False Detection Rate Research Articles

Unsupervised defect segmentation on denim fabric via local patch prediction and residual fusion

Deep learning-based defect inspection has gained popularity in recent years. The dataset requirements for the supervised learning-based method are currently high, but the types of defects are numerous and difficult to gather. This work proposes a local image reconstruction-based unsupervised fabric defect segmentation method to address this problem. Cyclic structures make up the normal portion of the fabric image, whereas the defects are anomalous and minor in comparison. As a result, the defect will be recreated as a normal texture utilizing the information from its surrounding areas, and the defect information will be preserved in the residual image. By masking the same area with various shapes, different reconstruction outcomes and residual images can be achieved. The signal of the defect will be amplified and the noise will be decreased due to the random distribution when the generated residual pictures are fused, which can effectively identify the defect from the noise and lower the false detection rate. On the denim fabric dataset, the proposed unsupervised method can achieve high precision fabric defect segmentation, with the defect detection rate and detection precision reaching at least 85% and 89%, respectively, with high efficiency (approximately 60 m/min inspection speed), outperforming other fabric defect segmentation methods.

An explainable and interpretable model for attention deficit hyperactivity disorder in children using EEG signals

Background:Attention deficit hyperactivity disorder (ADHD) is a neurodevelopmental disorder that affects a person’s sleep, mood, anxiety, and learning. Early diagnosis and timely medication can help individuals with ADHD perform daily tasks without difficulty. Electroencephalogram (EEG) signals can help neurologists to detect ADHD by examining the changes occurring in it. The EEG signals are complex, non-linear, and non-stationary. It is difficult to find the subtle differences between ADHD and healthy control EEG signals visually. Also, making decisions from existing machine learning (ML) models do not guarantee similar performance (unreliable). Method:The paper explores a combination of variational mode decomposition (VMD), and Hilbert transform (HT) called VMD-HT to extract hidden information from EEG signals. Forty-one statistical parameters extracted from the absolute value of analytical mode functions (AMF) have been classified using the explainable boosted machine (EBM) model. The interpretability of the model is tested using statistical analysis and performance measurement. The importance of the features, channels and brain regions has been identified using the glass-box and black-box approach. The model’s local and global explainability has been visualized using Local Interpretable Model-agnostic Explanations (LIME), SHapley Additive exPlanations (SHAP), Partial Dependence Plot (PDP), and Morris sensitivity. To the best of our knowledge, this is the first work that explores the explainability of the model prediction in ADHD detection, particularly for children. Results:Our results show that the explainable model has provided an accuracy of 99.81%, a sensitivity of 99.78%, 99.84% specificity, an F-1 measure of 99.83%, the precision of 99.87%, a false detection rate of 0.13%, and Mathew’s correlation coefficient, negative predicted value, and critical success index of 99.61%, 99.73%, and 99.66%, respectively in detecting the ADHD automatically with ten-fold cross-validation. The model has provided an area under the curve of 100% while the detection rate of 99.87% and 99.73% has been obtained for ADHD and HC, respectively. Conclusions:The model show that the interpretability and explainability of frontal region is highest compared to pre-frontal, central, parietal, occipital, and temporal regions. Our findings has provided important insight into the developed model which is highly reliable, robust, interpretable, and explainable for the clinicians to detect ADHD in children. Early and rapid ADHD diagnosis using robust explainable technologies may reduce the cost of treatment and lessen the number of patients undergoing lengthy diagnosis procedures.

Embankment crack detection in UAV images based on efficient channel attention U2Net

Rapid and accurate extraction of cracks present on the surface of concrete embankments is an important basis for assessing the structural health of embankments and maintaining structural stability. In this paper, a multimechanism fusion U2Net model is proposed for identifying embankment cracks with complex backgrounds and diverse morphologies. We replaced the normal convolution in RSU with depthwise separable convolution and atrous convolution to build UBlock-AS; added the ECA attention mechanism to the last layer of the sampling stage on UBlock-AS to build a new residual structure RSU-ECA-AS; and combined this residual structure with the U2Net model to build the U2Net-ECA-AS model to achieve automatic learning of crack features. Among them, the atrous convolution can obtain a larger reception field without reducing the resolution; the depthwise separable convolution helps to lighten the model; and the ECA can suppress the interference of each residual block during encoding and decoding, improving the model performance at a very small cost. Compared with the semantic segmentation models commonly used in deep learning, the method improves the accuracy of extracting features at different stages of the crack, reduces the model training cost, speeds up the model convergence and improves the model's interference resistance. Finally, a sliding window is designed to make the method applicable to a large range of UAV image detection, and a connected domain search algorithm is used to reduce the false detection rate. The experiments compare U2Net-ECA-AS with five crack segmentation networks (FCN, SegNet, UNet, ERFNet and DeepCrack), and three different attention mechanisms (CBMA, SE and ECA), to verify the effectiveness of the improved model. The method also obtained an IOU of 80.45% and an F1-score of 88.88% in the experiments on the UAV dike dataset. The experiments demonstrate that the method provides a new solution for embankment crack detection, and the results can provide data support for crack repair.

Automatic Defect Recognition and Localization for Aeroengine Turbine Blades Based on Deep Learning

Radiographic testing is generally used in the quality management of aeroengine turbine blades. Traditional radiographic testing is critically dependent on artificially detecting professional inspectors. Thus, it sometimes tends to be error-prone and time-consuming. In this study, we gave an automatic defect detection method by combining radiographic testing with computer vision. A defect detection algorithm named DBFF-YOLOv4 was introduced for X-ray images of aeroengine turbine blades by employing two backbones to extract hierarchical defect features. In addition, a new concatenation form containing all feature maps was developed which play an important role in the present defect detection framework. Finally, a defect detection and recognition system was established for testing and output of complete turbine blade X-ray images. Meanwhile, nine cropping cycles for one defect, flipping, brightness increasing and decreasing were applied for expansion of training samples and data augmentation. The results found that this defect detection system can obtain a recall rate of 91.87%, a precision rate of 96.7%, and a false detection rate of 7% within the score threshold of 0.5. It was proven that cropping nine times and data augmentation are extremely helpful in improving detection accuracy. This study provides a new way of automatic radiographic testing for turbine blades.

A YOLOX-Based Automatic Monitoring Approach of Broken Wires in Prestressed Concrete Cylinder Pipe Using Fiber-Optic Distributed Acoustic Sensors.

Wire breakage is a major factor in the failure of prestressed concrete cylinder pipes (PCCP). In the presented work, an automatic monitoring approach of broken wires in PCCP using fiber-optic distributed acoustic sensors (DAS) is investigated. The study designs a 1:1 prototype wire break monitoring experiment using a DN4000 mm PCCP buried underground in a simulated test environment. The test combines the collected wire break signals with the previously collected noise signals in the operating pipe and transforms them into a spectrogram as the wire break signal dataset. A deep learning-based target detection algorithm is developed to detect the occurrence of wire break events by extracting the spectrogram image features of wire break signals in the dataset. The results show that the recall, precision, F1 score, and false detection rate of the pruned model reach 100%, 100%, 1, and 0%, respectively; the video detection frame rate reaches 35 fps and the model size is only 732 KB. It can be seen that this method greatly simplifies the model without loss of precision, providing an effective method for the identification of PCCP wire break signals, while the lightweight model is more conducive to the embedded deployment of a PCCP wire break monitoring system.

DOIDS: An Intrusion Detection Scheme Based on DBSCAN for Opportunistic Routing in Underwater Wireless Sensor Networks.

In Underwater Wireless Sensor Networks (UWSNs), data should be transmitted to data centers reliably and efficiently. However, due to the harsh channel conditions, reliable data transmission is a challenge for large-scale UWSNs. Thus, opportunistic routing (OR) protocols with high reliability, strong robustness, low end-to-end delay, and high energy efficiency are widely applied. However, OR in UWSNs is vulnerable to routing attacks. For example, sinkhole attack nodes can attract traffic from surrounding nodes by forging information such as the distance to the sink node. In order to reduce the negative impact of malicious nodes on data transmission, we propose an intrusion detection scheme (IDS) based on the Density-Based Spatial Clustering of Applications with Noise (DBSCAN) clustering algorithm for OR (DOIDS) in this paper. DOIDS is based on small-sample IDS and is suitable for UWSNs with sparse node deployment. In DOIDS, the local monitoring mechanism is adopted. Every node in the network running DOIDS can select the trusted next hop. Firstly, according to the behavior characteristics of common routing attack nodes and unreliable underwater acoustic channel characteristics, DOIDS selected the energy consumption, forwarding, and link quality information of candidate nodes as the detection feature values. Then, the collected feature information is used to detect potential abnormal nodes through the DBSCAN clustering algorithm. Finally, a decision function is defined according to the time decay function to reduce the false detection rate of DOIDS. It makes a final judgment on whether the potential abnormal node is malicious. The simulation results show that the algorithm can effectively improve the detection accuracy rate (3% to 15% for different scenarios) and reduce the false positive rate, respectively.

Low-False-Alarm-Rate Timing and Duration Estimation of Noisy Frequency Agile Signal by Image Homogeneous Detection and Morphological Signature Matching Schemes.

Frequency hopping spread spectrum (FHSS) applies widely to communication and radar systems to ensure communication information and channel signal quality by tuning frequency within a wide frequency range in a random sequence. An efficient signal processing scheme to resolve the timing and duration signature from an FHSS signal provides crucial information for signal detection and radio band management purposes. In this research, hopping time was first identified by a two-dimensional temporal correlation function (TCF). The timing information was shown at TCF phase discontinuities. To enhance and resolve the timing signature of TCF in a noisy environment, three stages of signature enhancement and morphological matching processes were applied: first, computing the TCF of the FHSS signal and enhancing discontinuities via wavelet transform; second, a dual-diagonal edge finding scheme to extract the timing pattern signature and eliminate mismatching distortion morphologically; finally, Hough transform resolved the agile frequency timing from purified line segments. A grand-scale Monte Carlo simulation of the FHSS signals with additive white Gaussian noise was carried out in the research. The results demonstrated reliable hopping time estimation obtained in SNR at 0 dB and above, with a minimal false detection rate of 1.79%, while the prior related research had an unattended false detection rate of up to 35.29% in such a noisy environment.

KPE-YOLOv5: An Improved Small Target Detection Algorithm Based on YOLOv5

At present, the existing methods have many limitations in small target detection, such as low accuracy, a high rate of false detection, and missed detection. This paper proposes the KPE-YOLOv5 algorithm aiming to improve the ability of small target detection. The algorithm has three improvements based on the YOLOv5 algorithm. Firstly, it achieves more accurate size of anchor-boxes for small targets by K-means++ clustering technology. Secondly, the scSE (spatial and channel compression and excitation) attention module is integrated into the new algorithm to encourage the backbone network to pay greater attention to the feature information of small targets. Finally, the capability of small target feature extraction is improved by increasing the small target detection layer, which also increases the detection accuracy of small targets. We evaluate KPE-YOLOv5 on the VisDrone-2020 dataset and compare performance with YOLOv5. The results show that KPE-YOLOv5 improves the detection mAP by 5.3% and increases the P by 7%. The KPE-YOLOv5 algorithm has better detection outcome than YOLOv5 for small target detection.

Canine detection of chronic wasting disease (CWD) in laboratory and field settings

ABSTRACT Chronic wasting disease (CWD) is a fatal transmissible spongiform encephalopathy that affects both free-ranging and farmed cervid species, including mule deer, white-tailed deer, and elk (Odocoileus hemionus, Odocoileus virginianus, and Cervus canadensis). Due to the long incubation period and variability of clinical signs, CWD can expand and spread to new areas before they reach diagnostically detectable levels. Antemortem testing methods currently available can be difficult to obtain and to be applied to the large numbers required for adequate surveillance. However, key volatile biomarkers could be harnessed for non-invasive antemortem surveillance. Detection dogs are the most effective tool currently available for volatile detection; dogs can effectively complete wildlife surveys at rates surpassing that of humans. This study is the first to demonstrate that trained detection dogs can be used as an antemortem test for CWD. First, we trained three dogs to differentiate between CWD-positive and CWD-negative white-tailed deer faeces in a laboratory setting. Dogs spent significantly more time at the positive sample than the negative samples, suggesting that they differentiated between the positive and negative volatile signatures. We then trained the same dogs to search for CWD-positive faecal samples in a more naturalistic field setting. In the field, dogs found 8/11 CWD-positive samples and had an average false detection rate of 13%. These results suggest that dogs can be trained to differentiate CWD-positive faeces from CWD-negative faeces in both laboratory and field settings. Future studies will compare canine accuracy to other antemortem methods, as well as improved canine training methods.

Recognition and Detection of Persimmon in a Natural Environment Based on an Improved YOLOv5 Model

Accurate and rapid recognition of fruit is the guarantee of intelligent persimmon picking. Given the changes in the light and occlusion conditions in a natural environment, this study developed a detection method based on the improved YOLOv5 model. This approach has several critical steps, including optimizing the loss function based on the traditional YOLOv5, combining the centralized feature pyramid (CFP), integrating the convolutional block attention module (CBAM), and adding a small target detection layer. Images of ripe and unripe persimmons were collected from fruit trees. These images were preprocessed to enhance the contrast, and they were then extended by means of image enhancement to increase the robustness of the network. To test the proposed method, several experiments, including detection and comparative experiments, were conducted. From the detection experiments, persimmons in a natural environment could be detected successfully using the proposed model, with the accuracy rate reaching 92.69%, the recall rate reaching 94.05%, and the average accuracy rate reaching 95.53%. Furthermore, from the comparison experiments, the proposed model performed better than the traditional YOLOv5 and single-shot multibox detector (SSD) models, improving the detection accuracy while reducing the leak detection and false detection rate. These findings provide some references for the automatic picking of persimmons.

Deep Learning-Assisted Droplet Digital PCR for Quantitative Detection of Human Coronavirus.

Since coronavirus disease 2019 (COVID-19) pandemic rapidly spread worldwide, there is an urgent demand for accurate and suitable nucleic acid detection technology. Although the conventional threshold-based algorithms have been used for processing images of droplet digital polymerase chain reaction (ddPCR), there are still challenges from noise and irregular size of droplets. Here, we present a combined method of the mask region convolutional neural network (Mask R-CNN)-based image detection algorithm and Gaussian mixture model (GMM)-based thresholding algorithm. This novel approach significantly reduces false detection rate and achieves highly accurate prediction model in a ddPCR image processing. We demonstrated that how deep learning improved the overall performance in a ddPCR image processing. Therefore, our study could be a promising method in nucleic acid detection technology.

Adaptive Remote Sensing Paradigm for Real-Time Alerting of Convulsive Epileptic Seizures

Epilepsy is a debilitating neurological condition characterized by intermittent paroxysmal states called fits or seizures. Especially, the major motor seizures of a convulsive nature, such as tonic-clonic seizures, can cause aggravating consequences. Timely alerting for these convulsive epileptic states can therefore prevent numerous complications, during, or following the fit. Based on our previous research, a non-contact method using automated video camera observation and optical flow analysis underwent field trials in clinical settings. Here, we propose a novel adaptive learning paradigm for optimization of the seizure detection algorithm in each individual application. The main objective of the study was to minimize the false detection rate while avoiding undetected seizures. The system continuously updated detection parameters retrospectively using the data from the generated alerts. The system can be used under supervision or, alternatively, through autonomous validation of the alerts. In the latter case, the system achieved self-adaptive, unsupervised learning functionality. The method showed improvement of the detector performance due to the learning algorithm. This functionality provided a personalized seizure alerting device that adapted to the specific patient and environment. The system can operate in a fully automated mode, still allowing human observer to monitor and override the decision process while the algorithm provides suggestions as an expert system.

Unsupervised Detection and Clustering of Malicious TLS Flows

Malware abuses TLS to encrypt its malicious traffic, preventing examination by content signatures and deep packet inspection. Network detection of malicious TLS flows is important, but it is a challenging problem. Prior works have proposed supervised machine learning detectors using TLS features. However, by trying to represent all malicious traffic, supervised binary detectors produce models that are too loose, thus introducing errors. Furthermore, they do not distinguish flows generated by different malware. On the other hand, supervised multiclass detectors produce tighter models and can classify flows by the malware family but require family labels, which are not available for many samples. To address these limitations, this work proposes a novel unsupervised approach to detect and cluster malicious TLS flows. Our approach takes input network traces from sandboxes. It clusters similar TLS flows using 90 features that capture properties of the TLS client, TLS server, certificate, and encrypted payload and uses the clusters to build an unsupervised detector that can assign a malicious flow to the cluster it belongs to, or determine if it is benign. We evaluate our approach using 972K traces from a commercial sandbox and 35M TLS flows from a research network. Our clustering shows very high precision and recall with an F1 score of 0.993. We compare our unsupervised detector with two state-of-the-art approaches, showing that it outperforms both. The false detection rate of our detector is 0.032% measured over four months of traffic.

LES-YOLO: A lightweight pinecone detection algorithm based on improved YOLOv4-Tiny network

Pinecones are an important forest product that are often harvested manually. Automated pinecone detection and harvesting might increase the yield and resolve the problem of labor shortage. The quick and accurate detection of pinecones is one of the most critical technologies for ground picking equipment and very significant for reducing the leakage rate and increasing the yield. Currently, most solutions use deep learning to achieve pinecone recognition. However, deep learning has poor detection effect for small targets, large parameters, and slow operation speed; thus, there is scope for improving the pinecone recognition task. This study proposes a lightweight pinecone detection algorithm based on an improved You Only Look Once version 4 tiny (YOLOv4-Tiny) algorithm. A lightweight Enhance ShuffleNet is used as a backbone to extract the pinecone features. A squeeze-and-excitation feature pyramid network is used to fuse multi-scale information, retaining only a 26 × 26 detection head for pinecone prediction. In addition, focal loss and α-complete intersection over union loss are used to reduce undetected and false detection rates. Data augmentation is used to improve the generalization of the algorithm, and channel compression reduces the number of model parameters. The average precision of the improved network reaches 95.33%, which is an increase of 3.56% compared with the original YOLOv4-Tiny network. Additionally, the parameters, floating point operations, and detection time of one picture are compressed to 12.22%, 17.35%, and 67.41% of the original network, respectively. Comparative experiments were conducted using the proposed method and common target- detection algorithms. The findings show that the average precision of the proposed method is higher than the corresponding values of the YOLOv4, YOLOv5x, YOLOv5s, and YOLOX-Tiny algorithms (95.17%, 95.27%, 92.10%, and 90.47%, respectively), with parameters decreasing to 1.13%, 0.83%, 10.20%, and 14.34%, respectively. The proposed algorithm detects 135 pictures per second to achieve real-time effects. Further, it can distinguish pinecones quickly and accurately in a near-color background and provide a more precise and lightweight solution for pickup and acquisition equipment. In addition, the design process of the proposed algorithm could be a reference for neural network design for agricultural applications.

The WSN intrusion detection method based on deep data mining

ABSTRACT Aiming at the defects that wireless sensor network is vulnerable to intrusion attacks and affects communication performance, a WSN intrusion detection method based on deep data mining is presented. The network traffic capture tool is used to capture the data stream of the wireless sensor network, and the captured data stream is cleaned and normalized. An improved deep sparse autoencoder is used to extract WSN intrusion features from the normalized data stream. The extracted intrusion features are taken as the initial data of K-means clustering, to optimize the k-means clustering algorithm (KMCA) by genetic algorithm. The reasonable initial center point searched by the genetic algorithm is taken as the input parameter of the improved KMCA. The proposed method can detect internal attacks, external attacks and other intrusion behaviors in wireless sensor networks, and the false detection rate is less than 1%.

Tackling imbalanced data in cybersecurity with transfer learning: a case with ROP payload detection

In recent years, deep learning gained proliferating popularity in the cybersecurity application domain, since when being compared to traditional machine learning methods, it usually involves less human efforts, produces better results, and provides better generalizability. However, the imbalanced data issue is very common in cybersecurity, which can substantially deteriorate the performance of the deep learning models. This paper introduces a transfer learning based method to tackle the imbalanced data issue in cybersecurity using return-oriented programming payload detection as a case study. We achieved 0.0290 average false positive rate, 0.9705 average F1 score and 0.9521 average detection rate on 3 different target domain programs using 2 different source domain programs, with 0 benign training data sample in the target domain. The performance improvement compared to the baseline is a trade-off between false positive rate and detection rate. Using our approach, the total number of false positives is reduced by 23.16%, and as a trade-off, the number of detected malicious samples decreases by 0.68%.

Flooding attack mitigator for in-vehicle CAN using fault confinement in CAN protocol

For driver convenience and safety, a number of electronic control units (ECUs) have been installed on modern vehicles. To support communications among ECUs, the controller area network (CAN) is commonly used as in-vehicle network for several decades. However, the CAN protocol lacks security mechanisms, which means that it can be damaged by a number of cyber attacks. In particular, message flooding is one type of DoS attack known to be the easiest to perform because it continuously broadcasts a large number of CAN messages to the in-vehicle CAN without any CAN traffic analysis. To handle message flooding on the in-vehicle CAN, several countermeasures including intrusion detection and prevention have been studied, but unfortunately, these solutions could produce false positive detection rates or cause the communication failures of benign ECUs. In this paper, we introduce a message flooding attack mitigation method for the first time that does not accidentally cause the communication failures of benign ECUs. The proposed method can mitigate flooding attack attempts by using the fault confinement rule that is defined in the CAN protocol. Since the proposed method does not violate the rules of the CAN standard during mitigating, no system modifications are required. Experimental results show that the proposed mitigator guarantees a transmission rate up to 79.22% of normal messages that were not sent due to a flooding attack.

Dual-Modal Information Bottleneck Network for Seizure Detection.

In recent years, deep learning has shown very competitive performance in seizure detection. However, most of the currently used methods either convert electroencephalogram (EEG) signals into spectral images and employ 2D-CNNs, or split the one-dimensional (1D) features of EEG signals into many segments and employ 1D-CNNs. Moreover, these investigations are further constrained by the absence of consideration for temporal links between time series segments or spectrogram images. Therefore, we propose a Dual-Modal Information Bottleneck (Dual-modal IB) network for EEG seizure detection. The network extracts EEG features from both time series and spectrogram dimensions, allowing information from different modalities to pass through the Dual-modal IB, requiring the model to gather and condense the most pertinent information in each modality and only share what is necessary. Specifically, we make full use of the information shared between the two modality representations to obtain key information for seizure detection and to remove irrelevant feature between the two modalities. In addition, to explore the intrinsic temporal dependencies, we further introduce a bidirectional long-short-term memory (BiLSTM) for Dual-modal IB model, which is used to model the temporal relationships between the information after each modality is extracted by convolutional neural network (CNN). For CHB-MIT dataset, the proposed framework can achieve an average segment-based sensitivity of 97.42%, specificity of 99.32%, accuracy of 98.29%, and an average event-based sensitivity of 96.02%, false detection rate (FDR) of 0.70/h. We release our code at https://github.com/LLLL1021/Dual-modal-IB.

FMDADM: A Multi-Layer DDoS Attack Detection and Mitigation Framework Using Machine Learning for Stateful SDN-Based IoT Networks

The absence of standards and the diverse nature of the Internet of Things (IoT) have made security and privacy concerns more acute. Attacks such as distributed denial of service (DDoS) are becoming increasingly widespread in IoT, and the need for ways to stop them is growing. The use of newly formed Software-Defined Networking (SDN) significantly lowers the computational burden on IoT network nodes and makes it possible to perform more security measurements. This paper proposes an SDN-based, four-module DDoS attack detection and mitigation framework for IoT networks called FMDADM. The proposed FMDADM framework comprises four main modules and five-tier architecture. The first module implements an early detection process based on the average drop rate (ADR) principle using a 32-packet window size. The second module uses a novel double-check mapping function (DCMF), that aids in earlier attack detection at the data plane level. The third module is an ML-based detection application comprising four phases: data preprocessing, feature extraction, training and testing, and classification. This module detects DDoS attacks using only seven features: two selected and five newly computed features. The last module introduces an attack mitigation process. We applied the proposed framework to three test cases: one single-node attack test case and two multi-node attack test cases, all with real IoT traffic generated and deployed in Mininet-IoT. The proposed FMDADM framework efficiently detects DDoS attacks at high and low rates, can discriminate between attack traffic and flash crowds, and protects both local and remote IoT nodes by preventing infection from propagating to the ISP level. The FMDADM outperformed most existing cutting-edge approaches across ten different evaluation criteria. According to the experimental results, FMDADM achieved the following accuracy, precision, F-measure, recall, specificity, negative predictive value, false positive rate, false detection rate, false negative rate, and average detection time benchmarks:- 99.79%, 99.43%, 99.77%, 99.79%, 99.95%, 00.21%, 00.91%, 00.23%, and 2.64 μs, respectively.

Design of Attack Detector Based on Maximum Likelihood Estimation Using Data-Driven System Representation

This paper addresses data-driven attack detectors based on maximum likelihood estimation for cyber-physical systems. In the proposed method, input-output trajectories of the systems are optimally estimated by pre-experimental data and real-time measurements in the meaning of maximum likelihood. The proposed attack detector detects the existence of the attack compared with the estimated trajectories and measured ones. The theoretical contributions of this paper are that; the fundamental limitation is shown as the set of undetectable attacks if disturbances can be ignored; the performance of the proposed detector is guaranteed as the false detection rate if some disturbance exists in the system.