A Clone Selection Algorithm Optimized Support Vector Machine for AETA Geoacoustic Anomaly Detection

Studies of geoacoustic emission in a seismically active region in Kamchatka show that geoacoustic signals produce pronounced pulse anomalies during the earthquake preparation and post-seismic relaxation of the local stresses field at the observation point. The qualitative selection of such anomalies is complicated by a strong distortion and weakening of the signal amplitude. A review of existing acoustic emission analysis methods shows that most often researchers turn to the analysis of more accessible to study statistical properties and energy of signals. The distinctive features of the approach proposed by the authors are the extraction of informative features based on the analysis of time and frequency-time structures of geoacoustic signals and the description of various forms of recognizable pulses by a limited pattern set. This study opens up new ideas to develop methods for detecting anomalous behavior of geoacoustic signals, including anomalies before earthquakes. The paper describes a technique of information extraction from geoacoustic emission pulse streams of sound frequency range. A geoacoustic pulse mathematical model, reflecting the signal generation process from a variety of elementary sources, is presented. A solution to the problem of detection of geoacoustic signal informative features is presented by the means of description of signal fragments by the matrixes of local extrema amplitude ratios and of interval ratios between them. The result of applying the developed algorithm to describe automatically the structure of the detected pulses and to form a pattern set is shown. The patterns characterize the features of geoacoustic emission signals observed at IKIR FEB RAS field stations. A technique of reduction of the detected pulse set dimensions is presented. It allows us to find patterns similar in structure. A solution to the problem of processing of a large data flow by unifying pulses description and their systematization is proposed. A method to identify a geoacoustic emission pulse model using sparse approximation schemes is suggested. An algorithmic solution of the problem of reducing the computational complexity of the matching pursuit method is described. It is to include an iterative refinement algorithm for the solution at each step in the method. The results of the research allowed the authors to create a tool to investigate the dynamic properties of geoacoustic emission signal in order to develop earthquake prediction detectors.

Increasing availability of industrial systems through data stream mining

This study investigates the impact of assimilating Aircraft Meteorological Data Relay (AMDAR) observations on the prediction of two typhoons, Nesat and Haitang (2017), using the Gridpoint Statistical Interpolation (GSI) assimilation system and the Weather Research and Forecasting (WRF) model. Two quality control (QC) methods, Minimum Covariance Determinant (MCD) and one-class Support Vector Machine (OCSVM), were employed to perform QC on the AMDAR observations before data assimilation. The QC results indicated that both methods significantly reduced kurtosis, skewness, and discrepancies between the AMDAR data and the reanalysis data. The data distribution after applying the MCD-QC method exhibited a closer resemblance to a Gaussian distribution. Four numerical experiments were conducted to assess the impact of different AMDAR data qualities on typhoon forecasting, including a control experiment without data assimilation (EXP-CNTL), assimilating all AMDAR observations (EXP-RAW), assimilating observations after applying MCD-QC (EXP-MCD), and assimilating observations after applying OCSVM-QC (EXP-SVM). The results demonstrated that using AMDAR data in assimilation improved the track and intensity prediction of the typhoons. Furthermore, utilizing QC before assimilation enhanced the performance of track forecasting prediction, with EXP-MCD showing the best performance. As for intensity prediction, the three assimilation experiments exhibited varying strengths and weaknesses at different times, with EXP-MCD showing smaller intensity forecast errors on average.

This paper presents a hybrid unsupervised architecture for anomalous lane-changing behavior recognition. Anomaly detection aims to identify unusual driving behavior caused by either environmental or phycological stimuli, and is of great important in road safety. First, a Recurrent Convolutional Autoencoder (RC-AE) is built to explore the spatial-temporal features derived from the high-dimensional behavior data. Second, Reconstruct Error analysis of the autoencoder and one-class support vector machine method are both applied to identify anomalous lane-changing behavior in the learned feature space by autoencoder. Last, we employ T-Distributed Stochastic Neighbor Embedding (T-SNE) for data visualization in the anomaly detection. Based on the kernel density estimation analysis, anomalous and normal lane-changing sample groups display distinct difference over probability distributions. The findings contribute to a better understanding on drivers' natural lane-changing behavior, and can provide important insight into real-time personalized unusual lane-changing behavior monitoring system development.

Intrusion detection system (IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it is unable to detect unknown attacks, i.e., 0-day attacks, the ultimate challenge in intrusion detection field is how we can exactly identify such an attack by an automated manner. Over the past few years, several studies on solving these problems have been made on anomaly detection using unsupervised learning techniques such as clustering, one-class support vector machine (SVM), etc. Although they enable one to construct intrusion detection models at low cost and effort, and have capability to detect unforeseen attacks, they still have mainly two problems in intrusion detection: a low detection rate and a high false positive rate. In this paper, we propose a new anomaly detection method based on clustering and multiple one-class SVM in order to improve the detection rate while maintaining a low false positive rate. We evaluated our method using KDD Cup 1999 data set. Evaluation results show that our approach outperforms the existing algorithms reported in the literature; especially in detection of unknown attacks.

The identification of encrypted Instant Messaging (IM) channels between users is made difficult by the presence of variable and high levels of uncorrelated background traffic. In this paper, we propose a novel Cross-correlation Outlier Detector (CCOD) to identify communicating end-users in a large group of users. Our technique uses traffic flow traces between individual users and IM service provider's data center. We evaluate the CCOD on a data set of Yahoo! IM traffic traces with an average SNR of −6.11dB (data set includes ground truth). Results show that our technique provides 88% true positives (TP) rate, 3% false positives (FP) rate and 96% ROC area. Performance of the previous correlation-based schemes on the same data set was limited to 63% TP rate, 4% FP rate and 85% ROC area.

Massive amounts of data are created and collected by data acquisition systems, including SCADA and embedded systems in industrial machines.The data may be analysed by AI algorithms to gain a better understanding of the process and identify any irregularities in the machines.This is a major benefit of Industry 4.0.This paper will examine predictive maintenance as a process in industry and demonstrate how it may make full use of technologies from Industry 4.0.Using a weighted average, our method integrates Three Machine Learning models: Auto encoder (AE), One-Class Support Vector Machine (OCSVM), and Local Outlier Factor (LOF).This allows us to discover anomalies in real-time.Anomaly detection will be enhanced as a result.Improve real-time anomaly detection using the suggested hybrid machine-learning ensemble pipeline by combining the outputs of three ML models: auto encoder (AE), one-class support vector machine (OCSVM), and local outlier factor (LOF).

Recorded geoacoustic signals often contain noise and interference. Their appearance is caused by various reasons, e.g. of propagation environment heterogeneity, weather condition influence, human activity, etc. So, geoacoustic emission signals contain a persistent background noise that changes in intensity over time. This noise significantly distorts the geoacoustic pulse waveforms and thus complicates analysis of the signal characteristics. The article presents results of estimating the geoacoustic signal background noise. On the basis of these estimates, a method of adaptive wavelet thresholding is proposed to remove noise from the signal and recovery the single pulse waveforms. In conclusion, the results of a computational experiment are presented. They confirm effectiveness of using the chosen method for the geoacoustic signal preprocessing. The work was carried out as part of the implementation of the state task AAAA-A21-121011290003-0.

BACKGROUND Patient heterogeneity is a key challenge in immunotherapy for IDH-wildtype glioblastoma (GBM), where hypermutated tumors or highly immunosuppressive tumor microenvironments (TME) act as clinical outliers affecting treatment response and trial stratification. We developed Alert-GBM, a radiogenomic AI model designed to flag such outliers based on radiomic signatures from diagnostic imaging. MATERIAL AND METHODS We used multicenter open-access radiogenomic datasets (n = 176) to train unsupervised outlier detection models. Principal Component Analysis (PCA) served as a first-pass filter to harmonize data before applying Isolation Forest (IF) modeling. Three IF models were trained using inter-dataset leave-one-out cross-validation (LOOCV) to simulate real-world performance and were benchmarked against each other. The final model was selected using stratified 10-fold cross-validation (CV). Outliers were validated through visual inspection, statistical profiling, comparison with other outlier detection methods (Local Outlier Factor, One-Class SVM, Mahalanobis distance), and correlation with biological and immune profiles from imaging and omics data. RESULTS The PCA filter identified 3 initial outliers based on MRI metadata. The final IF model, following stratified 10-fold CV, detected 6 outliers across the datasets, with anomaly scores plotted. Flagged cases included large, highly enhancing tumors, minimally enhancing tumors, and post-operative scans. Visualizations using PCA, t-SNE, and UMAP were generated to illustrate separability. False positives and negatives were assessed using immune-based scores, and the distribution of anomaly scores was analyzed with KDE plots. Cross-validation against alternative outlier models confirmed consistency of the flagged cases. CONCLUSION Alert-GBM is a proof-of-concept AI architecture for outlier detection in GBM MRI radiogenomics, capable of flagging cases with atypical immune TME profiles. Integrating such models with radiogenomic immune predictors at the time of diagnosis may support multidisciplinary decision-making and improve patient stratification for immunotherapy trials. Incorporating a human-in-the-loop framework ensures that AI outputs remain clinically interpretable and actionable.

Introduction: Studies that examine the role of rare variants in both simple and complex disease are increasingly common. Though the usual approach of testing rare variants in aggregate sets is more powerful than testing individual variants, it is of interest to identify the variants that are plausible drivers of the association. We present a novel method for prioritization of rare variants after a significant aggregate test by quantifying the influence of the variant on the aggregate test of association. Methods: In addition to providing a measure used to rank variants, we use outlier detection methods to present the computationally efficient Rare Variant Influential Filtering Tool (RIFT) to identify a subset of variants that influence the disease association. We evaluated several outlier detection methods that vary based on the underlying variance measure: interquartile range (Tukey fences), median absolute deviation, and SD. We performed 1,000 simulations for 50 regions of size 3 kb and compared the true and false positive rates. We compared RIFT using the Inner Tukey to 2 existing methods: adaptive combination of p values (ADA) and a Bayesian hierarchical model (BeviMed). Finally, we applied this method to data from our targeted resequencing study in idiopathic pulmonary fibrosis (IPF). Results: All outlier detection methods observed higher sensitivity to detect uncommon variants (0.001 < minor allele frequency, MAF > 0.03) compared to very rare variants (MAF <0.001). For uncommon variants, RIFT had a lower median false positive rate compared to the ADA. ADA and RIFT had significantly higher true positive rates than that observed for BeviMed. When applied to 2 regions found previously associated with IPF including 100 rare variants, we identified 6 polymorphisms with the greatest evidence for influencing the association with IPF. Discussion: In summary, RIFT has a high true positive rate while maintaining a low false positive rate for identifying polymorphisms influencing rare variant association tests. This work provides an approach to obtain greater resolution of the rare variant signals within significant aggregate sets; this information can provide an objective measure to prioritize variants for follow-up experimental studies and insight into the biological pathways involved.

Nowadays, IoT technology has become an essential part of many aspects of life and business. Nevertheless, such widespread application has come at the cost of many security concerns that threaten data privacy and diminish IoT utilization momentum in critical applications such as the smart grid and intelligent transportation systems. To address this challenge, several approaches have been proposed to detect and prevent IoT cyberthreats from materializing. Anomaly detection is one of these approaches that defines the boundaries of legitimate (normal) behavior. Any behavior that falls outside these boundaries is considered anomalous. However, these solutions should have the capability to adapt and adjust to environmental changes that prompt IoT nodal behavioral aberrations, except they only assume that these nodes show the same behavior. This assumption does not hold due to the heterogeneity of IoT nodes and the dynamic nature of an IoT network topology. Furthermore, existing adaptive solutions rely on static (pre-defined) thresholds to control the moment for retraining updates. The cost is heavy for highly dynamic environments like IoT as it leads to an unnecessary higher frequency of retraining. Consequently, the model becomes unstable and adversely affects its accuracy and robustness. This paper addresses these problems by offering an improved Adaptive Anomaly Detection (AAD) methodology that resolves the heterogeneity issues by building local profiles that define normal behavior at each IoT node. The One Class Support Vector Machines (OC-SVM) was used to build these profiles. Then, K-Means clustering was used to build a global profile that represents all network nodes. A Local-Global Ratio-Based (LGR) Anomaly Detection scheme is advanced and was enlisted to control the adaptation process by adjusting the threshold of adaptive functionality dynamically based on the “current” situation to prevent unnecessary retraining. An Ensemble of Deep Belief Networks (EDBN) is developed and used to train the anomaly detection model. Additionally, this study's proposes a new Minimized Redundancy Discriminative Feature Selection (MRD-FS) technique to resolve the issue of redundant features. The MRD-FS experimental evaluation shows detection accuracy higher than those of the related solutions including lower false alarm rates. This validates the efficacy of the proposed model for various IoT applications such as smart grids, smart homes, smart cities and intelligent transportation systems.

In the realm of smart grids, machine learning (ML) detectors—both binary (or supervised) and anomaly (or unsupervised)—have proven effective in detecting electricity theft (ET). However, binary detectors are designed for specific attacks, making their performance unpredictable against new attacks. Anomaly detectors, conversely, are trained on benign data and identify deviations from benign patterns as anomalies, but their performance is highly sensitive to the selected threshold values. Additionally, ML detectors are vulnerable to evasion attacks, where attackers make minimal changes to malicious samples to evade detection. To address these limitations, we introduce a hybrid anomaly detector that combines a Deep Auto-Encoder (DAE) with a One-Class Support Vector Machine (OCSVM). This detector not only enhances classification performance but also mitigates the threshold sensitivity of the DAE. Furthermore, we evaluate the vulnerability of this detector to benchmark evasion attacks. Lastly, we propose an accurate and robust cluster-based DAE+OCSVM ET anomaly detector, trained using Explainable Artificial Intelligence (XAI) explanations generated by the Shapley Additive Explanations (SHAP) method on consumption readings. Our experimental results demonstrate that the proposed XAI-based detector achieves superior classification performance and exhibits enhanced robustness against various evasion attacks, including gradient-based and optimization-based methods, under a black-box threat model.

The rapid growth in the industrial sector has required the development of more productive and reliable machinery, and therefore, leads to complex systems. In this regard, the automatic detection of unknown events in machinery represents a greater challenge, since uncharacterized catastrophic faults can occur. However, the existing methods for anomaly detection present limitations when dealing with highly complex industrial systems. For that purpose, a novel fault diagnosis methodology is developed to face the anomaly detection. An unsupervised anomaly detection framework named deep-autoencoder-compact-clustering one-class support-vector machine (DAECC-OC-SVM) is presented, which aims to incorporate the advantages of automatically learnt representation by deep neural network to improved anomaly detection performance. The method combines the training of a deep-autoencoder with clustering compact model and a one-class support-vector-machine function-based outlier detection method. The addressed methodology is applied on a public rolling bearing faults experimental test bench and on multi-fault experimental test bench. The results show that the proposed methodology it is able to accurately to detect unknown defects, outperforming other state-of-the-art methods.

As the foundation of global communication networks, optical fibers are vulnerable to various disruptive events, including mechanical damage, such as cuts, and malicious physical layer breaches, such as eavesdropping via fiber bending. Traditional monitoring methods often fail to identify subtle or novel anomalies, stimulating the proliferation of Machine Learning (ML) techniques for detection of threats before they cause significant harm. In this paper, we evaluate the performance of Semi-Supervised Learning (SSL) and Unsupervised Learning (USL) approaches for detecting various abnormal events, such as fiber bending and vibrations, by analyzing polarization signatures with minimal reliance on labeled data. We experimentally collect thirteen polarization signatures on three different types of fiber cable and process them using One-Class Support Vector Machine (OCSVM) as an SSL, and Density-Based Spatial Clustering of Applications with Noise (DBSCAN) as a USL algorithm for anomaly detection. We introduce tailored evaluation metrics designed to guide hyper-parameter tuning and capture generalization over different anomaly types, detection consistency, and robustness to false positives, enabling practical deployment of OCSVM and DBSCAN in optical fiber security. Our findings demonstrate DBSCAN as a strong contender to detect previously unseen threats in scenarios where labeled data are not available, despite some variability in performance between different scenarios, with F1 score values between 0.615 and 0.995. In contrast, OCSVM, trained on normal operating conditions, maintains high F1 scores of 0.98 to 0.998, demonstrating accurate detection of complex anomalies in optical networks.

The classification performances of the traditional one-class support vector machine (OCSVM) and its variants are often not satisfying when outliers are complex. To deal with this case, assigning smaller weights to these outliers may alleviate their influence upon the classification boundary and enhance the robustness of OCSVM. In this paper, a novel adaptive-weighted one-class support vector machine (AWOCSVM) is proposed for dealing with the outlier detection problem. The appropriate weights are assigned to training samples by considering both their local densities and distances between them to their center. Experimental results on two synthetic data sets and eight benchmark data sets demonstrate that the proposed AWOCSVM achieves more compact classification boundary and superior performance in comparison with the traditional OCSVM and one related approach.