Anomaly Scores Research Articles

Deterring the Gray Market: Product Diversion Detection via Learning Disentangled Representations of Multivariate Time Series

A gray market emerges when some distributors divert products to unauthorized distributors/retailers to make sneaky profits from the manufacturers’ differential channel incentives, such as quantity discounts. Traditionally, manufacturers rely heavily on internal audits to periodically investigate the flows of products and funds so as to deter the gray market; however, this is too costly given the large number of distributors and their huge volumes of orders. Owing to the advances in data analytics techniques, the ordering quantities of a distributor over time, which form multivariate time series, can help reveal suspicious product diversion behaviors and narrow the audit scope drastically. To that end, in this paper, we build on the recent advancement of representation learning for time series and adopt a sequence autoencoder to automatically characterize the overall demand patterns. To cope with the underlying entangled factors and interfering information in the multivariate time series of ordering quantities, we develop a disentangled learning scheme to construct more effective sequence representations. An interdistributor correlation regularization is also proposed to ensure more reliable representations. Finally, given the highly scarce anomaly labels for the detection task, an unsupervised deep generative model based on the learned representations of the distributors is developed to estimate the densities of distributions, which enables the anomaly scores generated through end-to-end learning. Extensive experiments on a real-world distribution channel data set and a larger simulated data set empirically validate our model’s superior and robust performances compared with several state-of-the-art baselines. Additionally, our illustrative economic analysis demonstrates that the manufacturers can launch more targeted and cost-effective audits toward the suspected distributors recommended by our model so as to deter the gray market. History: Accepted by Ram Ramesh, Area Editor for Data Science & Machine Learning. Funding: This work was supported by the National Natural Science Foundation of China [Grants 72031001, 72301017, 72371011, and 72242101]. Supplemental Material: The software that supports the findings of this study is available within the paper and its Supplemental Information ( https://pubsonline.informs.org/doi/suppl/10.1287/ijoc.2022.0155 ) as well as from the IJOC GitHub software repository ( https://github.com/INFORMSJoC/2022.0155 ). The complete IJOC Software and Data Repository is available at https://informsjoc.github.io/ .

Generalization performance analysis of anomaly detection-based active sonar classifier using anomaly score landscape

This study explores generalization performance of anomaly detection-based active sonar classifier using the deep neural network (NN). Despite its superior performance, NN remains challenging to interpret its decision due to black-box nature, which, consequently, makes it hard to trust the results. To address this, we employ the loss landscape method used to analyze the generalization performance of supervised learning-based NN. Owing to the inapplicability of the conventional loss landscapes to anomaly detection-based classifier, we propose a novel anomaly score landscape for the anomaly detection-based classifier. Experimental results using active sonar datasets reveal that anomaly detection-based classifier maintains consistent landscape structures between train and test datasets, compared to supervised learning counterparts. This study provides insights into the interpretability and generalization capabilities of supervised- and anomaly detection-based active sonar classifiers.

Individual Activity Anomaly Estimation in Operating Rooms Based on Time-Sequential Prediction.

Surveillance videos of operating rooms have potential to benefit post-operative analysis and study. However, there is currently no effective method to extract useful information from the long and massive videos. As a step towards tackling this issue, we propose a novel method to recognize and evaluate individual activities using an anomaly estimation model based on time-sequential prediction. We verified the effectiveness of our method by comparing two time-sequential features: individual bounding boxes and body key points. Experiment results using actual surgery videos show that the bounding boxes are suitable for predicting and detecting regional movements, while the anomaly scores using key points can hardly be used to detect activities. As future work, we will be proceeding with extending our activity prediction for detecting unexpected and urgent events.

Curved Geometric Networks for Visual Anomaly Recognition.

Learning a latent embedding to understand the underlying nature of data distribution is often formulated in Euclidean spaces with zero curvature. However, the success of the geometry constraints, posed in the embedding space, indicates that curved spaces might encode more structural information, leading to better discriminative power and hence richer representations. In this work, we investigate the benefits of the curved space for analyzing anomalous, open-set, or out-of-distribution (OOD) objects in data. This is achieved by considering embeddings via three geometry constraints, namely, spherical geometry (with positive curvature), hyperbolic geometry (with negative curvature), or mixed geometry (with both positive and negative curvatures). Three geometric constraints can be chosen interchangeably in a unified design, given the task at hand. Tailored for the embeddings in the curved space, we also formulate functions to compute the anomaly score. Two types of geometric modules (i.e., geometric-in-one (GiO) and geometric-in-two (GiT) models) are proposed to plug in the original Euclidean classifier, and anomaly scores are computed from the curved embeddings. We evaluate the resulting designs under a diverse set of visual recognition scenarios, including image detection (multiclass OOD detection and one-class anomaly detection) and segmentation (multiclass anomaly segmentation and one-class anomaly segmentation). The empirical results show the effectiveness of our proposal through consistent improvement over various scenarios. The code is made available at https://github.com/JHome1/GiO-GiT.

Adaptive Memory Broad Learning System for Unsupervised Time Series Anomaly Detection.

Time series anomaly detection is the process of identifying anomalies within time series data. The primary challenge of this task lies in the necessity for the model to comprehend the characteristics of time-independent and abnormal data patterns. In this study, a novel algorithm called adaptive memory broad learning system (AdaMemBLS) is proposed for time series anomaly detection. This algorithm leverages the rapid inference capabilities of the broad learning algorithm and the memory bank's capacity to differentiate between normal and abnormal data. Furthermore, an incremental algorithm based on multiple data augmentation techniques is introduced and applied to multiple ensemble learners, thereby enhancing the model's effectiveness in learning the characteristics of time series data. To bolster the model's anomaly detection capabilities, a more diverse ensemble approach and a discriminative anomaly score are recommended. Extensive experiments conducted on various real-world datasets demonstrate that the proposed method exhibits superior inference speed and more accurate anomaly detection compared to the existing competitors. A detailed experimental investigation is presented to elucidate the effectiveness of the proposed method and the underlying reasons for its efficacy.

Injecting Text Clues for Improving Anomalous Event Detection From Weakly Labeled Videos.

Video anomaly detection (VAD) aims at localizing the snippets containing anomalous events in long unconstrained videos. The weakly supervised (WS) setting, where solely video-level labels are available during training, has attracted considerable attention, owing to its satisfactory trade-off between the detection performance and annotation cost. However, due to lack of snippet-level dense labels, the existing WS-VAD methods still get easily stuck on the detection errors, caused by false alarms and incomplete localization. To address this dilemma, in this paper, we propose to inject text clues of anomaly-event categories for improving WS-VAD, via a dedicated dual-branch framework. For suppressing the response of confusing normal contexts, we first present a text-guided anomaly discovering (TAG) branch based on a hierarchical matching scheme, which utilizes the label-text queries to search the discriminative anomalous snippets in a global-to-local fashion. To facilitate the completeness of anomaly-instance localization, an anomaly-conditioned text completion (ATC) branch is further designed to perform an auxiliary generative task, which intrinsically forces the model to gather sufficient event semantics from all the relevant anomalous snippets for completely reconstructing the masked description sentence. Furthermore, to encourage the cross-branch knowledge sharing, a mutual learning strategy is introduced by imposing a consistency constraint on the anomaly scores of these two branches. Extensive experimental results on two public benchmarks validate that the proposed method achieves superior performance over the competing methods.

Context Recovery and Knowledge Retrieval: A Novel Two-Stream Framework for Video Anomaly Detection.

Video anomaly detection aims to find the events in a video that do not conform to the expected behavior. The prevalent methods mainly detect anomalies by snippet reconstruction or future frame prediction error. However, the error is highly dependent on the local context of the current snippet and lacks the understanding of normality. To address this issue, we propose to detect anomalous events not only by the local context, but also according to the consistency between the testing event and the knowledge about normality from the training data. Concretely, we propose a novel two-stream framework based on context recovery and knowledge retrieval, where the two streams can complement each other. For the context recovery stream, we propose a spatiotemporal U-Net which can fully utilize the motion information to predict the future frame. Furthermore, we propose a maximum local error mechanism to alleviate the problem of large recovery errors caused by complex foreground objects. For the knowledge retrieval stream, we propose an improved learnable locality-sensitive hashing, which optimizes hash functions via a Siamese network and a mutual difference loss. The knowledge about normality is encoded and stored in hash tables, and the distance between the testing event and the knowledge representation is used to reveal the probability of anomaly. Finally, we fuse the anomaly scores from the two streams to detect anomalies. Extensive experiments demonstrate the effectiveness and complementarity of the two streams, whereby the proposed two-stream framework achieves state-of-the-art performance on ShanghaiTech, Avenue and Corridor datasets among the methods without object detection. Even if compared with the methods using object detection, our method reaches competitive or better performance on the ShanghaiTech, Avenue, and Ped2 datasets.

Knowledge Graph Based Large Scale Network Security Threat Detection Techniques

Abstract This paper constructs a detection technique for large-scale network security threats based on a knowledge graph, extracts the attack features of network security threats using feature template FT, and combines the CNN layer, BiLSTM layer and CRF layer to establish FT-CNN-BiLSTM-CRF large-scale network security threat detection technique. Network security threat performance evaluation experiments and multi-step attack experiments have verified the detection capability of this paper's method. The recall rate of the method built in this paper in detecting malicious data is about 62.39%, the average F1-Score for normal and malicious traffic detection is 0.7482, and the anomaly score for normal traffic detection is almost 0. The detection performance of this paper's method for multi-step network attacks is superior to that of other methods, and it is capable of detecting malicious attacks quickly. Experiments have proved that the method constructed in this paper can meet the requirements of detection capability and efficiency in large-scale network security threats and has high feasibility and application value.

Anomaly detection support for crowdworkers by providing anomaly scores

Anomaly detection support for crowdworkers by providing anomaly scores

Anomaly detection of retention loss in fixed partial dentures using resonance frequency analysis and machine learning: An in vitro study.

This study aimed to determine the usefulness of machine learning techniques, specifically supervised and unsupervised learning, for assessing the cementation condition between a fixed partial denture (FPD) and its abutment using a resonance frequency analysis (RFA) system. An in vitro mandibular model was used with a single crown and three-unit bridge made of a high-gold alloy. Two cementation conditions for the single crown and its abutment were set: cemented and uncemented. Four cementation conditions were set for the bridge and abutments: both crowns were firmly cemented, only the premolar crown was cemented, only the molar crown was cemented, and both crowns were uncemented. For RFA under cementation conditions, 16 impulsive forces were directly applied to the buccal side of the tested tooth at a frequency of 4 Hz using a Periotest device. Frequency responses were measured using a 3D accelerometer mounted on the occlusal surface of the tested tooth. Both supervised and unsupervised learning methods were used to analyze the datasets. Using supervised learning, the fully cemented condition had the highest feature importance scores at approximately 3000 Hz; the partially cemented condition had the highest scores between 1000 and 2000 Hz; and the highest scores for the uncemented condition were observed between 0 and 500 Hz. Using unsupervised learning, the uncemented and partially cemented conditions exhibited the highest anomaly scores. Machine learning combined with RFA exhibits good potential to assess the cementation condition of an FPD and hence facilitate the early diagnosis of FPD retention loss.

Prediction of disease severity in COPD: a deep learning approach for anomaly-based quantitative assessment of chest CT

ObjectivesTo quantify regional manifestations related to COPD as anomalies from a modeled distribution of normal-appearing lung on chest CT using a deep learning (DL) approach, and to assess its potential to predict disease severity.Materials and methodsPaired inspiratory/expiratory CT and clinical data from COPDGene and COSYCONET cohort studies were included. COPDGene data served as training/validation/test data sets (N = 3144/786/1310) and COSYCONET as external test set (N = 446). To differentiate low-risk (healthy/minimal disease, [GOLD 0]) from COPD patients (GOLD 1–4), the self-supervised DL model learned semantic information from 50 × 50 × 50 voxel samples from segmented intact lungs. An anomaly detection approach was trained to quantify lung abnormalities related to COPD, as regional deviations. Four supervised DL models were run for comparison. The clinical and radiological predictive power of the proposed anomaly score was assessed using linear mixed effects models (LMM).ResultsThe proposed approach achieved an area under the curve of 84.3 ± 0.3 (p < 0.001) for COPDGene and 76.3 ± 0.6 (p < 0.001) for COSYCONET, outperforming supervised models even when including only inspiratory CT. Anomaly scores significantly improved fitting of LMM for predicting lung function, health status, and quantitative CT features (emphysema/air trapping; p < 0.001). Higher anomaly scores were significantly associated with exacerbations for both cohorts (p < 0.001) and greater dyspnea scores for COPDGene (p < 0.001).ConclusionQuantifying heterogeneous COPD manifestations as anomaly offers advantages over supervised methods and was found to be predictive for lung function impairment and morphology deterioration.Clinical relevance statementUsing deep learning, lung manifestations of COPD can be identified as deviations from normal-appearing chest CT and attributed an anomaly score which is consistent with decreased pulmonary function, emphysema, and air trapping.Key Points• A self-supervised DL anomaly detection method discriminated low-risk individuals and COPD subjects, outperforming classic DL methods on two datasets (COPDGene AUC = 84.3%, COSYCONET AUC = 76.3%).• Our contrastive task exhibits robust performance even without the inclusion of expiratory images, while voxel-based methods demonstrate significant performance enhancement when incorporating expiratory images, in the COPDGene dataset.• Anomaly scores improved the fitting of linear mixed effects models in predicting clinical parameters and imaging alterations (p < 0.001) and were directly associated with clinical outcomes (p < 0.001).

Utilizing Model Residuals to Identify Rental Properties of Interest: The Price Anomaly Score (PAS) and Its Application to Real-time Data in Manhattan

Understanding whether a property is priced fairly hinders buyers and sellers since they usually do not have an objective viewpoint of the price distribution for the overall market of their interest. Drawing from data collected of all possible available properties for rent in Manhattan as of September 2023, this paper aims to strengthen our understanding of model residuals; specifically on machine learning models which generalize for a majority of the distribution of a well-proportioned dataset. Most models generally perceive deviations from predicted values as mere inaccuracies, however this paper proposes a different vantage point: when generalizing to at least 75% of the dataset, the remaining deviations reveal significant insights. To harness these insights, we introduce the Price Anomaly Score (PAS), a metric capable of capturing boundaries between irregularly predicted prices. By combining relative pricing discrepancies with statistical significance, the Price Anomaly Score (PAS) offers a multifaceted view of rental valuations. This metric allows experts to identify overpriced or underpriced properties within a dataset by aggregating PAS values, then fine-tuning upper and lower boundaries to any threshold to set indicators of choice.

Diagnosis of atrial fibrillation based on AI-detected anomalies of ECG segments

Early detection of atrial fibrillation (AF) is crucial for its effective management and prevention. Various methods for detecting AF using deep learning (DL) based on supervised learning with a large labeled dataset have a remarkable performance. However, supervised learning has several problems, as it is time-consuming for labeling and has a data dependency problem. Moreover, most of the DL methods do not provide any clinical evidence to physicians regarding the analysis of electrocardiography (ECG) for classification or detection of AF. To address these limitations, in this study, we proposed a novel AF diagnosis system using unsupervised learning for anomaly detection with three segments, PreQ, QRS, and PostS, based on the normal ECG. Two independent datasets, PTB-XL and China, were used in three experiments. We used a long short-term memory (LSTM)-based autoencoder to train the segments of the normal ECG. Based on the threshold of anomaly scores using mean squared error (MSE), it distinguished between normal and AF segments. In Experiment A, the best score was that of PreQ, which detected AF with an AUROC score of 0.96. In Experiment B and C for cross validation of each dataset, the best scores were also of PreQ, with AUROC scores of 0.9 and 0.95, respectively. To verify the significance of the anomaly score in distinguishing between AF and normal segments, we utilized an XG-Boosted model after generating anomaly scores in the three segments. The XG-Boosted model achieved an AUROC score of 0.98 and an F1 score of 0.94. AF detection using DL has been controversial among many physicians. However, our study differentiates itself from previous studies in that we can demonstrate evidence that distinguishes AF from normal segments based on the anomaly score.

Anomaly Detection of Axial Piston Pump Based on the DTW-RCK-IF Composite Method Using Pressure Signals

Axial piston pumps are critical components of hydraulic systems due to their compact design and high volumetric efficiency, making them widely used. However, they are prone to failure in harsh environments characterized by high pressure and heavy loads over extended periods. Therefore, detecting abnormal behavior in axial piston pumps is of significant importance. Traditional detection methods often rely on vibration signals from the pump casings; however, these signals are susceptible to external environmental interference. In contrast, pressure signals exhibit greater stability. In this study, we propose a novel anomaly detection method for axial piston pumps, referred to as DTW-RCK-IF, which combines dynamic time warping (DTW) for data segmentation, a random convolutional kernel (RCK) for feature extraction, and isolation forest (IF) for anomaly detection using pressure signals. The model is trained using normal operating data to enable the effective detection of abnormal states. First, the DTW algorithm is employed to segment the raw data, ensuring a high degree of similarity between the segmented data. Next, the random convolutional kernel approach is used in a convolutional neural network for feature extraction, resulting in features that are representative of normal operating conditions. Finally, the isolation forest algorithm calculates the anomaly scores for anomaly detection. Experimental simulations on axial piston pumps demonstrate that, compared with vibration signals, the DTW-RCK-IF approach using pressure signals yields superior results in detecting abnormal data, with an average F1 score of 98.79% and a good fault warning effect. Validation using the publicly available CWRU-bearing and XJTU-SY-bearing full-life datasets further confirms the effectiveness of this method, with average F1 scores of 99.35% and 99.73%, respectively, highlighting its broad applicability and potential for widespread use.

Methodology to Monitor Early Warnings Before Gas Turbine Trip

Abstract The current energy scenario requires that gas turbines (GTs) operate at their maximum efficiency and highest reliability. Trip is one of the most disrupting events that reduces GT availability and increases maintenance costs. To tackle the challenge of GT trip prediction, this paper presents a methodology that has the goal of monitoring the early warnings raised during GT operation and trigger an alert to avoid trip occurrence. The methodology makes use of an auto-encoder (prediction model) and a three-stage criterion (detection procedure). The auto-encoder is first trained to reconstruct safe operation data and subsequently tested on new data collected before trip occurrence. The trip detection criterion checks whether the individually tested data points should be classified as normal or anomalous (first stage), provides a warning if the anomaly score over a given time frame exceeds a threshold (second stage), and, finally, combines consecutive warnings to trigger a trip alert in advance (third stage). The methodology is applied to a real-world case study composed of a collection of trips, of which the causes may be different, gathered from various GTs in operation during several years. Historical observations of gas path measurements taken during three days of GT operation before trip occurrence are employed for the analysis. Once optimally tuned, the methodology provides a trip alert with a reliability equal to 75% at least 10 h in advance before trip occurrence.

Deep Isolation Forest for Anomaly Detection

Isolation forest (iForest) has been emerging as arguably the most popular anomaly detector in recent years due to its general effectiveness across different benchmarks and strong scalability. Nevertheless, its linear axis-parallel isolation method often leads to (i) failure in detecting hard anomalies that are difficult to isolate in high-dimensional/non-linear-separable data space, and (ii) notorious algorithmic bias that assigns unexpectedly lower anomaly scores to artefact regions. These issues contribute to high false negative errors. Several iForest extensions are introduced, but they essentially still employ shallow, linear data partition, restricting their power in isolating true anomalies. Therefore, this paper proposes deep isolation forest. We introduce a new representation scheme that utilises casually initialised neural networks to map original data into random representation ensembles, where random axis-parallel cuts are subsequently applied to perform the data partition. This representation scheme facilitates high freedom of the partition in the original data space (equivalent to non-linear partition on subspaces of varying sizes), encouraging a unique synergy between random representations and random partition-based isolation. Extensive experiments show that our model achieves significant improvement over state-of-the-art isolation-based methods and deep detectors on tabular, graph and time series datasets; our model also inherits desired scalability from iForest.

Anomaly detection and visualization for sound data with pre-trained deep neural networks

Anomaly detection in the industrial domain is a critical issue. Although anomaly detection needs expert's experiences or huge person-hours, recent researches of deep neural networks can save much labor. This paper proposes an anomaly detection method for sound data with pre-trained deep neural networks, and an anomaly visualization method to specify the frequency components of anomalous sounds. Common anomaly detection methods train deep neural networks which can detect anomalies in specific domains. However, training such networks from scratch costs a lot because the neural networks have numerous parameters and use lots of data to improve the performance. To address this problem, anomaly detection using the pre-trained image classification networks has been proposed. This method uses feature representations of classification networks and the Mahalanobis distance as the anomaly scores. In this paper, we propose a method which can apply the above method to sound data and evaluate its performance with a dataset for industrial sound which contains machine sounds under normal and anomalous operating conditions in real factory environments. We also propose a visualization method to specify the frequency components when abnormal sounds occur.

Anomaly detection of aviation data bus based on SAE and IMD

To detect remote terminal (RT) spoofing attacks on MIL-STD-1553B data bus and prevent the network paralysis of integrated avionics system (IAS) caused by misjudgment, an anomaly detection method of aviation data bus based on the combination of sparse autoencoder (SAE) and integrated mahalanobis distance (IMD) is proposed. Aiming at the communication traffic training set with only normal data, an unsupervised learning algorithm SAE is used to train a model that only represents normal behavior. To combine the feature information of each layer within SAE, the IMD, which can measure the similarity between data characteristics, is used to obtain the anomaly score of test data, and the comprehensive anomaly score (CAS) is obtained by considering the reconstruction error between SAE input and output. To solve the problem that data distribution and detection requirements were not considered in a single threshold, a heuristic multi-threshold selection method is proposed, which maximizes the performance of the classifier by considering the accuracy, youden index (YI), and F1. The experimental results demonstrate the effectiveness and feasibility of the method.

Efficient Performance Prediction of End-to-End Autonomous Driving Under Continuous Distribution Shifts Based on Anomaly Detection

A Deep Neural Network (DNN)’s prediction may be unreliable outside of its training distribution despite high levels of accuracy obtained during model training. The DNN may experience different degrees of accuracy degradation for different levels of distribution shifts, hence it is important to predict its performance (accuracy) under distribution shifts. In this paper, we consider the end-to-end approach to autonomous driving of using a DNN to map from an input image to the control action such as the steering angle. For each input image with possible perturbations that cause distribution shifts, we design a Performance Prediction Module to compute its anomaly score, and use it to predict the DNN’s expected prediction error, i.e., its expected deviation from the ground truth (optimal) control action, which is not available after deployment. If the expected prediction error is too large, then the DNN’s prediction may no longer be trusted, and remedial actions should be taken to ensure safety. We consider different methods for computing the anomaly score for the input image, including using the reconstruction error of an Autoencoder, or applying an Anomaly Detection algorithm to a hidden layer of the DNN. We present performance evaluation of the different methods in terms of both prediction accuracy and execution time on different hardware platforms, in order to provide a useful reference for the designer to choose among the different methods.

A Method for Image Anomaly Detection Based on Distillation and Reconstruction.

Image anomaly detection is a trending research topic in computer vision. The objective is to build models using available normal samples to detect various abnormal images without depending on real abnormal samples. It has high research significance and value for applications in the detection of defects in product appearance, medical image analysis, hyperspectral image processing, and other fields. This paper proposes an image anomaly detection algorithm based on feature distillation and an autoencoder structure, which uses the feature distillation structure of a dual-teacher network to train the encoder, thus suppressing the reconstruction of abnormal regions. This system also introduces an attention mechanism to highlight the detection objects, achieving effective detection of different defects in product appearance. In addition, this paper proposes a method for anomaly evaluation based on patch similarity that calculates the difference between the reconstructed image and the input image according to different regions of the image, thus improving the sensitivity and accuracy of the anomaly score. This paper conducts experiments on several datasets, and the results show that the proposed algorithm has superior performance in image anomaly detection. It achieves 98.8% average AUC on the SMDC-DET dataset and 98.9% average AUC on the MVTec-AD dataset.