Anomaly Detection Framework Research Articles

IDECODe: In-Distribution Equivariance for Conformal Out-of-Distribution Detection

Machine learning methods such as deep neural networks (DNNs), despite their success across different domains, are known to often generate incorrect predictions with high confidence on inputs outside their training distribution. The deployment of DNNs in safety-critical domains requires detection of out-of-distribution (OOD) data so that DNNs can abstain from making predictions on those. A number of methods have been recently developed for OOD detection, but there is still room for improvement. We propose the new method iDECODe, leveraging in-distribution equivariance for conformal OOD detection. It relies on a novel base non-conformity measure and a new aggregation method, used in the inductive conformal anomaly detection framework, thereby guaranteeing a bounded false detection rate. We demonstrate the efficacy of iDECODe by experiments on image and audio datasets, obtaining state-of-the-art results. We also show that iDECODe can detect adversarial examples. Code, pre-trained models, and data are available at https://github.com/ramneetk/iDECODe.

Explainable anomaly detection framework for predictive maintenance in manufacturing systems

To conduct preemptive essential maintenance, predictive maintenance detects the risk of unexpected shutdowns in a manufacturing system, thereby ensuring operational continuity. Traditional methods that heavily rely on the domain knowledge of expert engineers to detect any abnormal status in processing facilities are extremely time-consuming and domain-dependent. Conversely, recently studied data-driven approaches without much domain knowledge have yielded fairly good performance. However, most only identify whether the current status is normal or abnormal and do not offer any explanations or analyses. In this paper, we propose a real-time explainable anomaly detection framework for predictive maintenance in a manufacturing system. Various well-known anomaly detection algorithms are investigated to construct a framework suitable for shutdown prognosis. In addition, model interpretation techniques are also employed to provide a reasonable explanation for a detected shutdown. The experimental results on a real-world dataset derived from a chemical process show that the proposed framework could identify abnormal signs early and derive significant causes for each detected shutdown.

Data Visualization of Anomaly Detection in Semiconductor Processing Tools

Semiconductor manufacturing plays a crucial role in the world’s economic growth and technology development and is the backbone of the high value-added electronic device manufacturing industry. In this paper, a new anomaly detection framework by means of data visualization is proposed for semiconductor manufacturing. Firstly, t-Distributed Stochastic Neighbor Embedding (t-SNE) in unsupervised learning is used to transform the high-dimensional raw trace data, corresponding to normal wafers, into a two-dimensional map, with the purpose of visually observing the distribution of normal wafers. The t-SNE algorithm cannot be used at run time for a new test sample since it requires the whole dataset for the embedding transformation, and is computationally very expensive. The Multilayer Perceptron (MLP) neural network is then applied as a regressor for the real-time t-SNE embedding of a new test data. The envelope of t-SNE score estimates for a set of normal wafers is circumscribed and used as the 2D control boundary based on the Delaunay Triangulation (D.T.). A new test sample with its MLP estimated embedding points outside the D.T boundary is identified as defective. Lastly, a real-world dataset in semiconductor manufacturing is used to illustrate the proposed data visualization tool for anomaly detection. The experimental results show that a multilayer perceptron in combination with t-SNE and Delaunay Triangulation performs very well for data visualization and automated detection of anomalies.

Video anomaly detection using CycleGan based on skeleton features

Anomaly detection is a challenging task in the field of intelligent video surveillance. It aims to identify anomalous events by monitoring the video captured by visual sensors. The main difficulty of this task is that the definition of anomalies is ambiguous. In recent years, most anomaly detection methods use a two-stage learning strategy, i.e., feature extraction and model building. In this paper, with the idea of refactoring, we propose an end-to-end anomaly detection framework using cyclic consistent adversarial networks (CycleGAN). Dynamic skeleton features are used as network constraints to alleviate the inaccuracy of feature extraction algorithms of a single generative adversarial network. In the training phase, only normal video frames and the corresponding skeleton features are used to train the generator and discriminator. In the testing phase, anomalous behaviors with high reconstruction errors can be filtered out by manually set thresholds. To the best of our knowledge, this is the first time CycleGAN has been used for video anomaly detection. Experimental results on challenging datasets show that our method can accurately detect anomalous behaviors in videos collected by video surveillance systems and is comparable to the current state-of-the-art methods.

A conformal anomaly detection based industrial fleet monitoring framework: A case study in district heating

The monitoring infrastructure of an industrial fleet can rely on the so-called unit-level and subfleet-level models to observe the behavior of a target unit. However, such infrastructure has to confront several challenges. First, from an anomaly detection perspective of monitoring a target unit, unit-level and subfleet-level models can give different information about the nature of an anomaly, and which approach or level model is appropriate is not always clear. Second, in the absence of well-understood prior models of unit and subfleet behavior, the choice of a base model at their respective levels, especially in an online/streaming setting, may not be clear. Third, managing false alarms is a major problem. To deal with these challenges, we proposed to rely on the conformal anomaly detection framework. In addition, an ensemble approach was deployed to mitigate the knowledge gap in understanding the underlying data-generating process at the unit and subfleet levels. Therefore, to monitor the behavior of a target unit, a unit-level ensemble model (ULEM) and a subfleet-level ensemble model (SLEM) were constructed, where each member of the respective ensemble is based on a conformal anomaly detector (CAD). However, since the information obtained by these two ensemble models through their p-values may not always agree, a combined ensemble model (CEM) was proposed. The results are based on real-world operational data obtained from district heating (DH) substations. Here, it was observed that CEM reduces the overall false alarms compared to ULEM or SLEM, albeit at the cost of some detection delay. The analysis demonstrated the advantages and limitations of ULEM, SLEM, and CEM. Furthermore, discords obtained from the state-of-the-art matrix-profile (MP) method and the combined calibration scores obtained from ULEM and SLEM were compared in an offline setting. Here, it was observed that SLEM achieved a better overall precision and detection delay. Finally, the different components related to ULEM, SLEM, and CEM were put together into what we refer to as TRANTOR: a conformal anomaly detection based industrial fleet monitoring framework. The proposed framework is expected to enable fleet operators in various domains to improve their monitoring infrastructure by efficiently detecting anomalous behavior and controlling false alarms at the target units.

Combined Anomaly Detection Framework for Digital Twins of Water Treatment Facilities

Digital twins of cyber-physical systems with automated process control systems using programmable logic controllers (PLCs) are increasingly popular nowadays. At the same time, cyber-physical security is also a growing concern with system connectivity. This study develops a combined anomaly detection framework (CADF) against various types of security attacks on the digital twin of process control in water treatment facilities. CADF utilizes the PLC-based whitelist system to detect anomalies that target the actuators and the deep learning approach of natural gradient boosting (NGBoost) and probabilistic assessment to detect anomalies that target the sensors. The effectiveness of CADF is verified using a physical facility for water treatment with membrane processes called the Secure Water Treatment (SWaT) system in the Singapore University of Technology and Design. Various attack scenarios are tested in SWaT by falsifying the reported values of sensors and actuators in the digital twin process. These scenarios include both trivial attacks, which are commonly studied, as well as non-trivial (i.e., sophisticated) attacks, which are rarely reported. The results show that CADF performs very well with good detection accuracy in all scenarios, and particularly, it is able to detect all sophisticated attacks while ongoing before they can induce damage to the water treatment facility. CADF can be further extended to other cyber-physical systems in the future.

A multi-scale anomaly detection framework for retinal OCT images based on the Bayesian neural network

As a non-contact imaging technology, optical coherence tomography (OCT) is widely used in retinal disease detection. There is a growing interest among researchers for automated detection of retinal diseases using OCT images. With the development of deep learning, convolutional neural network (CNN) enables accurate detection of common retinal diseases. However, large-scale labeled data is necessary for these deep learning methods. It limits the application of these methods in retinal disease detection, especially for diseases with low occurrence. Therefore, we propose an automated anomaly detection method for unspecific retinal disease, and only healthy OCT images are needed for training. The method uses epistemic uncertainty as the criterion of anomaly detection. Our method assumes that the lesion correlates with a high epistemic uncertainty region. We propose a Bayesian neural network (BNN) model, Multi-scale Bayesian U-Net (MBU-Net), to obtain epistemic uncertainty of OCT images. We then design an algorithm to reduce the uncertainty generated by healthy tissue regions. Finally, a threshold-based function is designed to distinguish whether the input data is healthy or not. We evaluate our approach on a public dataset, UCSD dataset, and a private dataset collected by ourselves, named BFHJLU dataset. The experimental results show that the proposed method can achieve 94.9% accuracy, 97.9% sensitivity, and 86.0% specificity on the UCSD dataset. On the BFHJLU dataset, the accuracy, sensitivity, and specificity are 92.1%, 97.3%, and 87.7%. The proposed method outperforms existing anomaly detection methods.

Impact of the COVID‐19 Economic Downturn on Tropospheric Ozone Trends: An Uncertainty Weighted Data Synthesis for Quantifying Regional Anomalies Above Western North America and Europe

This study quantifies the association between the COVID‐19 economic downturn and 2020 tropospheric ozone anomalies above Europe and western North America, and their impact on long‐term trends. Anomaly detection for an atmospheric time series is usually carried out by identifying potentially aberrant data points relative to climatological values. However, detecting ozone anomalies from sparsely sampled ozonesonde profiles (once per week at most sites) is challenging due to ozone's high temporal variability. We first demonstrate the challenges for summarizing regional trends based on independent time series from multiple nearby ozone profiling stations. We then propose a novel regional‐scale anomaly detection framework based on generalized additive mixed models, which accounts for the sampling frequency and inherent data uncertainty associated with each vertical profile data set, measured by ozonesondes, lidar or commercial aircraft. This method produces a long‐term monthly time series with high vertical resolution that reports ozone anomalies from the surface to the middle‐stratosphere under a unified framework, which can be used to quantify the regional‐scale ozone anomalies during the COVID‐19 economic downturn. By incorporating extensive commercial aircraft data and frequently sampled ozonesonde profiles above Europe, we show that the complex interannual variability of ozone can be adequately captured by our modeling approach. The results show that free tropospheric ozone negative anomalies in 2020 are the most profound since the benchmark year of 1994 for both Europe and western North America, and positive trends over 1994–2019 are diminished in both regions by the 2020 anomalies.

A Deep Learning Anomaly Detection Framework for Satellite Telemetry with Fake Anomalies

Reducing satellite failures and keeping satellites healthy in orbit are important issues. Current satellite systems have developed modules to detect anomalies on board. However, they only target a subset of anomaly types and heavily rely on expert knowledge. To address these limitations, this paper proposes a data-driven anomaly detection framework to detect point anomalies. We first propose the Deviation Divide Mean over Neighbors (DDMN) method to figure out the fake anomaly problem caused by data errors in the satellite telemetry data. Then, we use the Long Short-Term Memory (LSTM), a deep learning method, to model the multivariable time-series data, and a Gaussian model to detect anomalies. We applied our approach to the telemetry data collected from sensors on an in-orbit satellite for more than two years and demonstrate its superiority. Moreover, we explored what conditions could lead to false alarms. The approach proposed has been deployed to the ground station to monitor the health status of the in-orbit satellites.

SMD Anomaly Detection: A Self-Supervised Texture–Structure Anomaly Detection Framework

In electronic manufacturing, anomaly detection of surface mount devices (SMDs) through computer vision is an important task to control the production quality of SMDs. The difficulty of the detection is that some anomalous regions on the surfaces of SMDs are very minor and with variable shapes, which leads to poor detection efficiency. To solve this problem, based on the assumption that normal samples can be reconstructed more accurately than anomalous samples, a self-supervised image anomaly detection framework with a multi-scale two-branch feature fusion strategy is proposed. Specifically, it adopts autoencoder as the basic framework, and to enhance the reconstruction error between input anomalous samples and the reconstructed ones, a self-supervised learning task of reconstructing images is introduced to have the model neglect the encoding of the suspected anomalous regions found by a contextual attention mask module. Meanwhile, a multi-scale feature fusion strategy is developed to fuse texture and structure features in the decoder to reconstruct samples. Moreover, a multi-level anomalous score criterion is proposed to enlarge the scores for the samples with very minor anomalies. At last, an SMD-Capacitor anomaly detection dataset (SMDC-DET) is built to evaluate the proposed method. The experiments show that the proposed method achieves an average AUC accuracy of 98.82%, much better when compared to the start-of-art existing anomaly detection methods.

An Adaptive Framework for Anomaly Detection in Time-Series Audio-Visual Data

Anomaly detection is an integral part of a number of surveillance applications. However, most of the existing anomaly detection models are statically trained on pre-recorded data from a single source, thus making multiple assumptions about the surrounding environment. As a result, their usefulness is limited to controlled scenarios. In this paper, we fuse information from live streams of audio and video data to detect anomalies in the captured environment. We train a deep learning-based teacher-student network using video, image, and audio information. The pre-trained visual network in the teacher model distills its information to the image and audio networks in the student model. Features from image and audio networks are combined and compressed using principal component analysis. Thus, the teacher-student network produces an image-audio-based light-weight joint representation of the data. The data dynamics are learned in a multivariate adaptive Gaussian mixture model. Empirical results from two audio-visual datasets demonstrate the effectiveness of joint representation over single modalities in the adaptive anomaly detection framework. The proposed framework outperforms the state-of-the-art methods by an average of 15.00 % and 14.52 % in AUC values for dataset 1 and dataset 2, respectively.

Federated Multi-Discriminator BiWGAN-GP Based Collaborative Anomaly Detection for Virtualized Network Slicing

Virtualized network slicing allows a multitude of logical networks to be created on a common substrate infrastructure to support diverse services. A virtualized network slice is a logical combination of multiple virtual network functions, which run on virtual machines (VMs) as software applications by virtualization techniques. As the performance of network slices hinges on the normal running of VMs, detecting and analyzing anomalies in VMs are critical. Based on the three-tier management framework of virtualized network slicing, we first develop a federated learning (FL) based three-tier distributed VM anomaly detection framework, which enables distributed network slice managers to collaboratively train a global VM anomaly detection model while keeping metrics data locally. The high-dimensional, imbalanced, and distributed data features in virtualized network slicing scenarios invalidate the existing anomaly detection models. Considering the powerful ability of generative adversarial network (GAN) in capturing the distribution from complex data, we design a new multi-discriminator Bidirectional Wasserstein GAN with Gradient Penalty (BiWGAN-GP) model to learn the normal data distribution from high-dimensional resource metrics datasets that are spread on multiple VM monitors. The multi-discriminator BiWGAN-GP model can be trained over distributed data sources, which avoids high communication and computation overhead caused by the centralized collection and processing of local data. We define an anomaly score as the discriminant criterion to quantify the deviation of new metrics data from the learned normal distribution to detect abnormal behaviors arising in VMs. The efficiency and effectiveness of the proposed collaborative anomaly detection algorithm are validated through extensive experimental evaluation on a real-world dataset.

Two-Stage Deep Anomaly Detection With Heterogeneous Time Series Data

We introduce a data-driven anomaly detection framework using a manufacturing dataset collected from a factory assembly line. Given <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">heterogeneous</i> time series data consisting of operation cycle signals and sensor signals, we aim at discovering abnormal events. Motivated by our empirical findings that conventional single-stage benchmark approaches may not exhibit satisfactory performance under our challenging circumstances, we propose a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">two-stage</i> deep anomaly detection (T-DAD) framework in which two different unsupervised learning models are adopted depending on types of signals. In Stage I, we select anomaly candidates by using a model trained by operation cycle signals; in Stage II, we finally detect abnormal events out of the candidates by using another model, which is suitable for taking advantage of temporal continuity, trained by sensor signals. A distinguishable feature of our framework is that operation cycle signals are exploited first to find likely anomalous points, whereas sensor signals are leveraged to filter out unlikely anomalous points afterward. Our experiments comprehensively demonstrate the superiority over single-stage benchmark approaches, the model-agnostic property, and the robustness to difficult situations.

Predicting mental disorder from noisy questionnaires: an anomaly detection approach based on keyword extraction and machine learning techniques

The early warning of mental disorders is of great importance for the psychological well-being of college students. The accuracy of conventional scaling methods on questionnaires is generally low in predicting mental disorders, as the questionnaires contain much noise, and the processing on the questionnaires is rudimentary. To address this problem, we propose a novel anomaly detection framework on questionnaires, which represents each questionnaire as a document, and applies keyword extraction and machine learning techniques to detect abnormal questionnaires. We also propose a new keyword statistic for the calculation of option significance and three interpretable machine learning models for the calculation of question significance. Experiments demonstrate the effectiveness of our proposed methods.

An unsupervised anomaly detection framework for detecting anomalies in real time through network system’s log files analysis

Nowadays, in almost every computer system, log files are used to keep records of occurring events. Those log files are then used for analyzing and debugging system failures. Due to this important utility, researchers have worked on finding fast and efficient ways to detect anomalies in a computer system by analyzing its log records. Research in log-based anomaly detection can be divided into two main categories: batch log-based anomaly detection and streaming log- based anomaly detection. Batch log-based anomaly detection is computationally heavy and does not allow us to instantaneously detect anomalies. On the other hand, streaming anomaly detection allows for immediate alert. However, current streaming approaches are mainly supervised. In this work, we propose a fully unsupervised framework which can detect anomalies in real time. We test our framework on hdfs log files and successfully detect anomalies with an F-1 score of 83%.

FedADMP: A Joint Anomaly Detection and Mobility Prediction Framework via Federated Learning

With the proliferation of mobile devices and smart cameras, detecting anomalies and predicting their mobility are critical for enhancing safety in ubiquitous computing systems. Due to data privacy regulations and limited communication bandwidth, it is infeasible to collect, transmit, and store all d

Condition monitoring of wind turbines using machine learning based anomaly detection and statistical techniques for the extraction of 'healthy data'

Premature failures caused by excessive wear are responsible for a large fraction of the maintenance costs of wind turbines. Therefore, it is crucial to be able to identify the propagation of these failures as early as possible. To this end, a novel condition monitoring method is proposed that uses statistical data analysis techniques and machine learning to construct a multivariate anomaly detection framework, based on high-frequency temperature SCADA data from wind turbines. This framework contains several steps. First, there is a preprocessing step in which relevant wind turbine states are extracted from the data. These states are the operating conditions and whether or not the turbine exhibits transient behavior. The second step entails anomaly detection on the temperature time series data. Fleet information is used to filter out exogenous (environmental) factors. Furthermore, multiple models are combined to get more stable and robust anomaly detections. By combining them the weaknesses of the individual models are alleviated resulting in a better overall performance. A limitation of machine learning-based anomaly detection on temperature data is the requirement that at least one year of “healthy” (meaning without anomalies) training data is available to account for seasonal effects. The lack of verified “healthy” data spread out evenly over the seasons generally means that the anomaly detection accuracy is severely compromised for the unrepresented seasons. This research uses smart retraining to reduce this limitation. Statistical techniques that leverage the information of the fleet are used to extract “healthy” data from at least one year, but preferably multiple years, of unverified data. This can then be used as training data for the machine learning-based models. To validate the pipeline, temperature and failure data of a real operational wind farm is used. Although the methodology is general in its scope, the validation case focusses specifically on generator bearing failures.

Deep-learning-based anomaly detection for lace defect inspection employing videos in production line

Defect inspection plays an essential role in ensuring quality of industrial products. The most widely used human visual inspection method has some drawbacks such as high cost and low efficiency, which bring an eager demand for the application of automatic defect inspection algorithm in actual production. However, few industrial production lines use automatic detection devices due to the gap between data collected in the actual production environment and ready-made datasets. Lace is one of the industrial products which completely depends on manual defect inspection. The complex and fine texture of lace makes it difficult to extract regular patterns using the existing image-based defect inspection methods. In this paper, we propose to collect lace videos in the weaving stage and design a deep-learning-based anomaly detection framework to detect lace defects. The framework contains three stages, namely video pre-processing stage, pixel reconstruction stage and pixel classification stage. In the offline phase, only defect-free lace videos are needed to train the pixel reconstruction model and calculate the detection threshold by our adaptive thresholding method. In the online phase, the proposed framework reconstructs lace videos and performs defect inspection using reconstruction error and the pre-set threshold. As far as we know, this paper the first to detect fabric defects by videos. Experimental results on artificial defect videos demonstrate the effectiveness of the proposed framework.

Deep learning-based probabilistic anomaly detection for solar forecasting under cyberattacks

Recently, cyberattacks on solar power forecasting emerge with the increase of solar penetration, which may lead to substantial economic losses and power system reliability issues. This paper presents a novel probabilistic anomaly detection framework to effectively and accurately detect cyberattacks in solar power forecasting, which consists of three major components. First, a convolutional neural network is used to extract spatial correlations among solar farms at the bottom of the model. Second, a long short-term memory network is used to capture the temporal dependencies within solar power data and generate deterministic solar power forecasts, which is then converted to probabilistic forecasts through pinball loss optimization. Finally, the probabilistic solar power forecasts are used for anomaly detection. The effectiveness of the proposed framework is validated by using 16 solar farms with a variety of data integrity attacks. Numerical results of case studies show that the developed probabilistic anomaly detection methodology could effectively detect data integrity attacks in solar power forecasting with a relatively high accuracy.

Unsupervised learning approach for predicting sepsis onset in ICU patients.

Sepsis is a life-threatening condition caused by a deregulated host response to infection. If not diagnosed at an early stage, septic patients can go into a septic shock, associated with aggravated patient outcomes. Research has been mostly focused on predicting sepsis onset using supervised models that require big labeled datasets to train. In this work we propose two fully unsupervised learning approaches to predict septic shock onset in the Intensive Care Unit (ICU). Our approach includes learning representations from patient multivariate timeseries using Recurrent Autoencoders. Then, we apply an anomaly detection framework, using clustering-based algorithms, on the representation space learned by the models. When evaluating the performance of the proposed approaches in the septic shock onset prediction task, the Variational Autoencoder (VAE) using Gaussian Mixture Models in the anomaly detection framework was competitive with a supervised LSTM network. Results led to an AUC of 0.82 and F1-score of 0.65 using the unsupervised approach in comparison with 0.80, 0.66 for the supervised model.Clinical relevance- This work proposes an unsupervised septic shock onset prediction framework which can improve current procedure for monitoring infection progression in the ICU.