A Stacking-Based Ensemble Framework for Anomaly Detection in High-Dimensional Data

Anomaly detection is a cornerstone of modern intelligent systems, with critical applications in healthcare, cybersecurity, smart grids, and IoT environments. While traditional machine learning and deep learning models have shown promise in identifying outliers, they often face challenges such as dependence on large labeled datasets, high computational costs, and limited scalability to edge devices or high-dimensional data streams. This study introduces D2H-AD, a novel anomaly detection framework built upon Hyperdimensional Computing (HDC), a brain-inspired paradigm that encodes information using high-dimensional distributed vectors. Unlike prior HDC-based approaches, D2H-AD fuses distance-based similarity and density-aware encoding in a hybrid design, significantly improving anomaly characterization and detection accuracy. Ablation experiments confirm that hyperdimensional encoding alone contributes up to 5.4% higher ROC-AUC compared to applying the same density-distance scoring in the original Euclidean feature space, and D2H-AD consistently outperforms all five published baselines (HDAD, ODHD, One-Class SVM, Isolation Forest, and Autoencoders) across every evaluated dataset. The method is designed to be lightweight, interpretable, and computationally efficient, suggesting strong suitability for deployment in resource-constrained and real-time environments. To validate its effectiveness, we evaluate D2H-AD on five diverse benchmark datasets, comparing its performance against five leading techniques: HDAD, ODHD, One-Class SVM, Isolation Forest, and Autoencoders. Our results show that D2H-AD consistently achieves superior F1 scores and ROC-AUC metrics, demonstrating robustness against class imbalance, noise, and data complexity. Beyond accuracy, D2H-AD offers practical advantages including scalability, minimal memory footprint, and an expected low-latency profile derived from its binary operations and lightweight design. These characteristics are crucial for TinyML and edge AI applications. This work highlights the untapped potential of HDC for high-performance anomaly detection and opens new avenues for secure, interpretable, and energy-efficient AI solutions in dynamic environments such as IoT, embedded systems, and beyond. Additionally, D2H-AD provides feature-level interpretability through hypervector decoding, enabling transparent explanations for safety-critical applications.

Massive amounts of data are created and collected by data acquisition systems, including SCADA and embedded systems in industrial machines.The data may be analysed by AI algorithms to gain a better understanding of the process and identify any irregularities in the machines.This is a major benefit of Industry 4.0.This paper will examine predictive maintenance as a process in industry and demonstrate how it may make full use of technologies from Industry 4.0.Using a weighted average, our method integrates Three Machine Learning models: Auto encoder (AE), One-Class Support Vector Machine (OCSVM), and Local Outlier Factor (LOF).This allows us to discover anomalies in real-time.Anomaly detection will be enhanced as a result.Improve real-time anomaly detection using the suggested hybrid machine-learning ensemble pipeline by combining the outputs of three ML models: auto encoder (AE), one-class support vector machine (OCSVM), and local outlier factor (LOF).

Groundwater monitoring data can be prone to errors and biases due to various factors like borehole and equipment malfunctions, or human mistakes. These inaccuracies can jeopardize the groundwater system, leading to reduced efficiency and potentially causing partial or complete failures in the monitoring system. Traditional anomaly detection methods, which rely on statistical and time-variant techniques, struggle to handle the complex and dynamic nature of anomalies. With advancements in artificial intelligence and the growing need for effective anomaly detection and prevention across different sectors, artificial neural network methods are emerging as capable of identifying more intricate anomalies by considering both temporal and contextual aspects. Nonetheless, there is still a shortage of comprehensive studies on groundwater anomaly detection. The intricate patterns of sequential data from groundwater present numerous challenges, necessitating sophisticated modeling techniques that combine mathematics, statistics, and machine learning for viable solutions. This paper introduces a model designed for high accuracy and efficient computation in detecting anomalies in groundwater monitoring data through a probabilistic approach. We employed the Monte Carlo method and SEAWAT numerical simulation to ascertain the uncertainty in groundwater salinity. Subsequently, a Long Short-Term Memory (LSTM)-Autoencoder model was trained and evaluated, forming the basis of an anomaly detection framework. Each piece of training data was assessed by the LSTM-Autoencoder using the Negative Log Likelihood (NLL) score and a predefined threshold to determine the data's abnormality percentage. The accuracy evaluation of the proposed LSTM-Autoencoder algorithm revealed that this approach achieved commendable performance, with an accuracy of 98.47% in anomaly detection.

This paper proposes a new multi-channel network traffic anomaly detection method combined with the idea of multi-scale decomposition and multi-channel detection theory. It can be learned that anomalies could change the characteristics of traffic data at different scales. Traditional anomaly detection methods usually work on each scale independently thus mainly focused on temporally correlated traffic. With the fully exploration on internal frequency-time correlations within multiple scales, this method first obtained the multi-scale decomposition of original traffic data using Ensemble Empirical Mode Decomposition (EEMD), then it is combined with a multi-channel Generalized Likelihood Ratio Test (GLRT) detector, for anomaly detection and decision-making. It can be verified with experiments that this method performs better than other traditional methods, thus gives a new sight on the anomaly detection with different types of traffic data.

Ensemble models for network anomaly detection are often challenged by class imbalance, a condition known to substantially degrade predictive accuracy. To address this limitation, a novel ensemble learning framework, termed the GMM Selector for Anomaly Detection (GMM-SAD), is proposed. The GMM-SAD framework utilizes Gaussian Mixture Models (GMM) to first estimate the prevalence of anomalies and then dynamically routes data to the most suitable specialized detection model within its architecture. To validate its effectiveness and generalization capabilities, extensive empirical evaluations were conducted on three widely-recognized benchmark datasets: CICIDS2017, UNSW-NB15, and NSL-KDD, under varying degrees of class imbalance. The proposed GMM-SAD model demonstrates robust and consistent performance, achieving an impressive average Area Under the Curve (AUC) of 98.40%, F1-score of 94.16%, and a high Recall of 95.32% across all datasets and imbalance scenarios. These findings confirm that the model significantly enhances network anomaly detection accuracy and robustness, particularly its ability to identify rare instances under challenging imbalanced conditions. This research introduces a highly adaptive technical approach for mitigating class imbalance, demonstrating strong potential for practical deployment in real-time network security monitoring.

Nowadays, IoT technology has become an essential part of many aspects of life and business. Nevertheless, such widespread application has come at the cost of many security concerns that threaten data privacy and diminish IoT utilization momentum in critical applications such as the smart grid and intelligent transportation systems. To address this challenge, several approaches have been proposed to detect and prevent IoT cyberthreats from materializing. Anomaly detection is one of these approaches that defines the boundaries of legitimate (normal) behavior. Any behavior that falls outside these boundaries is considered anomalous. However, these solutions should have the capability to adapt and adjust to environmental changes that prompt IoT nodal behavioral aberrations, except they only assume that these nodes show the same behavior. This assumption does not hold due to the heterogeneity of IoT nodes and the dynamic nature of an IoT network topology. Furthermore, existing adaptive solutions rely on static (pre-defined) thresholds to control the moment for retraining updates. The cost is heavy for highly dynamic environments like IoT as it leads to an unnecessary higher frequency of retraining. Consequently, the model becomes unstable and adversely affects its accuracy and robustness. This paper addresses these problems by offering an improved Adaptive Anomaly Detection (AAD) methodology that resolves the heterogeneity issues by building local profiles that define normal behavior at each IoT node. The One Class Support Vector Machines (OC-SVM) was used to build these profiles. Then, K-Means clustering was used to build a global profile that represents all network nodes. A Local-Global Ratio-Based (LGR) Anomaly Detection scheme is advanced and was enlisted to control the adaptation process by adjusting the threshold of adaptive functionality dynamically based on the “current” situation to prevent unnecessary retraining. An Ensemble of Deep Belief Networks (EDBN) is developed and used to train the anomaly detection model. Additionally, this study's proposes a new Minimized Redundancy Discriminative Feature Selection (MRD-FS) technique to resolve the issue of redundant features. The MRD-FS experimental evaluation shows detection accuracy higher than those of the related solutions including lower false alarm rates. This validates the efficacy of the proposed model for various IoT applications such as smart grids, smart homes, smart cities and intelligent transportation systems.

With the rapid development of sensor technology, the anomaly detection of multi-source time series data becomes more and more important. Traditional anomaly detection methods deal with the temporal and spatial information in the data independently, and fail to make full use of the potential of spatio-temporal information. To address this issue, this paper proposes a novel integration method that combines sensor embeddings and temporal representation networks, effectively exploiting spatio-temporal dynamics. In addition, the graph neural network is introduced to skillfully simulate the complexity of multi-source heterogeneous data. By applying a dual loss function—consisting of a reconstruction loss and a prediction loss—we further improve the accuracy of anomaly detection. This strategy not only promotes the ability to learn normal behavior patterns from historical data, but also significantly improves the predictive ability of the model, making anomaly detection more accurate. Experimental results on four multi-source sensor datasets show that our proposed method performs better than the existing models. In addition, our approach enhances the ability to interpret anomaly detection by analyzing the sensors associated with the detected anomalies.

Nowadays mobile positioning devices, sensor technologies, machine learning methods and cloud computing allow an efficient collection, processing and analysis of dynamic position information (trajectories), which can be used for various applications. Currently, data owners (e.g. vehicle producers or service operators) are reluctant to share data due to data privacy rules or because of the risk of sharing information with competitors, which could jeopardize the data owner's competitive advantage. In this paper, we compare various state-of-the-art anomaly detection methods like one-class support vector machine, isolation forest and bidirectional generative adversarial networks towards the detection of abnormal vehicle trajectories at intersections solving one-class classification problem with unsupervised learning algorithms. The experiments show that the selected models allow to identify anomalies with 98%-99% accuracy for the centralized approach. However, data exists mostly fragmented in form of isolated islands throughout the whole industry. Thus, we focus on a general concept of collaborative learning which provides with an increasing number of partners more accurate anomaly detection models than local models of each partner without exchanging raw data, but only synchronizing model parameters. We propose a federated learning algorithm for an one-class support vector machine model towards the detection of anomalies. The federated collaborative approach allows to construct comparable accuracy with the centralized approach, reduces the local data labeling load and keeps individual data private.

In the realm of smart grids, machine learning (ML) detectors—both binary (or supervised) and anomaly (or unsupervised)—have proven effective in detecting electricity theft (ET). However, binary detectors are designed for specific attacks, making their performance unpredictable against new attacks. Anomaly detectors, conversely, are trained on benign data and identify deviations from benign patterns as anomalies, but their performance is highly sensitive to the selected threshold values. Additionally, ML detectors are vulnerable to evasion attacks, where attackers make minimal changes to malicious samples to evade detection. To address these limitations, we introduce a hybrid anomaly detector that combines a Deep Auto-Encoder (DAE) with a One-Class Support Vector Machine (OCSVM). This detector not only enhances classification performance but also mitigates the threshold sensitivity of the DAE. Furthermore, we evaluate the vulnerability of this detector to benchmark evasion attacks. Lastly, we propose an accurate and robust cluster-based DAE+OCSVM ET anomaly detector, trained using Explainable Artificial Intelligence (XAI) explanations generated by the Shapley Additive Explanations (SHAP) method on consumption readings. Our experimental results demonstrate that the proposed XAI-based detector achieves superior classification performance and exhibits enhanced robustness against various evasion attacks, including gradient-based and optimization-based methods, under a black-box threat model.

The rapid growth in the industrial sector has required the development of more productive and reliable machinery, and therefore, leads to complex systems. In this regard, the automatic detection of unknown events in machinery represents a greater challenge, since uncharacterized catastrophic faults can occur. However, the existing methods for anomaly detection present limitations when dealing with highly complex industrial systems. For that purpose, a novel fault diagnosis methodology is developed to face the anomaly detection. An unsupervised anomaly detection framework named deep-autoencoder-compact-clustering one-class support-vector machine (DAECC-OC-SVM) is presented, which aims to incorporate the advantages of automatically learnt representation by deep neural network to improved anomaly detection performance. The method combines the training of a deep-autoencoder with clustering compact model and a one-class support-vector-machine function-based outlier detection method. The addressed methodology is applied on a public rolling bearing faults experimental test bench and on multi-fault experimental test bench. The results show that the proposed methodology it is able to accurately to detect unknown defects, outperforming other state-of-the-art methods.

Normative representation learning focuses on understanding the typical anatomical distributions from large datasets of medical scans from healthy individuals. Generative Artificial Intelligence (AI) leverages this attribute to synthesize images that accurately reflect these normative patterns. This capability enables the AI allowing them to effectively detect and correct anomalies in new, unseen pathological data without the need for expert labeling. Traditional anomaly detection methods often evaluate the anomaly detection performance, overlooking the crucial role of normative learning. In our analysis, we introduce novel metrics, specifically designed to evaluate this facet in AI models. We apply these metrics across various generative AI frameworks, including advanced diffusion models, and rigorously test them against complex and diverse brain pathologies. In addition, we conduct a large multi-reader study to compare these metrics to experts’ evaluations. Our analysis demonstrates that models proficient in normative learning exhibit exceptional versatility, adeptly detecting a wide range of unseen medical conditions. Our code is available at https://github.com/compai-lab/2024-ncomms-bercea.git.

The classification performances of the traditional one-class support vector machine (OCSVM) and its variants are often not satisfying when outliers are complex. To deal with this case, assigning smaller weights to these outliers may alleviate their influence upon the classification boundary and enhance the robustness of OCSVM. In this paper, a novel adaptive-weighted one-class support vector machine (AWOCSVM) is proposed for dealing with the outlier detection problem. The appropriate weights are assigned to training samples by considering both their local densities and distances between them to their center. Experimental results on two synthetic data sets and eight benchmark data sets demonstrate that the proposed AWOCSVM achieves more compact classification boundary and superior performance in comparison with the traditional OCSVM and one related approach.

System call analysis is based on a behavior-oriented anomaly detection technique, which is well accepted due to its consistent performance. This study compares two popular algorithms long short-term memory (LSTM) sequence to sequence (Seq-Seq), and one-class support vector machines (OCSVM) for anomalous system call sequences detection. The proposed framework monitors running processes to recognize compromised virtual machines in hypervisor-based systems. The evaluated results show the comparative analysis and effectiveness of feature extraction strategies and anomaly detection algorithms based on their high detection accuracy and with a low loss. This study demonstrates a comparative analysis of detecting anomalous behavior in any process using OCSVM and LSTM Seq-Seq algorithms. A bag-of-2-g with PCA feature extraction strategy and LSTM Seq-Seq with a sequence length of five provides higher detection accuracy of 97.2%.

In this paper, we propose a method by engaging the One Class Support Vector Machine (OC-SVM) in the identification of Diffractive Optically Variable Images (DOVIs). OC-SVM, as a special SVM, can solve the problems of high-dimensional data sets and small sample size (SSS) with positive and negative unbalance training data. Image feature matrix is built by extracting image features from texture aspects. OC-SVM can be trained with the high-dimensional matrix directly, and does not have to reduce the dimensionality of feature matrix as the usual methods. The experiment results show the effectiveness of the proposed approach against Linear Discriminant Analysis. Considering time cost and correct classification rate, OC-SVM is suitable for the identification of DOVIs.

Intrusion detection system (IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it is unable to detect unknown attacks, i.e., 0-day attacks, the ultimate challenge in intrusion detection field is how we can exactly identify such an attack by an automated manner. Over the past few years, several studies on solving these problems have been made on anomaly detection using unsupervised learning techniques such as clustering, one-class support vector machine (SVM), etc. Although they enable one to construct intrusion detection models at low cost and effort, and have capability to detect unforeseen attacks, they still have mainly two problems in intrusion detection: a low detection rate and a high false positive rate. In this paper, we propose a new anomaly detection method based on clustering and multiple one-class SVM in order to improve the detection rate while maintaining a low false positive rate. We evaluated our method using KDD Cup 1999 data set. Evaluation results show that our approach outperforms the existing algorithms reported in the literature; especially in detection of unknown attacks.