved a ROC-AUC score of 0.994, (95 % CI: 0.992, 0.995) and a F1-Score of 0.962 (95 % CI: 0.958, 0.966) for single treatments. The versatility of this framework allows its adaptation to other species within IS ABV and potentially to other prescription-based surveillance systems. If applied regularly to uploaded prescriptions, it should reduce input errors over time, improving the validity of the data in the long term.

U-TFF: A U-Net-Based Anomaly Detection Framework for Robotic Manipulator Energy Consumption Auditing Using Fast Fourier Transform

Robotic manipulators play a key role in modern industrial manufacturing processes. Monitoring their operational health is of paramount importance. In this paper, a novel anomaly detection framework named U-TFF is introduced for energy consumption auditing of robotic manipulators. It comprises a cascade of Time–Frequency Fusion (TFF) blocks to extract both time and frequency domain features from time series data. The block applies the Fast Fourier Transform to convert the input to the frequency domain, followed by two separate dense layers to process the resulting real and imaginary components, respectively. The frequency and time features are then combined to reconstruct the input. A U-shaped architecture is implemented to link corresponding TFF blocks of the encoder and decoder at the same level through skip connections. The semi-supervised model is trained using data exclusively from normal operations. Significant errors were generated during testing for anomalies with data distributions deviating from the training samples. Consequently, a threshold based on the magnitude of reconstruction errors was implemented to identify anomalies. Experimental validation was conducted using a custom dataset, including physical attacks as abnormal cases. The proposed framework achieved an accuracy and recall of approximately 0.93 and 0.83, respectively. A comparison with other benchmark models further verified its superior performance.

A novel multi-modal incremental tensor decomposition for anomaly detection in large-scale networks

Network traffic anomaly detection is a crucial task for today's network monitoring and maintenance. However, with the rapid growth of network data volume, the data structure has become more and more complex, showing multi-modal characteristics, which makes traffic anomaly detection face a great challenge. The earlier proposed anomaly detection methods have the following deficiencies, i) Most of them are static or dynamic detection methods that only grow along the temporal modality. ii) Lower detection rate or higher computational cost. To address these deficiencies, this article proposes a traffic anomaly detection framework based on multi-modal incremental tensor decomposition, which has the following three highlights, i) Constructing traffic data as a tensor model to fully mine the correlation between data, and the proposed framework is applicable to the situation where traffic data grows dynamically along multiple modes. ii) Using the multi-modal incremental tensor decomposition method to process dynamically growing data without decomposing all the data, greatly reducing computational cost and improving data quality. iii) Using the XGBoost classification algorithm for anomaly detection to improve detection accuracy. Finally, the results of experiments on two real network traffic datasets NSL-KDD and CICDDOS 2019 show that the proposed framework can achieve a high detection rate of 99.21%, and has the characteristics of good scalability and fast detection speed.

Digital twin-based anomaly detection for real-time tool condition monitoring in machining

Real-time tool condition monitoring (TCM) has been emerging as a key technology for smart manufacturing. TCM can improve the dimensional accuracy of products, minimize machine tool downtime, and eliminate scraps and re-work costs. Digital twins offer new opportunities for real-time monitoring of machining processes, which can, in principle, take into account changes in machining processes and operating environments, help understand mechanisms of cutting tool wear, and improve the anomaly detection accuracy and fault diagnosis results. The present study exploits these potential advantages of digital twins and proposes a new digital twin-based anomaly detection framework for real-time TCM in machining. The framework of the digital twin consists of three parts: the physical product, the virtual product and data flow connections. Within this framework of the digital twin, the “physical product” represents the machining processes. The “virtual product” includes a real-time data-driven model representing the dynamic relationship between vibration data measured from machining processes as well as the model frequency features (MFFs)-based diagnostics for cutting tool anomaly detection. The “data flow connections” involve real-time measured vibration data and machine tool numerical controller (NC) signals providing real-time information on machine tool dynamics and various machining processes. The novelty is associated with an innovative integration of real-time data-driven modeling, MFFs extraction, and MFFs and machine tool NC signal-based tool wear diagnostics. This, for the first time, enables the concept of digital twins to be potentially applied to the TCM for complicated dynamic machining processes which, as far as we are aware of, has never been achieved before. Comprehensive field studies have demonstrated the effectiveness of the proposed digital twin-based TCM framework and its potential industrial applications.

Time series anomaly detection using generative adversarial network discriminators and density estimation for infrastructure systems

Efficient data-driven defect detection techniques are crucial for maintaining service quality and providing early warnings for infrastructure systems. To this end, we proposed an effective unsupervised anomaly detection framework (DEGAN) using Generative Adversarial Networks (GANs). The framework relies solely on normal time series data as input to train well-configured discriminators into standalone anomaly predictors by leveraging repeatedly collected data from an infrastructure system. Expected normal patterns in data are identified by generators, and well-configured discriminators are extracted to evaluate anomalies in unseen time series. Kernel density estimation (KDE) is coupled with discriminators for probabilistic anomaly detection. Through a Class I railroad track case study, we evaluated the performance of a convolutional DEGAN in detecting anomalies identified by operators, achieving recall and precision of 80% and 86%, respectively. We also investigated the influence of GAN architectures and parameters, model validation scheme (supervised vs. unsupervised), clustering, and the KDE parameters.

An unsupervised anomaly detection framework for smart assisted living via growing neural gas networks

An unsupervised anomaly detection framework for smart assisted living via growing neural gas networks

Self-supervised learning for classifying paranasal anomalies in the maxillary sinus

PurposeParanasal anomalies, frequently identified in routine radiological screenings, exhibit diverse morphological characteristics. Due to the diversity of anomalies, supervised learning methods require large labelled dataset exhibiting diverse anomaly morphology. Self-supervised learning (SSL) can be used to learn representations from unlabelled data. However, there are no SSL methods designed for the downstream task of classifying paranasal anomalies in the maxillary sinus (MS).MethodsOur approach uses a 3D convolutional autoencoder (CAE) trained in an unsupervised anomaly detection (UAD) framework. Initially, we train the 3D CAE to reduce reconstruction errors when reconstructing normal maxillary sinus (MS) image. Then, this CAE is applied to an unlabelled dataset to generate coarse anomaly locations by creating residual MS images. Following this, a 3D convolutional neural network (CNN) reconstructs these residual images, which forms our SSL task. Lastly, we fine-tune the encoder part of the 3D CNN on a labelled dataset of normal and anomalous MS images.ResultsThe proposed SSL technique exhibits superior performance compared to existing generic self-supervised methods, especially in scenarios with limited annotated data. When trained on just 10% of the annotated dataset, our method achieves an area under the precision-recall curve (AUPRC) of 0.79 for the downstream classification task. This performance surpasses other methods, with BYOL attaining an AUPRC of 0.75, SimSiam at 0.74, SimCLR at 0.73 and masked autoencoding using SparK at 0.75.ConclusionA self-supervised learning approach that inherently focuses on localizing paranasal anomalies proves to be advantageous, particularly when the subsequent task involves differentiating normal from anomalous maxillary sinuses. Access our code at https://github.com/mtec-tuhh/self-supervised-paranasal-anomaly.

Deep Anomaly Detection Framework Utilizing Federated Learning for Electricity Theft Zero-Day Cyberattacks.

Smart power grids suffer from electricity theft cyber-attacks, where malicious consumers compromise their smart meters (SMs) to downscale the reported electricity consumption readings. This problem costs electric utility companies worldwide considerable financial burdens and threatens power grid stability. Therefore, several machine learning (ML)-based solutions have been proposed to detect electricity theft; however, they have limitations. First, most existing works employ supervised learning that requires the availability of labeled datasets of benign and malicious electricity usage samples. Unfortunately, this approach is not practical due to the scarcity of real malicious electricity usage samples. Moreover, training a supervised detector on specific cyberattack scenarios results in a robust detector against those attacks, but it might fail to detect new attack scenarios. Second, although a few works investigated anomaly detectors for electricity theft, none of the existing works addressed consumers' privacy. To address these limitations, in this paper, we propose a comprehensive federated learning (FL)-based deep anomaly detection framework tailored for practical, reliable, and privacy-preserving energy theft detection. In our proposed framework, consumers train local deep autoencoder-based detectors on their private electricity usage data and only share their trained detectors' parameters with an EUC aggregation server to iteratively build a global anomaly detector. Our extensive experimental results not only demonstrate the superior performance of our anomaly detector compared to the supervised detectors but also the capability of our proposed FL-based anomaly detector to accurately detect zero-day attacks of electricity theft while preserving consumers' privacy.

GAMA: A multi-graph-based anomaly detection framework for business processes via graph neural networks

Anomalies in business processes are inevitable for various reasons such as system failures and operator errors. Detecting anomalies is important for the management and optimization of business processes. However, prevailing anomaly detection approaches often fail to capture crucial structural information about the underlying process. To address this, we propose a multi-Graph based Anomaly detection fraMework for business processes via grAph neural networks, named GAMA. GAMA makes use of structural process information and attribute information in a more integrated way. In GAMA, multiple graphs are applied to model a trace in which each attribute is modeled as a separate graph. In particular, the graph constructed for the special attribute activity reflects the control flow. Then GAMA employs a multi-graph encoder and a multi-sequence decoder on multiple graphs to detect anomalies in terms of the reconstruction errors. Moreover, three teacher forcing styles are designed to enhance GAMA’s ability to reconstruct normal behaviors and thus improve detection performance. We conduct extensive experiments on both synthetic logs and real-life logs. The experiment results demonstrate that GAMA outperforms state-of-the-art methods for both trace-level and attribute-level anomaly detection.

Anomaly Detection in Blockchain Using Machine Learning

Blockchain technology has gained significant attention as a secure and decentralized platform for various applications. However, the immutable and distributed nature of blockchain also presents unique challenges for detecting anomalies and suspicious activities within the network. This research paper proposes a novel approach to anomaly detection in blockchain using machine learning techniques. The goal of this study is to develop an effective and scalable anomaly detection framework that can analyze the vast amount of data generated within a blockchain network and identify irregularities or potential security threats. The proposed framework leverages the power of machine learning algorithms to learn patterns, relationships, and behaviours from historical blockchain data, enabling the detection of anomalous activities in real time.The research paper first focuses on feature extraction techniques tailored specifically for blockchain data. These techniques consider key characteristics of blockchain transactions, such as transaction size, timestamp, and involved addresses, to construct meaningful features that capture the underlying patterns and trends. Various dimensionality reduction techniques are also explored to handle the high-dimensional nature of blockchain data.Subsequently, several machine learning algorithms, including clustering, classification, and anomaly detection methods, are employed to train models using the extracted features. The performance of different algorithms is evaluated using benchmark datasets and real-world blockchain data to assess their accuracy, precision, and recall in detecting anomalies. Additionally, the scalability of the proposed framework is investigated to ensure its effectiveness in large-scale blockchain networks.Furthermore, the research paper investigates the integration of domain-specific knowledge, such as known attack patterns and regulatory compliance rules, into the anomaly detection framework. This hybrid approach combines the strengths of machine learning algorithms with expert knowledge to enhance the accuracy and interpretability of anomaly detection results.The experimental results demonstrate that the proposed anomaly detection framework achieves promising performance in identifying various types of anomalies in blockchain data. It exhibits high detection rates while minimizing false positives, thereby providing valuable insights for blockchain network administrators and regulators to mitigate security risks and safeguard the integrity of blockchain systems. In conclusion, this research paper presents an innovative approach to anomaly detection in blockchain using machine learning. The proposed framework addresses the unique challenges posed by blockchain's decentralized and immutable nature, offering an effective solution for detecting suspicious activities and ensuring the security of blockchain networks. The findings of this study contribute to the growing field of blockchain analytics and have significant implications for real-world blockchain applications in domains such as finance, supply chain management, and healthcare.

HFN: Heterogeneous feature network for multivariate time series anomaly detection

As the key step of anomaly detection for multivariate time-series (MTS) data, learning the relations among different variables has been explored by many approaches. However, most existing approaches overlook the heterogeneity among variables, that is, different types of variables (continuous numerical variables, discrete categorical variables or hybrid variables) may have different edge distributions. In this paper, we propose a novel semi-supervised anomaly detection framework based on a heterogeneous feature network (HFN) for MTS. Specifically, we first combine the embedding similarity subgraph generated by sensor embedding and the feature value similarity subgraph generated by sensor values to construct a time-series heterogeneous graph, which fully utilizes the rich heterogeneous mutual information among variables. Then, a prediction model containing nodes and channel attentions is jointly optimized to obtain better time-series representations. This approach fuses the state-of-the-art technologies of heterogeneous graph structure learning (HGSL) and representation learning. Experimental results on four sensor datasets from real-world applications demonstrate that our approach achieves more accurate anomaly detection compared to baseline methods, laying a foundation for the rapid positioning of anomalies.

Digital twin-assisted intelligent anomaly detection system for Internet of Things

The proliferation of Internet of Things (IoT) devices within the cyber–physical infrastructure has raised privacy and security concerns. This is because processing large amounts of data and extracting anomalous data cannot be imprecisely identified with the limited storage and processing capabilities of IoT devices. Against this backdrop, edge computing is a networking paradigm to reshape the next generation of IoT-based applications, which brings computation and data storage closer to the data sources. However, since edge servers are difficult to obtain security protections like in centralized data centers, this makes them more vulnerable to security attacks. To address this issue, we propose a novel digital twin system architecture in edge computing-based Internet of Things (IoT) networks, which allows efficient data processing for anomaly detection at the network edge. Digital twin is a replica of the real world in a virtual environment with continuous information exchange. Our digital twin-assisted solution gives a data-driven strategy against the cell outage and simulates the behavior and patterns of the physical assets in the digital world. Powered by data processing capabilities at the network edge, the proposed digital twin-assisted model can help extract features and behaviors, reduce noise from data generated in the network physical model, and filter out redundant data for a better characterization of the network physical model in the anomaly detection service. To this extent, the contributions in this paper are threefold: We first propose a novel digital twin-assisted anomaly detection framework that processes high-dimensional data efficiently and improves the system performance despite the imbalanced classes. Second, we define an autoencoder-based threshold algorithm and evaluate the eXtreme Gradient Boosting (XGBoost) classifier to implement self-learning capability into the digital twin for an accurate prediction. Third, we extract the features, dependencies, and relationships to apply the learned model to the new and unseen dataset for real-time monitoring and optimization and evaluate the performance of the proposed model with both real-time and historical data. Finally, we analyze the performance of different classifiers to validate our model. We use four different datasets and demonstrate that our solution outperforms the state-of-the-art techniques in terms of accuracy performance, AUC score, and ROC curve.

A Diffusion-Based Framework for Multi-Class Anomaly Detection

Reconstruction-based approaches have achieved remarkable outcomes in anomaly detection. The exceptional image reconstruction capabilities of recently popular diffusion models have sparked research efforts to utilize them for enhanced reconstruction of anomalous images. Nonetheless, these methods might face challenges related to the preservation of image categories and pixel-wise structural integrity in the more practical multi-class setting. To solve the above problems, we propose a Difusion-based Anomaly Detection (DiAD) framework for multi-class anomaly detection, which consists of a pixel-space autoencoder, a latent-space Semantic-Guided (SG) network with a connection to the stable diffusion’s denoising network, and a feature-space pre-trained feature extractor. Firstly, The SG network is proposed for reconstructing anomalous regions while preserving the original image’s semantic information. Secondly, we introduce Spatial-aware Feature Fusion (SFF) block to maximize reconstruction accuracy when dealing with extensively reconstructed areas. Thirdly, the input and reconstructed images are processed by a pre-trained feature extractor to generate anomaly maps based on features extracted at different scales. Experiments on MVTec-AD and VisA datasets demonstrate the effectiveness of our approach which surpasses the state-of-the-art methods, e.g., achieving 96.8/52.6 and 97.2/99.0 (AUROC/AP) for localization and detection respectively on multi-class MVTec-AD dataset. Code will be available at https://lewandofskee.github.io/projects/diad.