One-class Classification Research Articles

Overview of Anomaly Detection Techniques across Different Domains: A Systematic Review

An anomaly, defined as something that deviates from what is normal, expected, or usual. It signifies abnormality or an irregularity that stands out from typical behaviours or patterns. Detecting anomalies is significant among numerous sectors due to the reasons of signal potential difficulties or opportunities. For an instance, in retail, detecting anomalies in sales data might prompt for further analysis into operational issues or customer behaviour to reduce losses and capitalize on its trends. Hence, different techniques are used for Anomaly Detection. However, anomaly detection using manual method are measured for time consuming, prone to error and can be tedious process. Therefore, different approaches have been considered for anomaly detection as AI (Artificial Intelligence) methods are efficient, faster, provides high level accuracy by effectively detecting the abnormalities. Owing to these aspects, this paper focuses on compiling different techniques and emphasizes on reviewing all anomaly detection using numerous techniques like ML (Machine Learning) and DL (Deep Learning) classifiers, statistical methods, one-class classification, clustering and density-based models which helps with identifying and comprehending the diversity of detection techniques that are applied in various domains like finance, retail, healthcare and cyber security. Various existing researches on anomaly detection are reviewed in the study. In addition to an overview, certain studies also deals with applications of detection models and future trends are reviewed in precise. Finally, the challenges are identified through the analysis of existing researchers and future recommendations are provided for overcoming the gaps that are intended to create promising work in this area.

Calibrated One-Class Classification for Unsupervised Time Series Anomaly Detection

Calibrated One-Class Classification for Unsupervised Time Series Anomaly Detection

Comprehensive Review of One-Class Classification Approaches for Anomaly Detection

Comprehensive Review of One-Class Classification Approaches for Anomaly Detection

Metabolomic analysis to predict the onset and severity of necrotizing enterocolitis

BackgroundNecrotizing enterocolitis (NEC) is the most devastating gastrointestinal (GI) emergency in preterm neonates. Untargeted metabolomics may allow the identification of biomarkers involved in NEC pathophysiology.MethodsWe conducted a prospective study including preterm infants born at < 34 gestational weeks (GWs) whose urine was longitudinally collected at birth (< 48 h, T0) and at 14 (T1) and 28 days (T2). Neonates were followed for their development of NEC, spontaneous intestinal perforation (SIP), or other GI conditions and compared to those of matched healthy controls. Urine samples were investigated by untargeted metabolomic analysis based on mass-spectrometry.ResultsThirty-five patients with NEC, 5 patients with SIP, 14 patients with other GI diseases and 113 controls were enrolled and selected for metabolomic analysis on the basis of their clinical characteristics and available samples. Considering urine samples at T0, the one-class classification approach was able to correctly classify 16/20 subjects (80%) who developed NEC, 3/3 (100%) who developed SIP and 5/7 subjects (71.4%) with other GI pathologies as not belonging to the control group. Neonates with surgical NEC had higher N-acetylaspartic acid, butyrylcarnitine and propionylcarnitine levels than did those with medical NEC. Considering the time evolution of the urinary metabolome, the NEC and control groups showed differences independently of the time point.ConclusionsThe urinary metabolome is closely associated with the underlying GI disease from birth. Urinary metabolic features characterize NEC patients from healthy controls until 28 days of life. The early urinary metabolome has the potential to predict surgical NEC. Future studies are needed to validate our results.

Adaptive Hypersphere Data Description for few-shot one-class classification

Adaptive Hypersphere Data Description for few-shot one-class classification

An Iterative Method for Unsupervised Robust Anomaly Detection Under Data Contamination.

Most deep anomaly detection models are based on learning normality from datasets due to the difficulty of defining abnormality by its diverse and inconsistent nature. Therefore, it has been a common practice to learn normality under the assumption that anomalous data are absent in a training dataset, which we call normality assumption. However, in practice, the normality assumption is often violated due to the nature of real data distributions that includes anomalous tails, i.e., a contaminated dataset. Thereby, the gap between the assumption and actual training data affects detrimentally in learning of an anomaly detection model. In this work, we propose a learning framework to reduce this gap and achieve better normality representation. Our key idea is to identify sample-wise normality and utilize it as an importance weight, which is updated iteratively during the training. Our framework is designed to be model-agnostic and hyperparameter insensitive so that it applies to a wide range of existing methods without careful parameter tuning. We apply our framework to three different representative approaches of deep anomaly detection that are classified into one-class classification-, probabilistic model-, and reconstruction-based approaches. In addition, we address the importance of a termination condition for iterative methods and propose a termination criterion inspired by the anomaly detection objective. We validate that our framework improves the robustness of the anomaly detection models under different levels of contamination ratios on five anomaly detection benchmark datasets and two image datasets. On various contaminated datasets, our framework improves the performance of three representative anomaly detection methods, measured by area under the ROC curve.

Recurrence analysis of 3D point clouds for the detection of surface anomalies in advanced manufacturing

Due to tool wear, machine malfunction, and other internal and external factors, surface anomalies are widely observed in diverse manufacturing processes, such as machining, stamping, and additive manufacturing. The detection of surface anomalies remains an important challenge for assuring the quality and reliability of manufacturing products. Conventional image-based approaches lack the ability to fully capture the 3-dimensional (3D) morphologies of surface defects, which hinder their applications in defect identification, characterization, and diagnosis. The emerging 3D sensing technologies, such as laser or structured-light scanning, enable the collection of point clouds, which embodies a comprehensive representation of defect-altered surface morphologies in 3D space. However, scanned point cloud data are unstructured and oftentimes contain large numbers of points, which pose significant challenges for the recognition of defective surface patterns. To address the challenges, this study develops a recurrence-based approach for the representation learning of 3D point clouds to detect surface defects in manufactured products. Specifically, with a scanned point cloud, key points are first extracted using a voxel-based sampling strategy, and each key point and its neighboring points form a localized sub-region. Then, a recurrence network is generated through a tailored approach, which considers both the morphology similarity and spatial closeness of sub-regions. For anomaly detection, a tensor-based one-class classification model is further deployed to distinguish abnormal surface patterns from normal ones. The developed methodology is experimentally evaluated through simulation and real-world case studies. Experimental results have demonstrated that the developed methodology outperforms benchmarks, highlighting its efficacy in the detection of surface anomalies.

GAN-based statistical process control for the time series data

The cumulative sum (CUSUM) control chart and the multivariate anomaly detection with the generative adversarial network (MAD-GAN) were compared for monitoring the time series data. However, the control boundaries constructed in terms of the one-class classification with only the normal data for the training phase are inappropriate for the test phase because the normal data and the abnormal data should be classified for the test phase. In this regard, we first propose this GAN-based statistical process control (SPC) framework to compare them in terms of detecting the process mean shift based on the perspective of SPC. Second, we propose the residual MAD-GAN in order to improve the detection performance. Third, we develop the loss function of the MAD-GAN. Finally, we find that the maximum mean discrepancy (MMD) as well as the nash equilibrium is useful for the MAD-GAN. Our experiments demonstrate that the residual MAD-GAN is more effective than the residual CUSUM control chart in terms of the run lengths for the time series data. Therefore, we propose SPC practitioners to consider the residual MAD-GAN for detecting the process mean shift in time series data.

Dissimilarity-Preserving Representation Learning for One-Class Time Series Classification.

We propose to embed time series in a latent space where pairwise Euclidean distances (EDs) between samples are equal to pairwise dissimilarities in the original space, for a given dissimilarity measure. To this end, we use auto-encoder (AE) and encoder-only neural networks to learn elastic dissimilarity measures, e.g., dynamic time warping (DTW), that are central to time series classification (Bagnall et al., 2017). The learned representations are used in the context of one-class classification (Mauceri et al., 2020) on the datasets of UCR/UEA archive (Dau et al., 2019). Using a 1-nearest neighbor (1NN) classifier, we show that learned representations allow classification performance that is close to that of raw data, but in a space of substantially lower dimensionality. This implies substantial and compelling savings in terms of computational and storage requirements for nearest neighbor time series classification.

Double kernel and minimum variance embedded broad learning system based autoencoder for one-class classification

One-class classification methods are often used for anomaly detection in healthcare, quality control in manufacturing, and fraud detection in financial services. Particularly in medical datasets, instances of rare cancers are considerably fewer in comparison to those of healthy individuals. One-class classification methods, which concentrate on learning models using just samples from a specified class, have drawn increasing attention as a solution to this problem. To enhance the model’s ability to capture essential feature information, we propose a novel strategy in this paper. This strategy involves the initial application of double kernel mapping, translating the original features into a new feature space. The autoencoder based on the Broad Learning System is then modified to incorporate the minimum variance so that the model can learn the potential feature information. We validated the effectiveness of our proposed strategy using UCI dataset and concordia digits dataset. To compare the performance with other one-class methods, the average F1 scores and the average G−mean are employed as comparative measures. Based on experimental results, it is evident that DKVBLS-AE not only outperforms but also demonstrates greater stability compared to the existing methods.

Function-Genes and Disease-Genes Prediction Based on Network Embedding and One-Class Classification.

Using genes which have been experimentally-validated for diseases (functions) can develop machine learning methods to predict new disease/function-genes. However, the prediction of both function-genes and disease-genes faces the same problem: there are only certain positive examples, but no negative examples. To solve this problem, we proposed a function/disease-genes prediction algorithm based on network embedding (Variational Graph Auto-Encoders, VGAE) and one-class classification (Fast Minimum Covariance Determinant, Fast-MCD): VGAEMCD. Firstly, we constructed a protein-protein interaction (PPI) network centered on experimentally-validated genes; then VGAE was used to get the embeddings of nodes (genes) in the network; finally, the embeddings were input into the improved deep learning one-class classifier based on Fast-MCD to predict function/disease-genes. VGAEMCD can predict function-gene and disease-gene in a unified way, and only the experimentally-verified genes are needed to provide (no need for expression profile). VGAEMCD outperforms classical one-class classification algorithms in Recall, Precision, F-measure, Specificity, and Accuracy. Further experiments show that seven metrics of VGAEMCD are higher than those of state-of-art function/disease-genes prediction algorithms. The above results indicate that VGAEMCD can well learn the distribution characteristics of positive examples and accurately identify function/disease-genes.

Within-Class Constraint Based Multi-task Autoencoder for One-Class Classification

Autoencoders (AEs) have attracted much attention in one-class classification (OCC) based unsupervised anomaly detection. The AEs aim to learn the unity features on targets without involving anomalies and thus the targets are expected to obtain smaller reconstruction errors than anomalies. However, AE-based OCC algorithms may suffer from the overgeneralization of AE and fail to detect anomalies that have similar distributions to target data. To address these issues, a novel within-class constraint based multi-task AE (WC-MTAE) is proposed in this paper. WC-MTAE consists of two different task: one for reconstruction and the other for the discrimination-based OCC task. In this way, the encoder is compelled by the OCC task to learn the more compact encoded feature distribution for targets when minimizing OCC loss. Meanwhile, the within-class scatter based penalty term is constructed to further regularize the encoded feature distribution. The aforementioned two improvements enable the unsupervised anomaly detection by the compact encoded features, thereby addressing the issue of the overgeneralization in AEs. Comparisons with several state-of-the-art (SOTA) algorithms on several non-image datasets and an image dataset CIFAR10 are provided where the WC-MTAE is conducted on 3 different network structures including the multilayer perception (MLP), LeNet-type convolution network and full convolution neural network. Extensive experiments demonstrate the superior performance of the proposed WC-MTAE. The source code would be available in future.

Mutation-Based Multivariate Time-Series Anomaly Generation on Latent Space with an Attention-Based Variational Recurrent Neural Network for Robust Anomaly Detection in an Industrial Control System

Anomaly detection involves identifying data that deviates from normal patterns. Two primary strategies are used: one-class classification and binary classification. In Industrial Control Systems (ICS), where anomalies can cause significant damage, timely and accurate detection is essential, often requiring analysis of time-series data. One-class classification is commonly used but tends to have a high false alarm rate. To address this, binary classification is explored, which can better differentiate between normal and anomalous data, though it struggles with class imbalance in ICS datasets. This paper proposes a mutation-based technique for generating ICS time-series anomalies. The method maps ICS time-series data into a latent space using a variational recurrent autoencoder, applies mutation operations, and reconstructs the time-series, introducing plausible anomalies that reflect multivariate correlations. Evaluations of ICS datasets show that these synthetic anomalies are visually and statistically credible. Training a binary classifier on data augmented with these anomalies effectively mitigates the class imbalance problem.

Benchmarking the negatives: Effect of negative data generation on the classification of miRNA-mRNA interactions.

MicroRNAs (miRNAs) are small non-coding RNAs that regulate gene expression post-transcriptionally. In animals, this regulation is achieved via base-pairing with partially complementary sequences on mainly 3' UTR region of messenger RNAs (mRNAs). Computational approaches that predict miRNA target interactions (MTIs) facilitate the process of narrowing down potential targets for experimental validation. The availability of new datasets of high-throughput, direct MTIs has led to the development of machine learning (ML) based methods for MTI prediction. To train an ML algorithm, it is beneficial to provide entries from all class labels (i.e., positive and negative). Currently, no high-throughput assays exist for capturing negative examples. Therefore, current ML approaches must rely on either artificially generated or inferred negative examples deduced from experimentally identified positive miRNA-target datasets. Moreover, the lack of uniform standards for generating such data leads to biased results and hampers comparisons between studies. In this comprehensive study, we collected methods for generating negative data for animal miRNA-target interactions and investigated their impact on the classification of true human MTIs. Our study relies on training ML models on a fixed positive dataset in combination with different negative datasets and evaluating their intra- and cross-dataset performance. As a result, we were able to examine each method independently and evaluate ML models' sensitivity to the methodologies utilized in negative data generation. To achieve a deep understanding of the performance results, we analyzed unique features that distinguish between datasets. In addition, we examined whether one-class classification models that utilize solely positive interactions for training are suitable for the task of MTI classification. We demonstrate the importance of negative data in MTI classification, analyze specific methodological characteristics that differentiate negative datasets, and highlight the challenge of ML models generalizing interaction rules from training to testing sets derived from different approaches. This study provides valuable insights into the computational prediction of MTIs that can be further used to establish standards in the field.

X Bot Detection Using One-Class Classification Methods with Isolation Forest Algorithm

X bots pose a significant issue in the social media landscape, with many shared links originating from bot-like accounts. This study introduces the application of the Isolation Forest algorithm, aimed explicitly at identifying anomalies such as bots by analyzing X account details. This study utilizes a dataset that merges data from Botometer with supplementary metrics like ‘average tweets per day’ and ‘account age in days’, contributed by David Martín Gutiérrez. This approach was adopted due to the increasing difficulties accessing the X API. The dataset comprises 37,438 instances, with 25,013 labeled human accounts and 12,425 labeled bot accounts. Pre-processing is performed to remove irrelevant features, and the dataset is split into Training, Validation, and Test sets in a 70:15:15 ratio. The training set undergoes hyperparameter and threshold tuning to identify the best configuration for this specific dataset (n_estimators: 50, contamination: 0.5, bootstrap: True), achieving a training set F1-score of 0.211001. Despite these optimization efforts, the Isolation Forest model's performance remains relatively low. The Test set evaluation yields modest precision, recall, and F1-score values (0.1801, 0.2795, and 0.2190, respectively), with a ROC AUC score of 0.3272. While the Isolation Forest algorithm shows promise in detecting X bots, its performance on this specific dataset is limited. Isolation Forest may not be the most suitable algorithm for this particular bot detection task on this dataset. Future work will explore techniques to enhance the performance of bot detection for a more comprehensive analysis.

SLSG: Industrial image anomaly detection with improved feature embeddings and one-class classification

Industrial image anomaly detection under the setting of one-class classification has significant practical value. However, most existing models face challenges in extracting separable feature representations when performing feature embedding and in constructing compact descriptions of normal features when performing one-class classification. One direct consequence is that most models perform poorly in detecting logical anomalies that violate contextual relationships. Focusing on more effective and comprehensive anomaly detection, we propose a network based on self-supervised learning and self-attentive graph convolution (SLSG). SLSG uses a generative pre-training network to assist the encoder in learning the embedding of normal patterns and the reasoning of positional relationships. Subsequently, we introduce pseudo-prior knowledge of anomalies in SLSG using simulated abnormal samples. By comparing the simulated anomalies, SLSG can better summarize the normal patterns and narrow the hypersphere used for one-class classification. In addition, with the construction of a more general graph structure, SLSG comprehensively models the dense and sparse relationships among the elements in an image, which further strengthens the detection of logical anomalies. Extensive experiments on benchmark datasets show that SLSG achieves superior anomaly detection performance, demonstrating the effectiveness of our method.

ALOC: Attack-Aware by Utilizing the Adversarially Learned One-Class Classifier for SCADA System

ALOC: Attack-Aware by Utilizing the Adversarially Learned One-Class Classifier for SCADA System

Ensemble One-Class Support Vector Machine for Sea Surface Target Detection Based on k-Means Clustering

Sea surface target detection is a key stage in a typical target detection system and directly influences the performance of the whole system. As an effective discriminator, the one-class support vector machine (OCSVM) has been widely used in target detection. In OCSCM, training samples are first mapped to the hypersphere in the kernel space with the Gaussian kernel function, and then, a linear classification hyperplane is constructed in each cluster to separate target samples from other classes of samples. However, when the distribution of the original data is complex, the transformed data in the kernel space may be nonlinearly separable. In this situation, OCSVM cannot classify the data correctly, because only a linear hyperplane is constructed in the kernel space. To solve this problem, a novel one-class classification algorithm, referred to as ensemble one-class support vector machine (En-OCSVM), is proposed in this paper. En-OCSVM is a hybrid model based on k-means clustering and OCSVM. In En-OCSVM, training samples are clustered in the kernel space with the k-means clustering algorithm, while a linear decision hyperplane is constructed in each cluster. With the combination of multiple linear classification hyperplanes, a complex nonlinear classification boundary can be achieved in the kernel space. Moreover, the joint optimization of the k-means clustering model and OCSVM model is realized in the proposed method, which ensures the linear separability of each cluster. The experimental results based on the synthetic dataset, benchmark datasets, IPIX datasets, and SAR real data demonstrate the better performance of our method over other related methods.

Malware Detection for Internet of Things Using One-Class Classification.

The increasing usage of interconnected devices within the Internet of Things (IoT) and Industrial IoT (IIoT) has significantly enhanced efficiency and utility in both personal and industrial settings but also heightened cybersecurity vulnerabilities, particularly through IoT malware. This paper explores the use of one-class classification, a method of unsupervised learning, which is especially suitable for unlabeled data, dynamic environments, and malware detection, which is a form of anomaly detection. We introduce the TF-IDF method for transforming nominal features into numerical formats that avoid information loss and manage dimensionality effectively, which is crucial for enhancing pattern recognition when combined with n-grams. Furthermore, we compare the performance of multi-class vs. one-class classification models, including Isolation Forest and deep autoencoder, that are trained with both benign and malicious NetFlow samples vs. trained exclusively on benign NetFlow samples. We achieve 100% recall with precision rates above 80% and 90% across various test datasets using one-class classification. These models show the adaptability of unsupervised learning, especially one-class classification, to the evolving malware threats in the IoT domain, offering insights into enhancing IoT security frameworks and suggesting directions for future research in this critical area.

DoubleR: Effective XSS attacking reality detection

Cross-site scripting (XSS) attack has been one of the most dangerous attacks in cyberspace security. Traditional methods essentially discover XSS attack by detecting malicious payloads in requests, which is unable to distinguish blind&random scanning with the attacking reality. Moreover, it also brings tens of thousands of worthless security alerts to administrators, as well as unfriendly experience to users. In this paper, we propose DoubleR, a bi-directional framework which detects both Requests and Responses to discover XSS attacking reality. On the basis of conventional detection of malicious requests, DoubleR collects responses from web server and trains a bagging based PU learning model to determine whether the vulnerability is truly triggered. To validate our proposed framework, experiments are performed on 5 popular Web applications with 11 specified CVE recorded vulnerabilities. Results show that DoubleR effectively distinguishes attacking reality from attacking attempts, reduce the worthless security alarms, and at the same time works well on other web attacks of the same type.