Anomaly Detection Model Research Articles

Relapse prediction in schizophrenia with smartphone digital phenotyping during COVID-19: a prospective, three-site, two-country, longitudinal study

Smartphone technology provides us with a more convenient and less intrusive method of detecting changes in behavior and symptoms that typically precede schizophrenia relapse. To take advantage of the aforementioned, this study examines the feasibility of predicting schizophrenia relapse by identifying statistically significant anomalies in patient data gathered through mindLAMP, an open-source smartphone app. Participants, recruited in Boston, MA in the United States, and Bangalore and Bhopal in India, were invited to use mindLAMP for up to a year. The passive data (geolocation, accelerometer, and screen state), active data (surveys), and data quality metrics collected by the app were then retroactively fed into a relapse prediction model that utilizes anomaly detection. Overall, anomalies were 2.12 times more frequent in the month preceding a relapse and 2.78 times more frequent in the month preceding and following a relapse compared to intervals without relapses. The anomaly detection model incorporating passive data proved a better predictor of relapse than a naive model utilizing only survey data. These results demonstrate that relapse prediction models utilizing patient data gathered by a smartphone app can warn the clinician and patient of a potential schizophrenia relapse.

Monitoring Chemical Accidents in Industrial Complexes Using Tower-Installed Infrared System for Remote Chemical Detection and Long-Range Video Surveillance System

Chemical industrial complexes are extensive, complex structures with large-scale chemical facilities where large quantities of various chemical substances are handled. Detection equipment must be installed in high locations to monitor these industrial complexes and detect chemical accidents from a distance. In previous studies, individual monitoring equipment was temporarily installed on the ground, on a rooftop, or on a vehicle to detect chemical accidents from a distance. In this study, however, the industrial complex chemical accident monitoring system was developed by combining different technologies and was installed on a tower. For the Yeosu National Industrial Complex (which functioned as a test bed), 70m-high steel towers were built. Additionally, an infrared system for remote chemical detection (SIGIS-2, Bruker) and a long-range video surveillance system (TORUSS-LR2000, Globalsystems) were installed at the top of steel towers to monitor the entire industrial complex. The target substances to be monitored in real time by the infrared system for remote chemical detection were selected, and the monitoring sections were classified to enable each piece of equipment to distinguish the scanned areas. To improve the accuracy of the detection results, the information about the actual handled substances and respective facilities of the sites in the industrial complex was inserted into the database of the system and then connected to the sections. During the three-month test operation, various chemical substances (including 1,3-butadiene, methanol, methylamine, ethyl acetate, ammonia, and vinyl chloride) were detected at each section in 20,034 cases, and the detection results were consistent with the inserted actual information. The accumulated detection data shows that the detection frequency of a specific chemical substance was high in each section. This can be used as a basis for modifying the threshold of the anomaly detection model, thereby improving the accuracy of the system. Therefore, this system can detect and evaluate the leakage of chemical substances and the occurrence of fires or smoke through large-scale scans 24 h per day. Furthermore, it can be used for the early detection of and effective responses to chemical accidents in industrial complexes.

HaarAE: an unsupervised anomaly detection model for IOT devices based on Haar wavelet transform

HaarAE: an unsupervised anomaly detection model for IOT devices based on Haar wavelet transform

A Comparative Study of Time Series Anomaly Detection Models for Industrial Control Systems.

Anomaly detection has been known as an effective technique to detect faults or cyber-attacks in industrial control systems (ICS). Therefore, many anomaly detection models have been proposed for ICS. However, most models have been implemented and evaluated under specific circumstances, which leads to confusion about choosing the best model in a real-world situation. In other words, there still needs to be a comprehensive comparison of state-of-the-art anomaly detection models with common experimental configurations. To address this problem, we conduct a comparative study of five representative time series anomaly detection models: InterFusion, RANSynCoder, GDN, LSTM-ED, and USAD. We specifically compare the performance analysis of the models in detection accuracy, training, and testing times with two publicly available datasets: SWaT and HAI. The experimental results show that the best model results are inconsistent with the datasets. For SWaT, InterFusion achieves the highest F1-score of 90.7% while RANSynCoder achieves the highest F1-score of 82.9% for HAI. We also investigate the effects of the training set size on the performance of anomaly detection models. We found that about 40% of the entire training set would be sufficient to build a model producing a similar performance compared to using the entire training set.

Intelligent Anomaly Detection of Trajectories for IoT Empowered Maritime Transportation Systems

The convergence of Maritime Transportation Systems (MTS) and Internet of Things (IoT) has led to the promising IoT-empowered MTS (IoT-MTS). However, abnormal trajectories of maritime transportation ships can have highly negative impacts on the management of IoT-MTS. Therefore, anomaly detection of trajectories is important for the successful deployment of IoT-MTS. In this paper, we propose a Transfer Learning based Trajectory Anomaly Detection strategy, named TLTAD, for IoT-MTS. Specifically, a variational autoencoder is used to discover the potential connections between each dimension of the normal trajectory, while a graph variational autoencoder is used to explore the spatial similarity between normal trajectories. Based on internal connection of trajectories, a deep reinforcement learning algorithm, Twin Delayed Deep Deterministic policy gradient (TD3), is employed to train the trajectory anomaly detection model. To reduce the model training time, transfer learning is used to migrate the trained anomaly detection model between different regions of an ocean area or between similar ocean areas. Moreover, an efficient data transformation module is designed to improve the efficiency of model transfer. The experiments were conducted on a real-world automatic identification system (AIS) dataset. The results indicate that the proposed TLTAD can provide accurate anomaly detection on ships’ trajectories in IoT-MTS with reduced model training times.

Generative Adversarial Networks for Anomaly Detection in Biomedical Imaging: A Study on Seven Medical Image Datasets

Anomaly detection (AD) is a challenging problem in computer vision. Particularly in the field of medical imaging, AD poses even more challenges due to a number of reasons, including insufficient availability of ground truth (annotated) data. In recent years, AD models based on generative adversarial networks (GANs) have made significant progress. However, their effectiveness in biomedical imaging remains underexplored. In this paper, we present an overview of using GANs for AD, as well as an investigation of state-of-the-art GAN-based AD methods for biomedical imaging and the challenges encountered in detail. We have also specifically investigated the advantages and limitations of AD methods on medical image datasets, conducting experiments using 3 AD methods on 7 medical imaging datasets from different modalities and organs/tissues. Given the highly different findings achieved across these experiments, we further analyzed the results from both data-centric and model-centric points of view. The results showed that none of the methods had reliable performance for detecting abnormalities in medical images. Factors such as the number of training samples, the subtlety of the anomaly, and the dispersion of the anomaly in the images are among the phenomena that highly impact the performance of the AD models. The obtained results were highly variable (AUC: 0.475-0.991; Sensitivity: 0.17-0.98; Specificity: 0.14-0.97). In addition, we provide recommendations for deployment of AD models in medical imaging and foresee important research directions.

A High Accuracy and Adaptive Anomaly Detection Model With Dual-Domain Graph Convolutional Network for Insider Threat Detection

Insider threat is destructive and concealable, making addressing it a challenging task in cybersecurity. Most existing methods transform user behavior into sequential information and analyze user behavior while neglecting structural information among users, resulting in high false positives. To solve this problem, in this paper, we propose Dual-Domain Graph Convolutional Network (referred to as DD-GCN), a graph-based modularized method for high accuracy and adaptive insider threat detection. The central idea is to convert user features and structural information into heterogeneous graphs in the light of various relationships and take user behavior and relationship into account together. To this end, a weighted feature similarity mechanism is applied to balance the feature similarity of users and original linkages among them so as to generate the fused structure. Next, specific graph embeddings are extracted from the original topology structure and fused structure simultaneously, which convert behavior information into high-level representations. Furthermore, an attention mechanism is applied to learn the adaptive importance weights of the user’s features in the corresponding embedding. The combination and difference constraints are proposed to enhance the learned embeddings’ commonality and the ability to capture different information. Extensive experiments on two real-world datasets clearly show that our proposed DD-GCN extracts the most correlated information from structural topology and feature information substantially, and achieves improved accuracy with a clear margin.

Retracted: Time Series Anomaly Detection Model Based on Multi-Features.

[This retracts the article DOI: 10.1155/2022/2371549.].

Real-time water quality detection based on fluctuation feature analysis with the LSTM model

AbstractSignal analysis and anomaly detection for water pollution early warning systems are important and necessary. In view of the nonlinear and volatile characteristics of water quality time series, this paper proposes a new method for water anomaly detection based on fluctuation feature analysis. The method has two steps. First, the water quality time series data are used to calculate the residuals between the observed value and the predicted value with the long short-term memory (LSTM) network. Second, the dynamic features are extracted by sliding time window and described by the Approximate Entropy (ApEn) which are input to the anomaly detection model with Isolation Forest. Compared with traditional anomaly detection methods, the results obtained by the proposed method show better performance in distinguishing water quality anomalies. The proposed method can be applied to real-time water quality anomaly detection and early warning.

A Memory-Guided Anomaly Detection Model with Contrastive Learning for Multivariate Time Series

A Memory-Guided Anomaly Detection Model with Contrastive Learning for Multivariate Time Series

Feasibility of Universal Anomaly Detection without Knowing the Abnormality in Medical Images.

Many anomaly detection approaches, especially deep learning methods, have been recently developed to identify abnormal image morphology by only employing normal images during training. Unfortunately, many prior anomaly detection methods were optimized for a specific "known" abnormality (e.g., brain tumor, bone fraction, cell types). Moreover, even though only the normal images were used in the training process, the abnormal images were often employed during the validation process (e.g., epoch selection, hyper-parameter tuning), which might leak the supposed "unknown" abnormality unintentionally. In this study, we investigated these two essential aspects regarding universal anomaly detection in medical images by (1) comparing various anomaly detection methods across four medical datasets, (2) investigating the inevitable but often neglected issues on how to unbiasedly select the optimal anomaly detection model during the validation phase using only normal images, and (3) proposing a simple decision-level ensemble method to leverage the advantage of different kinds of anomaly detection without knowing the abnormality. The results of our experiments indicate that none of the evaluated methods consistently achieved the best performance across all datasets. Our proposed method enhanced the robustness of performance in general (average AUC 0.956).

SA-PatchCore: Anomaly Detection in Dataset With Co-Occurrence Relationships Using Self-Attention

Various unsupervised anomaly detection methods using deep learning have recently been proposed, and the accuracy of the anomaly detection technique for local anomalies has been improved. However, no anomaly detection dataset includes co-occurrence-related anomalies, which are combination-related. Thus, the accuracy of anomaly detection for co-occurrence-related anomalies has not progressed. Therefore, we propose SA-PatchCore, which introduces self-attention to the state-of-the-art local anomaly detection model, PatchCore. It detects anomalies in co-occurrence relationships and anomalies in local areas with the benefit of the self-attention module, which can consider contexts between separated words introduced first in the natural language processing field. As no anomaly detection dataset includes anomalies in co-occurrence relation, we prepared a new dataset called the Co-occurrence Anomaly Detection Screw Dataset (CAD-SD). Furthermore, we performed experiments on anomaly detection using the new dataset. SA-PatchCore achieves high anomaly detection performance compared with PatchCore in the CAD-SD. Moreover, our proposed model shows almost the same anomaly detection performance as PatchCore in an MVTec Anomaly Detection dataset, which is composed of anomalies in a local area. As a contribution to the anomaly detection task, we have released the CAD-SD to the public. The code and dataset are publicly available at <uri xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">https://github.com/IshidaKengo/SA-PatchCore</uri>

Insider Threat Detection Using Machine Learning Approach

Insider threats pose a critical challenge for securing computer networks and systems. They are malicious activities by authorised users that can cause extensive damage, such as intellectual property theft, sabotage, sensitive data exposure, and web application attacks. Organisations are tasked with the duty of keeping their layers of network safe and preventing intrusions at any level. Recent advances in modern machine learning algorithms, such as deep learning and ensemble models, facilitate solving many challenging problems by learning latent patterns and modelling data. We used the Deep Feature Synthesis algorithm to derive behavioural features based on historical data. We generated 69,738 features for each user, then used PCA as a dimensionality reduction method and utilised advanced machine learning algorithms, both anomaly detection and classification models, to detect insider threats, achieving an accuracy of 91% for the anomaly detection model. The experimentation utilised a publicly available insider threat dataset called the CERT insider threats dataset. We tested the effect of the SMOTE balancing technique to reduce the effect of the imbalanced dataset, and the results show that it increases recall and accuracy at the expense of precision. The feature extraction process and the SVM model yield outstanding results among all other ML models, achieving an accuracy of 100% for the classification model.

Constructing a high-performance self-training model based on support vector classifiers to detect gold mineralization-related geochemical anomalies for gold exploration targeting

In an area where mineral deposits have been discovered, both anomaly detection algorithms and supervised classification algorithms can be adopted to detect mineralization-related geochemical anomalies for mineral exploration targeting. However, anomaly detection algorithms themselves cannot use known mineral deposits as the supervisors to improve the performance of geochemical anomaly detection models. Supervised classification algorithms can not properly deal with the extreme class-imbalance of geochemical exploration data in the establishment of classification models. Therefore, neither anomaly detection models nor supervised classification models perform well in the detection of mineralization-related geochemical anomalies. In order to obtain a high-performance mineral exploration targeting model, the self-training algorithm was adopted to construct a self-training model based on support vector classifiers to detect gold mineralization-related geochemical anomalies in the Chengde area in Hebei Province (China). The self-training model was compared with the support vector classification model, logistic regression model and five dictionary learning models in terms of area under the curve (AUC) and lift index. The AUC value of the self-training model (0.89) is much higher than those of the two supervised classification models (0.81–0.82) and five anomaly detection models (0.79–0.81). The lift index of the self-training model (11.87) is also much higher than those of the two supervised classification models (2.77–4.04) and five anomaly detection models (2.64–3.48). Therefore, the self-training model performs much better than the two supervised classification models and five anomaly detection models in the detection of gold mineralization-related geochemical anomalies. The gold mineralization-related geochemical anomalies detected by the self-training model highly conform to the metallogenic and geological features in the study area. Therefore, it is a prospective method to establish a self-training model to detect mineralization-related geochemical anomalies in an area where mineral deposits have been discovered.

Deep learning-enabled anomaly detection for IoT systems

Internet of Things (IoT) systems have become an intrinsic technology in various industries and government services. Unfortunately, IoT devices and networks are known to be highly vulnerable to security attacks that target data integrity and service availability. Moreover, the heterogeneity of the data collected from various IoT devices, together with the disturbances incurred within the IoT system, render the detection of anomalous behavior and compromised nodes more challenging compared to traditional Information Technology (IT) networks. As a result, there is a pressing need for effective and reliable anomaly detection to identify malicious data to guarantee that they will not be used in IoT-driven decision support systems. In this paper, we propose a deep learning-powered anomaly detection for IoT that can learn and capture robust and useful features, which cannot be significantly affected by unstable environments. These features are then used by the classifier to enhance the accuracy of detecting malicious IoT data. More specifically, the proposed deep learning model is designed based on a denoising autoencoder, which is adopted to obtain features that are robust against the heterogeneous environment of IoT. Experimental results based on real-life IoT datasets show the effectiveness of the proposed framework in terms of enhancing the accuracy of detecting malicious data compared to the state-of-the-art IoT-based anomaly detection models.

RUAD: Unsupervised anomaly detection in HPC systems

The increasing complexity of modern high-performance computing (HPC) systems necessitates the introduction of automated and data-driven methodologies to support system administrators’ effort towards increasing the system’s availability. Anomaly detection is an integral part of improving the availability as it eases the system administrator’s burden and reduces the time between an anomaly and its resolution. However, current state-of-the-art (SOTA) approaches to anomaly detection are supervised and semi-supervised, so they require a human-labelled dataset with anomalies — this is often impractical to collect in production HPC systems. Unsupervised anomaly detection approaches based on clustering, aimed at alleviating the need for accurate anomaly data, have so far shown poor performance.In this work, we overcome these limitations by proposing RUAD, a novel Recurrent Unsupervised Anomaly Detection model. RUAD achieves better results than the current semi-supervised and unsupervised SOTA approaches. This is achieved by considering temporal dependencies in the data and including long-short term memory cells in the model architecture. The proposed approach is assessed on a complete ten-month history of a Tier-0 system (Marconi100 from CINECA with 980 nodes). RUAD achieves an area under the curve (AUC) of 0.763 in semi-supervised training and an AUC of 0.767 in unsupervised training, which improves upon the SOTA approach that achieves an AUC of 0.747 in semi-supervised training and an AUC of 0.734 in unsupervised training. It also vastly outperforms the current SOTA unsupervised anomaly detection approach based on clustering, achieving the AUC of 0.548.

Anomaly detection of power battery pack using gated recurrent units based variational autoencoder

Rapid and accurate detection of battery pack anomalies and timely fault-tolerant control is of great importance to the safe operation of electric vehicles (EVs). The occurrence of battery system fire accidents shows that if an anomaly cannot be detected early in the potential stage before thermal runaway, the anomaly may develop into a serious fault at any time and lead to irreparable damage. This paper presents such a semi-supervised anomaly detection model, by using a gated recurrent unit (GRU) based variational autoencoder (VAE) (GRU-VAE) framework that detects the early potential anomalies of EV power battery packs. Specifically, employing a GRU-based inference network enables the model to learn the robust latent feature representations of the input multivariate time series (MVTS), which are then used by the generator network to reconstruct the input data. In the training phase, minimizing the reconstruction error helps to learn the data distribution of normal samples. In the testing phase, a large reconstruction error of an input sample indicates that it contains potential abnormal events. In particular, the GRU is used to capture the complex time dependencies in MVTS, and the VAE is used to reconstruct the input sample with probability. The Peaks over Threshold (POT) model in the classical extreme value theory (EVT) is used to properly set the anomaly detection threshold. Experimentation over the real EV operation datasets shows that the model can effectively detect the potential anomalies in MVTS, which is expected to provide a reference for intelligent power battery pack anomaly detection technology.

Online Anomaly Detection for Aeroengine Gas Path Based on Piecewise Linear Representation and Support Vector Data Description

The online anomaly detection of an aeroengine gas path system is very important to ensure the safety of aircraft. The traditional online anomaly detection method based on a sliding window has many shortcomings, which leads to the lack of accuracy of anomaly detection. In addition, the extreme lack of abnormal samples is also a difficult problem for engine anomaly detection. Therefore, this article proposes an anomaly detection method based on piecewise linear representation (PLR) and support vector data description (SVDD). First, the monitoring data of the aeroengine gas path are segmented and linearly represented so that the data in each segment have basically consistent changing trends, which can make up for the defects of the traditional sliding window. And an improved online segmentation method is proposed that increases the efficiency of the segmentation algorithm. Then, segment features are extracted, and input samples for the anomaly detection model are constructed. The classification model employs SVDD that requires only normal samples. The SVDD model is trained on the offline normal samples and anomaly detection is performed on the online samples. Experimental results show the superiority of this method in aeroengine gas path anomaly detection.

Industrial Anomaly Detection with Skip Autoencoder and Deep Feature Extractor

Over recent years, with the advances in image recognition technology for deep learning, researchers have devoted continued efforts toward importing anomaly detection technology into the production line of automatic optical detection. Although unsupervised learning helps overcome the high costs associated with labeling, the accuracy of anomaly detection still needs to be improved. Accordingly, this paper proposes a novel deep learning model for anomaly detection to overcome this bottleneck. Leveraging a powerful pre-trained feature extractor and the skip connection, the proposed method achieves better feature extraction and image reconstructing capabilities. Results reveal that the areas under the curve (AUC) for the proposed method are higher than those of previous anomaly detection models for 16 out of 17 categories. This indicates that the proposed method can realize the most appropriate adjustments to the needs of production lines in order to maximize economic benefits.

Anomaly detection by using a combination of generative adversarial networks and convolutional autoencoders

With the development of full digitalization, the amount of time series data generated by sensors is ever-increasing; thus, time series outlier detection has become crucial. Moreover, in practice, discovering and flagging anomalies is very time-consuming and expensive. To solve this problem, unsupervised anomaly detection methods have often been used in the past, in which the model is trained with normal data to learn its behavioral patterns. Generative adversarial networks (GANs) can simulate complex and high-dimensional distributions of data and can be used to learn the behavioral patterns of normal data for unsupervised anomaly detection. However, because of the problem of convergence, GANs are difficult to train. Thus, USADs (an unsupervised anomaly detection model) utilize an autoencoder (AE) to undertake the task of the generator and discriminator and enhance the stability during adversarial training by using the AE to alleviate the problem of non-convergence encountered in GANs. Therefore, in this study, we used the USAD’s generative adversarial training architecture combined with convolutional AEs to improve the model’s feature extraction capabilities. In addition, to reduce false-positive outcomes caused by the prominent sharp points in the reconstructed data, we used the exponential weighted moving average method to smooth the reconstruction error, thereby improving the anomaly detection accuracy of the model. Finally, we experimented with real-world time-series data (ECG and 2D gesture) and verified that our approach could improve accuracy. Compared to the best in the comparison method, our model improved by 0.028% in AUROC, 0.233% in AUPRC, and 0.187% in F1 on average.