Continuous authentication using one-class classifiers and their fusion

The growth of cyber threats and network traffic has highlighted the need for effective methods for detecting anomalies. The purpose of the study was to develop a hybrid model for detecting anomalies in telecommunications networks with increased accuracy based on comparative analysis of uncontrolled algorithms. Four main algorithms were compared: Isolation Forest, Local Outlier Factor (LOF), One-Class Support Vector Machine (SVM), and Elliptic Envelope using simulated network traffic data. Analysis methods included data normalisation using Z-score and Min-Max Scaling to eliminate large-scale differences between traits. An ensemble of 100 decision trees was used to improve the accuracy of anomaly detection. As a result, it was found that Isolation Forest provided the highest accuracy of anomaly detection (F1-Score = 85.8%) and high processing speed (processing time per 10,000 records in 2.5 seconds), which is important for real-world conditions of telecommunications networks with large amounts of data. LOF showed high accuracy in detecting local anomalies, but with greater computational complexity. The one-class SVM algorithm detected global anomalies, but showed lower accuracy for local ones. Elliptic Envelope had limited performance due to the assumption of normal data distribution. Additionally, a comprehensive model was developed that combined the advantages of Isolation Forest, LOF, and Density-Based Spatial Clustering of applications with Noise, which allowed increasing the F1-Score to 88% and exceeding the results of individual models. The hybrid model showed adaptability to multimodal distributions and efficiency in detecting local anomalies. Practical significance lies in improving the accuracy and stability of network security systems and form the basis for adaptive real-time algorithms, which allowed cybersecurity and telecommunications specialists to more effectively monitor and protect networks from threats

A comparative investigation of data-driven approaches based on one-class classifiers for condition monitoring of marine machinery system

Deploying unsupervised anomaly detection systems in heterogeneous smart home environments is hindered by the need for costly, per-site hyperparameter tuning. This paper addresses the critical challenge of hyperparameter transferability for creating zero-tune, plug-and-play security solutions. We systematically evaluate five unsupervised machine learning models [Elliptic Envelope (EE), Isolation Forest (IF), Local Outlier Factor (LoF), One-Class SVM (oSVM), and an Autoencoder (AE)] across five prominent IoT datasets. Using a rigorous dataset-specific hyperparameter tuning approach, we benchmark the performance of transferred configurations against both per-dataset optimization and default settings. Our findings establish a clear performance hierarchy: while dataset-specific tuning remains the gold standard, an intelligent transfer strategy significantly outperforms default configurations. Notably, we identify the IoTID20 dataset as the most effective source. Our quantitative topological analysis supports this, revealing that IoTID20’s high feature space complexity and cluster overlap (evidenced by low Silhouette scores) create a rigorous training environment that produces robust, portable hyperparameters. Furthermore, our analysis reveals a strategic trade-off: Autoencoders and LoF deliver the highest absolute performance, whereas IF offers the most substantial improvement over default settings. This work provides a quantitative framework for dataset-driven initialization, guiding the development of robust, low-maintenance intrusion detection systems.

Continuous authentication systems have been proposed as a promising solution to authenticate users in smartphones in a non-intrusive way. However, current systems have important weaknesses related to the amount of data or time needed to build precise user profiles, together with high rates of false alerts. Voice is a powerful dimension for identifying subjects but its suitability and importance have not been deeply analyzed regarding its inclusion in continuous authentication systems. This work presents the S3 platform, an artificial intelligence-enabled continuous authentication system that combines data from sensors, applications statistics and voice to authenticate users in smartphones. Experiments have tested the relevance of each kind of data, explored different strategies to combine them, and determined how many days of training are needed to obtain good enough profiles. Results showed that voice is much more relevant than sensors and applications statistics when building a precise authenticating system, and the combination of individual models was the best strategy. Finally, the S3 platform reached a good performance with only five days of use available for training the users’ profiles. As an additional contribution, a dataset with 21 volunteers interacting freely with their smartphones for more than sixty days has been created and made available to the community.

Existing continuous authentication proposals tend to have two major drawbacks. First, touch-based smartphone authentication approaches typically require explicit user interactions with the smartphone to collect sufficient touch data. These approaches may provide an attacker the opportunity to steal a victim's sensitive data before the system detects the attacker's intrusion. Likewise, an attacker may disable the continuous authentication scheme itself before detection. Second, sensor-based continuous authentication approaches inherently suffer from high energy consumption due to the constant usage of multiple sensors. In this paper, we present a novel continuous authentication system that collects light sensor data from a user's smartphone and analyzes them to authenticate users using support vector machines. We focus on the possibility of collecting light sensor data from users' smartphones while they are conducting daily behaviors to develop an anomaly detection system.

This paper describes a technique for using time series data to monitor and diagnose faults in production systems. Predictive maintenance is the focus of research in order to assess equipment condition and anticipate potential failures. The method reduces the need for user intervention by combining Automatic Diagnostic Systems (ADS) with continuous monitoring systems to detect equipment failures early on. Three distinct techniques were tested on temperature sensor time series data: Isolation Forest (IF), Local Outlier Factor (LOF), and One-Class Support Vector Machine (OCSVM). Graphs showing how each method distinguished between normal and abnormal sensor behavior were used to evaluate each method’s efficacy in detecting anomalies. According to the results, IF is best used for ongoing monitoring, OCSVM for more thorough anomaly detection, and LOF for distinguished outlier identification. The findings are intended to improve problem detection and maintenance oversight in production systems.

Behavioral finance has emerged as a critical framework for understanding market dynamics beyond traditional rational agent models. This research presents a comprehensive multimodal approach to behavioral finance analysis, integrating market data, macroeconomic indicators, news sentiment, cryptocurrency metrics, Web3 analytics, GitHub development activity, and social sentiment to test five advanced hypotheses regarding behavioral pattern identification and market anomaly detection. The study employs an ultra-comprehensive data pipeline processing 30,400 samples across seven distinct data sources, generating 91 engineered features representing behavioral biases, investment patterns, and market psychology. Advanced machine learning techniques including Principal Component Analysis, t-Distributed Stochastic Neighbor Embedding, Variational Autoencoders, K-Means, Hierarchical Clustering, DBSCAN, Isolation Forest, One-Class SVM, and Elliptic Envelope are applied to identify behavioral structures and detect anomalies. Statistical validation through chi-square tests, ANOVA, Granger causality analysis, and lagged correlation studies demonstrates that three of five hypotheses (60%) achieve statistical significance at p < 0.05. Key findings reveal that behavioral structures exist and correspond to canonical biases (chi-square = 3406.780, p < 0.001), cluster assignments maintain moderate stability across market regimes (Jaccard similarity = 0.300), and sentiment and macroeconomic factors exhibit 65 significant causal relationships with behavioral patterns. However, multimodal data integration does not uniformly improve clustering quality (Silhouette score decrease of 0.116), and cluster-conditioned anomaly detection fails to outperform global methods (F1-score decrease of 0.017). These findings contribute to behavioral finance theory while providing practical applications for investment management, fraud detection, and regulatory compliance.

Behaviour-based continuous authentication systems like those that utilise an individual user's typing rhythm and device usage behaviour patterns have much potential over password-based schemes since they do not require an individual user to memorise passwords. Irrespective of the progress in biometric technologies, many systems are still susceptible to more complex attacks, and the decision between security and usability has been a perennial struggle for researchers and practitioners. This paper offers a powerful continuous authentication system based on AI and behavioural biometrics, enhancing precision and resistance to motivated attacks. By measuring behavioural data (e.g. keystroke dynamics and motion sensor) on a heterogeneous user population and then analyzing it, we trained our machine learning models to verify users in real-time. Based on our results, our performance is better than that of the traditional and static authentication methods, with an accuracy of 97.2 per cent, with the false acceptance rate (FAR) and false rejection rate (FRR) of 1.8 per cent and 2.3 per cent, respectively. Moreover, error analysis depicted significant trends in behaviour changes, which apply to an adaptive security strategy. This is demonstrated as a potential of AI-based behavioural biometrics to support feasible, secure, and user-friendly continuous authentication systems that work in contemporary cybersecurity scenarios. Future improvements will additionally involve enlarging datasets, combining multi-modal behavioural features, and increasing resistance to spoofing and behavioural drift.

Mobile devices can carry large amounts of personal data, but are often left unsecured. PIN locks are inconvenient to use and thus have seen low adoption (33% of users). While biometrics are beginning to be used for mobile device authentication, they are used only for initial unlock. Mobile devices secured with only login authentication are still vulnerable to data theft when in an unlocked state. This paper introduces our work on a face-based continuous authentication system that operates in an unobtrusive manner. We present a methodology for fusing mobile device (unconstrained) face capture with gyroscope, accelerometer, and magnetometer data to correct for camera orientation and, by extension, the orientation of the face image. Experiments demonstrate (i) improvement of face recognition accuracy from face orientation correction, and (ii) efficacy of the prototype continuous authentication system.

Spatiotemporal information on crops and cropping systems can provide useful insights into disease outbreak mechanisms in croplands. In September 2011, a severe outbreak of Maize Lethal Necrosis (MLN) disease was reported in Bomet County, Kenya. We aimed to detect severely MLN-infected fields and discriminate mono, inter, and continuous maize cropping systems. We collected in-situ MLN severity observations and acquired multi-date and multi-sensor data viz., RapidEye (RE), Sentinel-1 (S1), digital elevation model (DEM), and Landsat-8 (L8) imagery. A hierarchical classification approach was used to map the cropping systems and severely MLN-infected fields during the short rainy season (September 2014–February 2015) using the random forest (RF), one-class support vector machine (OCSVM) and biased SVM (BSVM) classifiers. RF showed better performance when a balanced multi-class dataset was available. Both OCSVM and BSVM did not lead to an accurate high severity MLN class separation. Moreover, the BSVM classifier was able to separate the mono and intercropping systems. During the long rainy season (March–August 2015), only maize crop data were available, hence the BSVM as one class classifiers (OCC) was used and maize fields were successfully mapped even with high confusion rate. Furthermore, the distribution of maize intercropping system increased in low rainfall sites, and the continuous cropping system limited to only 31% of total maize cropland.

Huberized one-class support vector machine with truncated loss function in the primal space

This paper studies a specific one-class classification problem where the training data are corrupted by significant outliers. Specifically, we are interested in the one-class support vector machine (OCSVM) approach that normally requires good training data. However, perfect training data are usually hard to obtain in most real-world applications due to the inherent data variability and uncertainty. To address this issue, we propose an OCSVM-based data editing and classification method that can iteratively purify the training data and learn an appropriate classifier from the trimmed training set. The proposed method is compared with a general OCSVM approach trained from two types of bootstrap samples, and applied to the mapping and compliance monitoring tasks for the U.S. Department of Agriculture's Conservation Reserve Program using remotely sensed imagery. Experimental results show that the proposed method outperforms the general OCSVM using bootstrap samples at a lower computational load.

Most working professionals as well as school and college students require very less physical activity and they are mostly seated during most part of the day. Maintaining a good posture while sitting is a step towards avoiding several lifestyle diseases that arise due to decreased physical activity. In this work, posture detection by placing multiple accelerometers on the back of user is presented. Novel use of one-class classification for detecting poor posture is proposed. One-class support vector machine and isolation forest are employed for posture detection. The classifiers are provided unlabeled data containing mostly samples of good posture. During testing, the poor postures, which we be different postures other than that considered as the good posture, are predicted as outliers. The performance of the models is compared quantitatively. The performance of one-class classifiers is also compared with commonly used unsupervised learning algorithm, k-mean clustering. Results are presented for tuning of the considered models and to study the effect of sensor placement. The isolation forest provides the highest accuracy of 99.3% and F1-score of 0.99.

Smartphones have recently seen massive growth in usage and become a repository for many types of personal information. The privacy and security are primary concerns for their usage, where there is a need to provide seamless and continuous authentication systems(CASs) for smartphones. We introduce in this work a proof-of-concept design and a case study for using a biologically-inspired and hardware-friendly CAS. Our proposed design adopts a hybrid Liquid State Machine (LSM) approach to perform automatic features extraction and multi-modal fusion scheme for users' interaction. Our work establishes the design concepts for future on-chip and explains why LSM can be a promising approach for fast, adaptive and reliable hardware CASs. The experimental part reveals our proof-of-concept testing results against the golden standard features. Furthermore, The results indicate a promising future for such design and a potential biologically-inspired CASs.

Accurate energy demand prediction is crucial for efficient grid management and resource optimization, particularly across multiple countries with varying consumption patterns. However, real-world energy demand data often contains outliers that can distort forecasting accuracy. This study evaluates the impact of five outlier detection techniques—Z-Score, density- based spatial clustering of applications with noise (DBSCAN), isolation forest (IF), local outlier factor (LOF), and one-class support vector machine (SVM)—on the performance of three time-series forecasting models: long short-term memory (LSTM) networks, convolutional neural network (CNN) Autoencoders, and LSTM with attention mechanisms. The models are tested using energy demand data from four European countries— Germany, France, Spain, and Italy—derived from real-time consumption records. A comparative analysis based on root mean squared error (RMSE) demonstrates that incorporating outlier detection significantly enhances model robustness, reducing forecasting errors caused by anomalous data. The findings emphasize the importance of selecting appropriate outlier detection strategies to improve the accuracy and reliability of energy demand forecasting. This research provides valuable insights into the trade-offs involved in outlier removal, with implications for policy and operational practices in energy management.