Normal Training Data Research Articles

Anomaly Detection in Time Series Data

This paper presents a novel unsupervised approach for anomaly detection in marine diesel engines using a Transformer Neural Network based autoencoder (TAE) and residual analysis with Sequential Probability Ratio Test (SPRT) and Sum of Squares of Normalized Residuals (SSNR). This approach adeptly captures temporal dependencies within normal time-series data without the necessity for labeled failure data. To assess the performance of the proposed methodology, a dataset containing faulty data is generated under the same operational profile as the normal training data. The model undergoes training using normal data, after which the faulty data is reconstructed utilizing the trained model. Subsequently, SPRT and SSNR are used to analyze the residuals from the observed and reconstructed faulty data. Significant deviations surpassing a predefined threshold are identified as anomalous behavior. Additionally, this study explores various architectures of Transformer neural networks and other types of neural networks to conduct a comprehensive comparative analysis of the performance of the proposed approach. Insights and recommendations derived from the performance analysis are also presented, offering valuable information for potential users to leverage. The experimental results demonstrate that the proposed approach can accurately and efficiently detect anomalies in marine diesel engines. Therefore, this approach can be considered as a promising solution for early anomaly detection, leading to timely maintenance and repair, and preventing costly downtime. Also, avoid accidents with probability severe consequences.

Information enhanced slow feature analysis integrated with prior fault data for sensitive monitoring of chemical processes

As an effective feature extraction method, slow feature analysis (SFA) has been successfully applied in the domain of chemical process monitoring. However, as an unsupervised method, the basic SFA ignores the key information carried by prior fault data so that many complicated faults cannot be sensitively detected. To address this issue, an enhanced SFA method, termed Information Enhanced SFA (IE-SFA), is proposed by integrating available fault discriminant information to achieve more sensitive detection of complicated chemical process faults. The proposed method builds a primary-auxiliary SFA modeling framework. On the one hand, the normal training data are analyzed to establish the primary SFA model. On the other, prior fault data are integrated to develop an auxiliary monitoring model for providing extra fault-sensitive information. In the auxiliary model, a sample-variable weighted Fisher discriminant analysis method is performed on normal data, fault data, and their respective slow feature components, thereby extracting fault-sensitive features for enhancing the fault detection capability. For full-view fault monitoring, the Bayesian fusion strategy is used to fuse the outcomes from both primary and auxiliary models. The applications on a benchmark Tennessee Eastman chemical process and a three-phase flow process demonstrate that the proposed IE-SFA method provides superior fault detection performance compared to the basic SFA method.

Fast video anomaly detection via context-aware shortcut exploration and abnormal feature distance learning

Surveillance systems are essential in computer vision, with video anomaly detection (VAD) critical for real-world security. Conventional approaches anticipate abnormal frames using normal patterns learned with normal training data and determine anomalies by comparing the output and input. However, they often incur high computational costs due to pre-trained networks and complex modules. Also, they suffer from the tendency to overlook anomalies due to strong generalizing ability. To address these, we propose two innovations: Anomaly Distance Learning (ADL) and Context-Aware Skip Connection (CONASkip), maximizing the distinction between normal and abnormal samples. ADL increases the feature gap by learning to separate normal and abnormal features, while CONASkip selectively connects layers to preserve normal information and differentiate output quality. These methods operate on self-supervised signals, replacing complex and costly modules. Additionally, ADL is excluded during testing, enabling fast inference. Our model achieves 130 frames per second and superior performance on three benchmarks, addressing real-world efficiency challenges.

Field Validation of a Universally Applicable Condition-Based Maintenance System for Mud Pumps

Summary Although mud pumps are considered to be critical rig equipment, their health monitoring currently still relies on infrequent human observation and monitoring. This approach often fails to detect pump damage at an early stage, resulting in nonproductive time (NPT) and increased well construction costs when initial damage progresses and pumps go down unexpectedly and catastrophically. Automated approaches to condition-based maintenance (CBM) of mud pumps to date have failed due to the lack of a generalized solution applicable to any pump type and/or operating conditions. This paper presents a field-validated universally applicable solution to mud pump CBM. The system uses a sensor package that includes acoustic emission sensors and accelerometers in combination with anomaly detection deep learning data analysis to pinpoint any abnormal behavior of the pump and its components. The deep learning models are trained with undamaged normal state data only, and a damage score characterizing the extent of damage to the mud pump is calculated to identify the earliest signs of damage. The system can then generate alerts to notify the rig crew of the damage level of key mud pump components, prompting proactive maintenance actions. Field tests were conducted while drilling an unconventional shale well in west Texas, USA, and a geothermal well in Japan (i.e., two very different drilling operations) to verify the feasibility and general applicability of the developed pump CBM solution. Sensors were attached to pump modules, and data were collected and analyzed using the deep learning models during drilling operations. During the field tests, different hyperparameters and features were compared to select the most effective ones for identifying damage while at the same time delivering low false positive rates (i.e., false alarms during normal state pump operation). The system required only several hours of normal state data for training with no prior pump information. Moreover, it correctly identified the degradation of the pump, swabs, and valves and produced early alerts several hours (in the range of 0.5–17 hours) before actual pump maintenance action was taken by the rig crew. This generally applicable pump CBM system eliminates the environmental, health, and safety concerns that can occur during human-based observations of mud pump health and avoids unnecessary NPT associated with catastrophic pump failures. The final version of this system will be a fully self-contained magnetically attachable box containing sensors and a processor, generating simple indicators for recommending proactive pump maintenance tasks when needed.

Dense Projection for Anomaly Detection

This work presents a novel method called dense projection for unsupervised anomaly detection (DPAD). The main idea is maximizing the local density of (normal) training data and then determining whether a test data is anomalous or not by evaluating its density. Specifically, DPAD uses a deep neural network to learn locally dense representations of normal data. Since density estimation is computationally expensive, we minimize the local distances of the representations in an iteratively reweighting manner, where the weights are updated adaptively and the parameters are regularized to avoid model collapse (all representations collapse to a single point). Compared with many state-of-the-art methods of anomaly detection, our DPAD does not rely on any assumption about the distribution or spatial structure of the normal data and representations. Moreover, we provide theoretical guarantees for the effectiveness of DPAD. The experiments show that our method DPAD is effective not only in traditional one-class classification problems but also in scenarios with complex normal data composed of multiple classes.

Rethinking Reverse Distillation for Multi-Modal Anomaly Detection

In recent years, there has been significant progress in employing color images for anomaly detection in industrial scenarios, but it is insufficient for identifying anomalies that are invisible in RGB images alone. As a supplement, introducing extra modalities such as depth and surface normal maps can be helpful to detect these anomalies. To this end, we present a novel Multi-Modal Reverse Distillation (MMRD) paradigm that consists of a frozen multi-modal teacher encoder to generate distillation targets and a learnable student decoder targeting to restore multi-modal representations from the teacher. Specifically, the teacher extracts complementary visual features from different modalities via a siamese architecture and then parameter-freely fuses these information from multiple levels as the targets of distillation. For the student, it learns modality-related priors from the teacher representations of normal training data and performs interaction between them to form multi-modal representations for target reconstruction. Extensive experiments show that our MMRD outperforms recent state-of-the-art methods on both anomaly detection and localization on MVTec-3D AD and Eyecandies benchmarks. Codes will be available upon acceptance.

An attention graph stacked autoencoder for anomaly detection of electro-mechanical actuator using spatio-temporal multivariate signals

Health monitoring of electro-mechanical actuator (EMA) is critical to ensure the security of airplanes. It is difficult or even impossible to collect enough labeled failure or degradation data from actual EMA. The autoencoder based on reconstruction loss is a popular model that can carry out anomaly detection with only consideration of normal training data, while it fails to capture spatio-temporal information from multivariate time series signals of multiple monitoring sensors. To mine the spatio-temporal information from multivariate time series signals, this paper proposes an attention graph stacked autoencoder for EMA anomaly detection. Firstly, attention graph convolution is introduced into autoencoder to convolve temporal information from neighbor features to current features based on different weight attentions. Secondly, stacked autoencoder is applied to mine spatial information from those new aggregated temporal features. Finally, based on the benchmark reconstruction loss of normal training data, different health thresholds calculated by several statistic indicators can carry out anomaly detection for new testing data. In comparison with traditional stacked autoencoder, the proposed model could obtain higher fault detection rate and lower false alarm rate in EMA anomaly detection experiment.

Targeted Collapse Regularized Autoencoder for Anomaly Detection: Black Hole at the Center.

Autoencoders have been extensively used in the development of recent anomaly detection techniques. The premise of their application is based on the notion that after training the autoencoder on normal training data, anomalous inputs will exhibit a significant reconstruction error. Consequently, this enables a clear differentiation between normal and anomalous samples. In practice, however, it is observed that autoencoders can generalize beyond the normal class and achieve a small reconstruction error on some of the anomalous samples. To improve the performance, various techniques propose additional components and more sophisticated training procedures. In this work, we propose a remarkably straightforward alternative: instead of adding neural network components, involved computations, and cumbersome training, we complement the reconstruction loss with a computationally light term that regulates the norm of representations in the latent space. The simplicity of our approach minimizes the requirement for hyperparameter tuning and customization for new applications which, paired with its permissive data modality constraint, enhances the potential for successful adoption across a broad range of applications. We test the method on various visual and tabular benchmarks and demonstrate that the technique matches and frequently outperforms more complex alternatives. We further demonstrate that implementing this idea in the context of state-of-the-art methods can further improve their performance. We also provide a theoretical analysis and numerical simulations that help demonstrate the underlying process that unfolds during training and how it helps with anomaly detection. This mitigates the black-box nature of autoencoder-based anomaly detection algorithms and offers an avenue for further investigation of advantages, fail cases, and potential new directions.

The role of noise in denoising models for anomaly detection in medical images.

Pathological brain lesions exhibit diverse appearance in brain images, in terms of intensity, texture, shape, size, and location. Comprehensive sets of data and annotations are difficult to acquire. Therefore, unsupervised anomaly detection approaches have been proposed using only normal data for training, with the aim of detecting outlier anomalous voxels at test time. Denoising methods, for instance classical denoising autoencoders (DAEs) and more recently emerging diffusion models, are a promising approach, however naive application of pixelwise noise leads to poor anomaly detection performance. We show that optimization of the spatial resolution and magnitude of the noise improves the performance of different model training regimes, with similar noise parameter adjustments giving good performance for both DAEs and diffusion models. Visual inspection of the reconstructions suggests that the training noise influences the trade-off between the extent of the detail that is reconstructed and the extent of erasure of anomalies, both of which contribute to better anomaly detection performance. We validate our findings on two real-world datasets (tumor detection in brain MRI and hemorrhage/ischemia/tumor detection in brain CT), showing good detection on diverse anomaly appearances. Overall, we find that a DAE trained with coarse noise is a fast and simple method that gives state-of-the-art accuracy. Diffusion models applied to anomaly detection are as yet in their infancy and provide a promising avenue for further research. Code for our DAE model and coarse noise is provided at: https://github.com/AntanasKascenas/DenoisingAE.

A Fine-grained Semi-supervised Anomaly Detection Framework for Predictive Maintenance of Industrial Assets

Reliable operation of industrial assets is of high priority for businesses where productivity determines the ability to deliver safety-critical products of high quality in a timely manner. The aerospace industry leads the demand for predictive maintenance (PdM). In the manufacturing space, unscheduled down time causes production delay and increases operational costs while introducing potential risks in product quality and on-time delivery. In field application of these products, unexpected breakdown of critical components can result in safety-critical events. Failure events are, therefore, extremely rare in industrial settings. Diverse operating conditions in the manufacturing environment and field applications contribute to the heterogeneous nature of data collected from these assets. This work presents an anomaly detection framework for PdM of industrial assets to address the practical challenges of scarce failure data sources and heterogeneous data across assets. We introduce a fine-grained modeling approach that efficiently accounts for individual asset differences in a semi-supervised fashion which requires only normal operation data for model training. The framework is demonstrated with an industrial 4.0 use case. Vibration sensor data from pumps in one of our manufacturing facilities is ingested to enable PdM with 2 weeks lead time using the proposed framework. This transforms unexpected breakdown time to scheduled maintenance, thereby reducing cost of delays and operation interruptions. The systematic implementation of the framework in the case study covers the practical production aspects including data quality evaluation, model training, optimization and daily serving of predictions. Furthermore, implementation challenges and recommendations are discussed based on the end-to-end solution implementation experiences.

Reciprocating compressor health monitoring based on BSInformer with deep convolutional AutoEncoder

A composite model combining deep convolutional autoencoder and balanced sparse sampling Informer (MCA-BSInformer) is proposed to solve the problem that reciprocating compressors are difficult to achieve long-term accurate health monitoring. By introducing the Maximum Mean Discrepancy (MMD) difference term into the deep convolutional autoencoder, the distribution of noise data in the multi-source signal of the compressor become more similar to the distribution of normal training data. Thus, effective low-dimensional features containing spatial information in the data can be obtained to reduce the impact of noise data. In addition, a balanced sparse sampling algorithm is integrated into the Informer model to achieve adaptive sparse sampling. The improved Informer model effectively solves the problem that the model reduces the prediction performance while pursuing efficiency. The experimental results demonstrate that the prediction accuracy of the composite model for the health status of reciprocating compressors is higher than that of other mainstream models.

Unsupervised Anomaly Detection in Marine Diesel Engines using Transformer Neural Networks and Residual Analysis

This paper presents a novel unsupervised approach for detecting anomalies in marine diesel engines using a Transformer Neural Network based autoencoder (TAE) and residual analysis with Sequential Probability Ratio Test (SPRT) and Sum of Squares of Normalized Residuals (SSNR). The proposed method can capture temporal dependencies in normal timeseries data without the need for labeled failure data. To assess the effectiveness of the proposed approach, a dataset of faulty data is generated under the same operational profile as the normal training data. The model is trained using normal data, and the faulty data is reconstructed using the trained model. SPRT and SSNR are then used to analyze the residuals from the observed and reconstructed faulty data, with significant deviations exceeding a predefined threshold being identified as anomalous behavior. The experimental results demonstrate that the proposed approach can accurately and efficiently detect anomalies in marine diesel engines. Therefore, this approach can be considered as a promising solution for early anomaly detection, leading to timely maintenance and repair, and preventing costly downtime.

Leveraging and Refining Image Recognition Technology for Intelligent Logistics Sorting Systems

Obstacles in the realm of target detection, tracking accuracy, real-time performance, and robustness have been identified within the context of intelligent logistics sorting systems, which incorporate image recognition technology. Furthermore, the critical role of detecting anomalous states in augmenting sorting efficiency and curtailing errors is underscored. Image recognition technologies of a conventional nature tend to suffer from limitations in their applicability and robustness. In practical working environments, a paucity of abnormal data from logistics sorting targets is observed, which inhibits the application of supervised learning methods of deep learning. Addressing these challenges, an unsupervised deep learning method is introduced for the detection of anomalous states in logistics sorting targets. This approach reinterprets the detection of logistics sorting targets as an anomaly detection problem and utilizes Variational AutoEncoders (VAE) for modeling the distribution of normal data. This method's dependency rests exclusively on normal data for training, thereby circumventing the need for a substantial quantity of abnormal samples. In practical deployments, the anomalous state of logistics sorting targets is discerned by the method through the computation of similarity and implementation of labeling algorithms, evidencing robustness, generalizability, and adaptability. Overall, this method is presented as an effective solution for the detection of anomalous states within intelligent logistics sorting scenarios, serving to decrease labeling costs, enhance detection accuracy and efficiency, and satisfying the practical requisites of logistics sorting systems for abnormal state detection.

A Novel Adaptive STFT-SFA Based Fault Detection Method for Nonstationary Processes

In the field of fault detection, the nonstationary characteristics caused by external disturbances of wind turbines and other reasons can mask the fault signals, while the inconsistent data distribution between training data and test data due to equipment loss and other reasons can lead to model mismatch problems, both of which can lead to the degradation of fault detection performance. In order to solve the above problems, a novel adaptive fault detection framework is proposed in this work. First, the stationary features of nonstationary variables are extracted based on short-time Fourier analysis, after which the features are combined with the stationary variables. Second, isolation-based anomaly detection using nearest-neighbor ensembles is introduced as monitoring metrics for designing the statistic for the slow feature analysis method. Then, the differences between online normal data and training data are calculated, the model update factor and update strategy are designed, and an adaptive fault detection framework based on short-time Fourier transform-slow feature analysis (STFT-SFA) is proposed. Finally, the effectiveness of the proposed fault detection framework is verified using the Tennessee-Eastman process and actual wind turbine data. The results show that the proposed STFT-SFA method has a 94.0% correct monitoring rate (CMR) for Tennessee Eastman process failures, and the proposed adaptive STFT-SFA method has a 95.6% CMR for wind turbine failures, which are better than other comparative fault detection methods.

Cross Attention Transformers for Multi-modal Unsupervised Whole-Body PET Anomaly Detection

Cancer is a highly heterogeneous condition that can occur almost anywhere in the human body. [<sup>18</sup>F]fluorodeoxyglucose Positron Emission Tomography (<sup>18</sup>F-FDG PET) is a imaging modality commonly used to detect cancer due to its high sensitivity and clear visualisation of the pattern of metabolic activity. Nonetheless, as cancer is highly heterogeneous, it is challenging to train general-purpose discriminative cancer detection models, with data availability and disease complexity often cited as a limiting factor. Unsupervised learning methods, more specifically anomaly detection models, have been suggested as a putative solution. These models learn a healthy representation of tissue and detect cancer by predicting deviations from the healthy norm, which requires models capable of accurately learning long-range interactions between organs, their imaging patterns, and other abstract features with high levels of expressivity. Such characteristics are suitably satisfied by transformers, which have been shown to generate state-of-the-art results in unsupervised anomaly detection by training on normal data. This work expands upon such approaches by introducing multi-modal conditioning of the transformer via cross-attention i.e. supplying anatomical reference information from paired CT images to aid the PET anomaly detection task. Furthermore, we show the importance and impact of codebook sizing within a Vector Quantized Variational Autoencoder, on the ability of the transformer network to fulfill the task of anomaly detection. Using 294 whole-body PET/CT samples containing various cancer types, we show that our anomaly detection method is robust and capable of achieving accurate cancer localization results even in cases where normal training data is unavailable. In addition, we show the efficacy of this approach on out-of-sample data showcasing the generalizability of this approach even with limited training data. Lastly, we propose to combine model uncertainty with a new kernel density estimation approach, and show that it provides clinically and statistically significant improvements in accuracy and robustness, when compared to the classic residual-based anomaly maps. Overall, a superior performance is demonstrated against leading state-of-the-art alternatives, drawing attention to the potential of these approaches.

Privacy-protecting behaviours of risk detection in people with dementia using videos

Background People living with dementia often exhibit behavioural and psychological symptoms of dementia that can put their and others’ safety at risk. Existing video surveillance systems in long-term care facilities can be used to monitor such behaviours of risk to alert the staff to prevent potential injuries or death in some cases. However, these behaviours of risk events are heterogeneous and infrequent in comparison to normal events. Moreover, analysing raw videos can also raise privacy concerns. Purpose In this paper, we present two novel privacy-protecting video-based anomaly detection approaches to detect behaviours of risks in people with dementia. Methods We either extracted body pose information as skeletons or used semantic segmentation masks to replace multiple humans in the scene with their semantic boundaries. Our work differs from most existing approaches for video anomaly detection that focus on appearance-based features, which can put the privacy of a person at risk and is also susceptible to pixel-based noise, including illumination and viewing direction. We used anonymized videos of normal activities to train customized spatio-temporal convolutional autoencoders and identify behaviours of risk as anomalies. Results We showed our results on a real-world study conducted in a dementia care unit with patients with dementia, containing approximately 21 h of normal activities data for training and 9 h of data containing normal and behaviours of risk events for testing. We compared our approaches with the original RGB videos and obtained a similar area under the receiver operating characteristic curve performance of 0.807 for the skeleton-based approach and 0.823 for the segmentation mask-based approach. Conclusions This is one of the first studies to incorporate privacy for the detection of behaviours of risks in people with dementia. Our research opens up new avenues to reduce injuries in long-term care homes, improve the quality of life of residents, and design privacy-aware approaches for people living in the community.

Social Engineering Attack Classifications on Social Media Using Deep燣earning

In defense-in-depth, humans have always been the weakest link in cybersecurity. However, unlike common threats, social engineering poses vulnerabilities not directly quantifiable in penetration testing. Most skilled social engineers trick users into giving up information voluntarily through attacks like phishing and adware. Social Engineering (SE) in social media is structurally similar to regular posts but contains malicious intrinsic meaning within the sentence semantic. In this paper, a novel SE model is trained using a Recurrent Neural Network Long Short Term Memory (RNN-LSTM) to identify well-disguised SE threats in social media posts. We use a custom dataset crawled from hundreds of corporate and personal Facebook posts. First, the social engineering attack detection pipeline (SEAD) is designed to filter out social posts with malicious intents using domain heuristics. Next, each social media post is tokenized into sentences and then analyzed with a sentiment analyzer before being labelled as an anomaly or normal training data. Then, we train an RNN-LSTM model to detect five types of social engineering attacks that potentially contain signs of information gathering. The experimental result showed that the Social Engineering Attack (SEA) model achieves 0.84 in classification precision and 0.81 in recall compared to the ground truth labeled by network experts. The experimental results showed that the semantics and linguistics similarities are an effective indicator for early detection of SEA.

近傍特徴と異常特徴を考慮した事前学習済みモデルによる異常検知

In anomaly detection using deep learning, normal models based on pretrained CNNs using only normal data have become the mainstream. This framework can only use normal data for training and discards valuable information even when abnormal data is available. In addition, PaDiM, one of the representative models in this framework, creates a normal model for each position and thus cannot consider the relationship between each pixel. In this paper, we propose a method to generate a normal model by considering the information of anomalous data and neighborhood information, and achieve an image-level AUROC: 0.984 on MVTec AD.

MANomaly: Mutual adversarial networks for semi-supervised anomaly detection

In network intrusion detection, since the available attack traffic is much less than normal traffic, detecting attacks and intrusions from these unbalanced traffic can be a problem of semi-supervised learning, i.e., finding outliers (anomalies) from a data population that obeys a certain distribution. In this paper, we design a novel network model named the mutual adversarial network (MAN), which has two identical reconstruction autoencoder (RecAE) subnetworks. In training, these two subnetworks use the proposed mutual adversarial training to learn the data distribution of normal traffic samples. In detection, we identify anomalies based on the residual values obtained after different samples are reconstructed by MAN. In addition, we devise a novel method to identify anomalies from anomaly scores named the high anomaly suppression (HAS) determination mechanism, which uses the mean values to suppress the effect of noisy data in the test sample. Then, we construct a novel semi-supervised reconstruction anomaly detection framework named MANomaly by combining MAN with the HAS determination mechanism. Meanwhile, we design three different mutual adversarial training approaches to MANomaly and evaluate them on two publicly available network traffic datasets: NSL-KDD and UNSW-NB15. Experimental results show that our method achieves excellent performance by using only 5% of normal training data.

Anomaly detection model based on few-shot learning and memory modules

Anomaly detection is a key issue in public security. Its accuracy is essential to identify abnormalities and take corresponding actions to ensure the safety of relevant objects, which have a broad application space. The traditional anomaly detection method based on deep learning has too strong generalization ability. At the same time, it lacks recognition ability because it only uses normal data for training. To this end, we propose an anomaly detection model based on few-shot learning, guided by memory modules and trained by a large number of normal samples combined with a small number of observed abnormalities. We introduce memory modules to record normal features, which has the function of updating and reading. When training modules, feature compactness, and separateness loss are utilized, it successfully weakens the strong generalization of CNN and improves the memory module to identify normal samples. Then, based on the few-shot learning approach, we learn a more compact normal data distribution and expand the margin between normal and anomalous events to improve the discriminant ability. Many experimental results demonstrate that our method is practical and feasible, and its performance is better than the existing detection methods.