Anomaly Detection Module Research Articles

Semantic Coarse-to-Fine Granularity Learning for Two-Stage Few-Shot Anomaly Detection

Anomaly detection is critical in industrial inspection, where identifying defects significantly impacts product quality and safety. Existing models, primarily based on convolutional neural networks (CNNs), struggle with noise sensitivity and insufficient resolution for fine-grained feature discrimination. To address these issues, we propose a two-stage few-shot anomaly detection network that enhances semantic feature granularity and generalization. The network includes a coarse-grained anomaly detection module, a multi-scale channel attention module, and a fine-grained detection module. The coarse-grained module identifies abnormal regions, serving as the initial filter. The multi-scale channel attention module focuses on anomalous features, enhancing sensitivity to fine-grained characteristics. This step overcomes limitations in discerning subtle yet critical anomalies. The fine-grained detection module refines feature maps, enhancing generalization. Experimental results on the MVTec dataset show an image-level Area under the region of convergence (AUROC) of 92.3% and a pixel-level AUROC of 95.3%, a 1% to 2% improvement over leading FSAD methods.

AI-Based Electricity Grid Management for Sustainability, Reliability, and Security

Greenhouse gas emissions are critical issues for mankind, especially from the viewpoint of electricity consumption. With the development of artificial intelligence (AI), the smart grid is an emerging issue in terms of efficiency, sustainability, reliability, and security. This article proposes a concept for an AI-based electricity management system that includes prediction, anomaly detection, grid management, and market equalization modules. The prediction module predicts electricity supply and demand, and the anomaly detection module detects potential attacks and failures of supply and demand for security considerations. Based on prediction and detection, the grid management module determines sustainable subsidies and reliable operating reserve rates. Finally, the market equilibrium model balances electricity supply and demand.

Solar-Mixer: An Efficient End-to-End Model for Long-Sequence Photovoltaic Power Generation Time Series Forecasting

The expansion of photovoltaic power generation makes photovoltaic power forecasting an essential requirement. With the development of deep learning, more accurate predictions have become possible. This paper proposes an efficient end-to-end model for solar power generation that allows for long-sequence time series forecasting.This paper proposes an efficient end-to-end system for solar power generation that allows for long-term forecasting. Two modules comprise the forecasting model: the anomaly detection module and the forecasting module. Singular values are detected and corrected by the anomaly detection module. And in the forecasting module, the series is first divided into different intervals. After that, the divided data is passed through a decomposition module embedded in the neural network, and each interval is encoded as high-dimension vectors. These vectors are fed into the mixing layer, which is used to learn the relationship between intervals and channels after the encoding process. Every mixing layer comprises two different layers: the channel-mixing layer allows communication between different channels, and the interval-mixing layer allows communication between different intervals. This neural network is purely dependent on the multilayer perceptron, resulting in a network with low system latency and low training cost. The experiments results not only show the model proposed in this paper can make accurate long-sequence time series forecasts for photovoltaic power generation at three sites but also show that the model can defeat the state-of-the-art model in long-sequence photovoltaic power generation time series forecasting work.

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers.

Software defined networking (SDN) improves the flexibility and programmability of the network by separating the control plane and the data plane and effectively realizes the global control of the network infrastructure. However, the centralized structure design of SDN exposes the controller to potential threats. Attackers have used the active flow table delivery mode to launch distributed denial of service (DDoS) attacks on the SDN controller, resulting in the controller failure and seriously affecting the network performance. To overcome this problem, this paper proposes a defense framework called CC-Guard. The framework consists of four modules: attack detection triggering, switch migration, anomaly detection, and mitigation. Among them, the attack detection trigger module improves the system's timely response to DDoS attacks. The switch migration module effectively unclogs the controller congestion problem and provides convenience for network flow transmission. The anomaly detection module uses a coarse-grained method for two-stage detection, which improves the detection accuracy. The mitigation module uses the idea of cross-domain cooperation of the controller to clear the abnormal flow in the blacklist. Experimental results show that our proposed CC-Guard has real-time DDoS attack defense capability and high detection accuracy, as well as efficient network resource utilization.

Employing a hybrid model based on texture-biased convolutional neural networks and edge-biased vision transformers for anomaly detection of signal bonds

The railway system of Japan plays a vital role in the national transportation network. A key issue in public transport safety is anomaly detection in railways. Lately, developing robust algorithms and methods for anomaly detection has become the premier task in this field. Recently introduced approaches based on convolutional neural networks, generative adversarial networks, and vision transformers (ViTs) have remarkably improved the research in anomaly detection. Our work proposes a high-performance module for the anomaly detection of signal bonds. First, we present an overview of the proposed module; then, the object detection model and the proposed hybrid classification model based on texture-biased convolutional neural networks and edge-biased ViTs are introduced. Finally, the proposed anomaly detection module is evaluated for accuracy using the dataset from the East Japan Railway Company and the receiver operating characteristic curve. The results show that our proposed module achieves a better performance on real-life data than the two methods that were combined to generate it, raising hope toward possible usage in other areas as well.

A Laborer’s Mask-Wearing Behavior Detection Approach in the Manufacturing Field

Industry 4.0 has considerably advanced multiple manufacturing fields through digitalization and intelligentization. Many technologies, such as supervisory control, data acquisition, and data analytics, have been used widely in manufacturing sites to enhance production efficiency. Therefore, this created a cloud-based anomaly detection module for epidemic prevention at the manufacturing site. Image process technologies, deep learning algorithms, and cloud computing were employed in the proposed module to automatically identify labor anomaly behavior in the manufacturing site and prevent the epidemic. This study used image processing technologies and deep learning to recognize and train the manufacturing site image. Accordingly, the analyzed result could be incorporated into the cloud system using the Message Queuing Telemetry Transport (MQTT) protocol. Therefore, the administrators and laborers can be notified regarding the anomaly behavior. The author used the image data obtained from the cylinder head process site as a data source for DA. As per the experimental results, the proposed method has an accuracy of 90%. Therefore, deep learning algorithms provide a practical approach to anomaly detection for epidemic prevention. Furthermore, this study’s primary contributions are designing an improved approach and connecting the manufacturing site to the cloud side using the proposed module.

Anomaly Detection Module for Network Traffic Monitoring in Public Institutions

It seems to be a truism to say that we should pay more and more attention to network traffic safety. Such a goal may be achieved with many different approaches. In this paper, we put our attention on the increase in network traffic safety based on the continuous monitoring of network traffic statistics and detecting possible anomalies in the network traffic description. The developed solution, called the anomaly detection module, is mostly dedicated to public institutions as the additional component of the network security services. Despite the use of well-known anomaly detection methods, the novelty of the module is based on providing an exhaustive strategy of selecting the best combination of models as well as tuning the models in a much faster offline mode. It is worth emphasizing that combined models were able to achieve 100% balanced accuracy level of specific attack detection.

Energy grid management system with anomaly detection and Q-learning decision modules

Stability and security issues in energy management have become widespread research topics, in which artificial intelligence techniques are often embedded in management systems to efficiently manage the smart grid. In this paper, we propose an energy grid management system with anomaly detection and Q-learning decision modules (EMSAD). The anomaly detection module is a multitask learning network that simultaneously classifies suppliers and predicts actual supply quantities. The Q-learning decision module then determines the operating reserve and subsidies to manage the energy grid. Experimental results show that the proposed anomaly detection module has an excellent performance in classifying malicious suppliers with F1-scores from 73.3% to 100.0%. The robustness evaluation also shows that EMSAD maintains high performance even in unseen environments without fine-tuning. Thus, the simulation results demonstrate the security, efficiency, transferability, and robustness of the proposed EMSAD in smart grid energy management.

이상 탐지 기반 퍼스널 모빌리티 사용자 인식 및 운전보조 응용

As the number of personal mobility users increases, it is essential to protect both personal mobility users and car drivers. Although existing supervised learning-based object detection methods can recognize personal mobilities, processing for data collection, labeling, and training is time-consuming and expensive whenever new forms of personal mobilities come to the market. Anomaly detection-based methods are proposed to learn normal patterns and detect abnormal patterns without prior training. This study proposes a new approach to personal mobility user recognition using deep learning-based anomaly detection in dynamically changing driving environments. The proposed approach consists of Human detection, Cropping and Anomaly detection modules. The Human detection module detects human regions. The Cropping module removes unnecessary areas and performs a preprocessing. The memory-based Anomaly detection module distinguishes between pedestrians and personal mobility users. Based on the proposed anomaly detection method, augmented reality (AR) visualization in the head-up display (HUD) is proposed for effective driving assistance. Since it is possible to distinguish pedestrians and mobility users effectively, the AR HUD-based visualization can assist the driver to pay more attention to the mobility user.

Network security risk assessment of football matches based on data mining technology

ObjectiveUsing the principles and advanced methods of data mining technology, this paper aims to achieve the analysis and assessment of network security risks under soccer tournaments as a way to help analyze and solve the objective problems such as system vulnerabilities and network viruses that exist in network security today. Faced with various network securities, this paper adopts quantitative risk assessment method. MethodsIn the evaluation of algorithms for constructing network security, the principles and laws of data mining techniques are drawn upon for the analysis and evaluation of network security risks to help analyze the network security risks of soccer tournaments. ResultIt contains 494,020 network connection data, each of which contains 41 connection attributes, including 34 numeric and 7 character attributes. There were 97,277 normal network connections and 396,743 anomalous network connections. In the experiments of the anomaly detection module, although the false positive rate increases compared to all features, the accuracy is basically the same as that of all features with nearly 50% less modeling time and lower false positive rate. So this method is more stable. Therefore, the analysis and assessment of cybersecurity risks are crucial in the present time.

EEG-Based Anamoly Detection for Autistic Kids – A Pilot Study

An electroencephalogram (EEG) test can be utilized to capture the electrical impulses in the human brain. EEG signal analysis is crucial in the detection and treatment of brain diseases. Autism is one of the neurological disorders that needs to be diagnosed in the early stages of life. Autistic behavior is difficult to differentiate and it can even lead to adverse effects in the daily routine of a kid. Recent advances in Artificial Intelligence have proven to be an effective way of diagnosing ASD. This research employs PyCaret framework to analyze the anomalies present in the EEG signal data in the context of differentiating Autistic children from Typically developing children. The different anomaly detection modules have been used to detect anomalies, compute their anomaly scores and visualize it. The goal of this study is to determine if PyCaret's anomaly detection module can aid the detection of ASD.

Knowledge-based quality control of organ delineations in radiation therapy.

To reduce the likelihood of errors in organ delineations used for radiotherapy treatment planning, a knowledge-based quality control (KBQC) system, which discriminates between valid and anomalous delineations isdeveloped. The KBQC is comprised of a group-wise inference system and anomaly detection modules trained using historical priors from 296 locally advanced lung and prostate cancer patient computational tomographies (CTs). The inference system discriminates different organs based on shape, relational, and intensity features. For a given delineated image set, the inference system solves a combinatorial optimization problem that results in an organ group whose relational features follow those of the training set considering the posterior probabilities obtained from support vector machine (SVM), discriminant subspace ensemble (DSE), and artificial neural network (ANN) classifiers. These classifiers are trained on nonrelational features with a 10-fold cross-validation scheme. The anomaly detection module is a bank of ANN autoencoders, each corresponding with an organ, trained on nonrelational features. A heuristic rule detects anomalous organs that exceed predefined organ-specific tolerances for the feature reconstruction error and the classifier's posterior probabilities. Independent data sets with anomalous delineations were used to test the overall performance of the KBQC system. The anomalous delineations were manually manipulated, computer-generated, or propagated based on a transformation obtained by imperfect registrations. Both peer-review-based scoring system and shape similarity coefficient (DSC) were used to label regions of interest (ROIs) as normal or anomalous in two independent test cohorts. The accuracy of the classifiers was 99.8%, and the minimum per-class F1-scores were 0.99, 0.99, and 0.98 for SVM, DSE, and ANN, respectively. The group-wise inference system reduced the miss-classification likelihood for the test data set with anomalous delineations compared to each individual classifier and a fused classifier that used the average posterior probability of all classifiers. For 15 independent locally advanced lung patients, the system detected 79% of the anomalous ROIs. For 1320 auto-segmented abdominopelvic organs, the anomaly detection system identified anomalous delineations, which also had low Dice similarity coefficient values with respect to manually delineated organs in the training dataset. The KBQC system detected anomalous delineations with superior accuracy compared to classification methods that judge only based on posterior probabilities.

Deep neural network for text anomaly detection in SIoT

Unsupervised textual anomaly detection, which discovers anomalies from unlabeled texts, is critical to improve the cybersecurity and interaction ability among the objects in the Social Internet of Things (SIoT). Recently, detecting anomalies by deep neural networks has become a popular trend. Specially, context vector data description (CVDD) method shows the promising performance. However, CVDD has two limitations: (1) it uses an one-class classification objective to constrain the sentence embeddings, which leads the learned embeddings to lose content information of text. (2) Scalar-based attention weights, which are used to extract sentence features, fail to focus on dimensional properties in a word. Learning the text contents and the dimensional properties is important for detection task in SIoT, which can help detector capture the difference between normal and anomaly texts. To overcome these limits, this paper proposes a textual anomaly detection network. First, an adversarial training strategy is designed to fight against the problem of missing content information. Second, a textual anomaly detection module with multiple dimensional transformation matrices is constructed to learn dimensional properties of words in diverse semantic subspaces. Experimental results on several textual datasets show that our proposed method outperforms CVDD and other strong baselines.

An edge based hybrid intrusion detection framework for mobile edge computing

The Mobile Edge Computing (MEC) model attracts more users to its services due to its characteristics and rapid delivery approach. This network architecture capability enables users to access the information from the edge of the network. But, the security of this edge network architecture is a big challenge. All the MEC services are available in a shared manner and accessed by users via the Internet. Attacks like the user to root, remote login, Denial of Service (DoS), snooping, port scanning, etc., can be possible in this computing environment due to Internet-based remote service. Intrusion detection is an approach to protect the network by detecting attacks. Existing detection models can detect only the known attacks and the efficiency for monitoring the real-time network traffic is low. The existing intrusion detection solutions cannot identify new unknown attacks. Hence, there is a need of an Edge-based Hybrid Intrusion Detection Framework (EHIDF) that not only detects known attacks but also capable of detecting unknown attacks in real time with low False Alarm Rate (FAR). This paper aims to propose an EHIDF which is mainly considered the Machine Learning (ML) approach for detecting intrusive traffics in the MEC environment. The proposed framework consists of three intrusion detection modules with three different classifiers. The Signature Detection Module (SDM) uses a C4.5 classifier, Anomaly Detection Module (ADM) uses Naive-based classifier, and Hybrid Detection Module (HDM) uses the Meta-AdaboostM1 algorithm. The developed EHIDF can solve the present detection problems by detecting new unknown attacks with low FAR. The implementation results illustrate that EHIDF accuracy is 90.25% and FAR is 1.1%. These results are compared with previous works and found improved performance. The accuracy is improved up to 10.78% and FAR is reduced up to 93%. A game-theoretical approach is also discussed to analyze the security strength of the proposed framework.

Slow Control System for PandaX-III experiment

The PandaX-III experiment uses high pressure gaseous time projection chamber to search for the neutrinoless double beta decay of 136Xe. A modular slow control system (SCS) has been designed to monitor all the critical parameters of the experiment.It ensures the proper operation of the experiment and provides necessary information for data corrections. The main subsystems of the experiment will be constantly monitored by the data collection module of the SCS,which collects data from sensors and sends them to the centralized database.When an alarm message is generated by the anomaly detection module,it will be sent to an alert website and related on-call experts immediately.A demonstrator of the SCS has been built for the PandaX-III prototype detector.The long-term test of it provided valuable experience for the final design of the SCS for PandaX-III.

Viral Pneumonia Screening on Chest X-Rays Using Confidence-Aware Anomaly Detection.

Clusters of viral pneumonia occurrences over a short period may be a harbinger of an outbreak or pandemic. Rapid and accurate detection of viral pneumonia using chest X-rays can be of significant value for large-scale screening and epidemic prevention, particularly when other more sophisticated imaging modalities are not readily accessible. However, the emergence of novel mutated viruses causes a substantial dataset shift, which can greatly limit the performance of classification-based approaches. In this paper, we formulate the task of differentiating viral pneumonia from non-viral pneumonia and healthy controls into a one-class classification-based anomaly detection problem. We therefore propose the confidence-aware anomaly detection (CAAD) model, which consists of a shared feature extractor, an anomaly detection module, and a confidence prediction module. If the anomaly score produced by the anomaly detection module is large enough, or the confidence score estimated by the confidence prediction module is small enough, the input will be accepted as an anomaly case (i.e., viral pneumonia). The major advantage of our approach over binary classification is that we avoid modeling individual viral pneumonia classes explicitly and treat all known viral pneumonia cases as anomalies to improve the one-class model. The proposed model outperforms binary classification models on the clinical X-VIRAL dataset that contains 5,977 viral pneumonia (no COVID-19) cases, 37,393 non-viral pneumonia or healthy cases. Moreover, when directly testing on the X-COVID dataset that contains 106 COVID-19 cases and 107 normal controls without any fine-tuning, our model achieves an AUC of 83.61% and sensitivity of 71.70%, which is comparable to the performance of radiologists reported in the literature.

Online anomaly detection in surveillance videos with asymptotic bound on false alarm rate

Anomaly detection in surveillance videos is attracting an increasing amount of attention. Despite the competitive performance of recent methods, they lack theoretical performance analysis, particularly due to the complex deep neural network architectures used in decision making. Additionally, online decision making is an important but mostly neglected factor in this domain. Much of the existing methods that claim to be online, depend on batch or offline processing in practice. Motivated by these research gaps, we propose an online anomaly detection method in surveillance videos with asymptotic bounds on the false alarm rate, which in turn provides a clear procedure for selecting a proper decision threshold that satisfies the desired false alarm rate. Our proposed algorithm consists of a multi-objective deep learning module along with a statistical anomaly detection module, and its effectiveness is demonstrated on several publicly available data sets where we outperform the state-of-the-art algorithms. All codes are available at https://github.com/kevaldoshi17/Prediction-based-Video-Anomaly-Detection-.

DBTP2SF: A deep blockchain‐based trustworthy privacy‐preserving secured framework in industrial internet of things systems

AbstractBy providing ubiquitous connectivity, effective data analytics tools, and better decision support systems for improved market competitiveness, the industrial internet of things (IIoT) promises creative business models in different industrial domains. However, the conventional IIoT architecture can no longer provide adequate support for such an enormous device as the number of nodes, and network size increases. Therefore, several challenges, such as security, privacy, centralization, trust, and integrity prevents faster adaptation of IIoT applications. To address aforementioned challenges, we present a deep blockchain‐based trustworthy privacy‐preserving secured framework (DBTP2SF) for IIoT environment. This framework comprises of three modules, namely, trust management module, a two‐level privacy‐preservation module, and an anomaly detection module. In trustworthiness module, blockchain (BC)‐based address reputation system is proposed. In the two‐level privacy module a BC‐based enhanced proof of work technique is simultaneously applied with AutoEncoder, to transform cyber‐physical system data into a new reduced form that prevents inference and poisoning attacks. In the anomaly detection module, deep neural network is deployed. Finally, due to various limitations of current Cloud‐Fog infrastructure, we present a BC‐interplanetary file systems integrated Cloud‐Fog architecture, namely, BlockCloud and BlockFog to deploy proposed DBTP2SF framework in IIoT environment. The experiment is conducted using IIoT‐based realistic dataset, namely, ToN‐IoT. The performance analysis shows that the proposed approach outperforms using transformed dataset over peer privacy‐preserving intrusion detection strategies, and has obtained accuracy of 98.97%, and detection rate of 93.87%. Finally, we have shown the superiority of DBTP2SF framework over some of the recent state‐of‐art techniques in both non‐BC and BC‐based IIoT system.

On-board Clutch Slippage Detection and Diagnosis in Heavy Duty Machine

In order to reduce unnecessary stops and expensive downtime originating from clutch failure of construction equipment machines; adequate real time sensor data measured on the machine in combination with feature extraction and classification methods may be utilized.This paper presents a framework with feature extraction methods and an anomaly detection module combined with Case-Based Reasoning (CBR) for on-board clutch slippage detection and diagnosis in heavy duty equipment. The feature extraction methods used are Moving Average Square Value Filtering (MASVF) and a measure of the fourth order statistical properties of the signals implemented as continuous queries over data streams. The anomaly detection module has two components, the Gaussian Mixture Model (GMM) and the Logistics Regression classifier. CBR is a learning approach that classifies faults by creating a new solution for a new fault case from the solution of the previous fault cases. Through use of a data stream management system and continuous queries (CQs), the anomaly detection module continuously waits for a clutch slippage event detected by the feature extraction methods, the query returns a set of features, which activates the anomaly detection module. The first component of the anomaly detection module trains a GMM to extracted features while the second component uses a Logistic Regression classifier for classifying normal and anomalous data. When an anomaly is detected, the Case-Based diagnosis module is activated for fault severity estimation.

Intrusion Detection System for the MIL-STD-1553 Communication Bus

MIL-STD-1553 is a military standard that defines the specification of a serial communication bus that has been implemented in military and aerospace avionic platforms for over 40 years. MIL-STD-1553 was designed for a high level of fault tolerance while less attention was paid to cyber security issues. Thus, as indicated in recent studies, it is exposed to various threats. In this article, we suggest enhancing the security of MIL-STD-1553 communication buses by integrating a machine learning-based intrusion detection system (IDS); such anIDS will be capable of detecting cyber attacks in real time. The IDS consists of two modules: 1) a remote terminal (RT) authentication module that detects illegitimately connected components and data transfers and 2) a sequence-based anomaly detection module that detects anomalies in the operation of the system. The IDS showed high detection rates for both normal and abnormal behavior when evaluated in a testbed using real 1553 hardware, as well as a very fast and accurate training process using logs from a real system. The RT authentication module managed to authenticate RTs with +0.99 precision and +0.98 recall; and detect illegitimate component (or a legitimate component that impersonates other components) with +0.98 precision and +0.99 recall. The sequence-based anomaly detection module managed to perfectly detect both normal and abnormal behavior. Moreover, the sequencebased anomaly detection module managed to accurately (i.e., zero false positives) model the normal behavior of a real system in a short period of time (~22 s).