Correlation-Based Anomaly Detection Method for Multi-sensor System.

The classification of multidimensional time series holds significant importance across various domains, including action classification, medical diagnosis, and credit assessment. Within multidimensional time series data, features pertinent to classification exhibit variance in their positional distribution along the entirety of the sequence. Moreover, the relative significance of features across distinct dimensions also fluctuates, contributing to suboptimal performance in multidimensional time series classification. Consequently, the proposition of tailored deep learning models for feature extraction specific to multidimensional time series data becomes imperative. This paper introduces attention mechanisms applied to the temporal dimension, graph attention mechanisms for inter-dimensional relationships within multidimensional data, and attention mechanisms applied between channels post-convolutional calculations. These mechanisms are deployed for feature extraction across temporal, variational, and channel dimensions of multidimensional time series data, respectively. Furthermore, attention is directed towards inter-channel interactions within the squeeze-and-excitation network to enhance the model’s representational capacity. Experimental findings substantiate the viability of integrating attention mechanisms into multidimensional time series classification endeavors.

A large amount of work has been done on the KDD 99 dataset, most of which include the use of a hybrid anomaly and misuse detection model done in parallel with each other. In order to further classify the intrusions, our approach to network intrusion detection includes the use of two different anomaly detection models followed by misuse detection applied to the combined output obtained from the previous step. The end goal of this is to verify the anomalies detected by the anomaly detection algorithm and clarify whether they are actually intrusions or random outliers from the trained normal (and thus to try and reduce the number of false positives). We aim to detect a pattern in this novel intrusion technique itself, and not the handling of such intrusions. The intrusions were detected to a very high degree of accuracy.

In response to the high accident rate associated with large-scale UAV deployment, the prediction-based anomaly detection method has emerged as an important research field. This method uses airborne sensor data to predict the expected operational status of UAVs to determine whether their actual status deviates from normal. However, when the anomaly detection model is exposed to diverse flight conditions and missions, continuously changing sensor data characteristics may lead to model mismatch, resulting in reduced detection accuracy. Therefore, this paper proposes a similarity augmented incremental learning-based flight data anomaly detection method for UAV dynamic conditions. The core goal of this method is to maintain the accuracy of anomaly detection in new conditions while preventing issues related to model mismatch. Firstly, an LSTM-based anomaly detection model and the feature buffer are established using historical sensor data. The feature buffer is used to update the detection model when new operating conditions arise. Secondly, a JS divergence-based similarity measurement is proposed to monitor changes in the distribution of sensor data and identify whether new operating conditions that differ significantly from historical data occur. Finally, a similarity augmented replay-based incremental learning mechanism is designed for model updates when new operating conditions are detected. During the model update process, similarity measurements are employed to augment the replay-based update strategy, thereby improving the adaptability of the model. Experiments with simulated and real airborne sensor data demonstrate that the proposed method improves anomaly detection accuracy, increasing ACC by 0.6% to 1.8% and reducing FPR by 16.5% to 95.2%.

The telemetry data of spacecraft is an ultra-high dimensional time series used to indicate on-orbit operation status, and anomaly detection can effectively ensure safety and reliability. Aiming at the characteristics and complex correlation of high dimensional telemetry data, this paper proposes a novel anomaly detection method based on Generative Adversarial Networks (GAN) for telemetry data anomaly detection. Instead of treating each variable independently, our proposed method captures the latent representation amongst multi-dimensional time series. For normal data, the GAN-based anomaly detection method can obtain a reconstructed time series similar to the original time series, learning the probability distribution model of normal data. For abnormal data, the reconstructed time series deviates greatly from the original time series. In the GAN framework, we use Long Short-Term Memory (LSTM) as the network structure of generator for time series reconstruction and discriminator for calculating the probability of being the real time series, which can learn the temporal features of telemetry data. We also propose a novel anomaly score called GDScore, which comprehensively considers the reconstruction error of the generator and the output of the discriminator. We conduct experiments with two telemetry datasets, which verifies that our proposed GAN-based anomaly detection method can effectively detect outliers.

Volunteered Geographic Information (VGI), defined as geographic information contributed voluntarily by individuals, has grown exponentially with the aid of ubiquitous GPS-enabled technologies. VGI projects have generated a large amount of geographic data, providing a new data source for scientific research. However, many scientists are concerned about the quality of VGI data for research, given the lack of rigorous and systematic quality control procedures. This study contributes to the improvement of quality control procedures by proposing a Cross-Volunteer Referencing Anomaly Detection (CVRAD) method to filter anomalous data, using the crowdsourced Safecast radiation data as a case study. The anomaly detection method is validated using two data sets: (1) an official radiation survey data set collected by the KURAMA car-borne system, (2) a set of anomalous Safecast measurements filtered by Safecast moderators. The validation results show that the proposed CVRAD method outperformed the 1.5 IQR benchmark method in minimizing the overall measurement error and detecting abnormal imports of Safecast measurements, thus demonstrating the effectiveness of the proposed method in improving the overall accuracy of crowdsourced radiation measurements.

Many anomaly detection approaches, especially deep learning methods, have been recently developed to identify abnormal image morphology by only employing normal images during training. Unfortunately, many prior anomaly detection methods were optimized for a specific "known" abnormality (e.g., brain tumor, bone fraction, cell types). Moreover, even though only the normal images were used in the training process, the abnormal images were often employed during the validation process (e.g., epoch selection, hyper-parameter tuning), which might leak the supposed "unknown" abnormality unintentionally. In this study, we investigated these two essential aspects regarding universal anomaly detection in medical images by (1) comparing various anomaly detection methods across four medical datasets, (2) investigating the inevitable but often neglected issues on how to unbiasedly select the optimal anomaly detection model during the validation phase using only normal images, and (3) proposing a simple decision-level ensemble method to leverage the advantage of different kinds of anomaly detection without knowing the abnormality. The results of our experiments indicate that none of the evaluated methods consistently achieved the best performance across all datasets. Our proposed method enhanced the robustness of performance in general (average AUC 0.956).

The article examines the problem of detecting anomalies in the network traffic of information systems of organizations. Detection of anomalies in network traffic will allow to determine the hidden malicious activity of the data obtained on the basis of protocols that collect statistical data of the network traffic of the information system. This, in turn, will allow you to reduce the load and configure the attributes that will be used to monitor and analyze network traffic. The authors proposed the network traffic anomaly detection architecture, which is divided into functional levels. Protocols were analyzed to collect statistics, namely the Net Flow/IPFIX protocol, which provides comprehensive information based on packet headers. To process and analyze the received data, the authors developed a model for detecting anomalies in the traffic of the information system. The anomaly detection model uses statistical data for their further processing, as well as the possibility of storing data in a repository. All received data is filtered to detect malicious processes, transferred and stored in the repository of the attack database with the possibility of creating warnings and identifying the attack. For the specified model, the use of Machine Learning based on methods of predicting categorical fields is proposed. The work used a dataset with firewall data, which contains information on the number and size of transmitted and received packets of packets, data on the use of malicious software. Using the method, an experimental study of the data was conducted to predict the presence of malicious software in them. The method of forecasting categorical fields using Logistic Regression, SVM, Random Forest Classifier and other classification algorithms was investigated. Based on the obtained data, a confusion matrix was built, which allows to estimate the error of the algorithms.

GRU-Based Interpretable Multivariate Time Series Anomaly Detection in Industrial Control System

The increasing prevalence of vision-threatening retinal diseases poses a growing challenge on healthcare systems worldwide, underscoring the need for effective strategies in disease diagnosis and management. Unsupervised artificial intelligence (AI) approaches, such as anomaly detection, offer the potential to identify established and novel retinal imaging biomarkers. They reduce reliance on expert-driven annotations, mitigate bias, and overcome the limitations of predefined disease categories. Moreover, when integrated into clinical workflows, they have the potential to enhance practical applicability by supporting efficient screening, longitudinal disease monitoring, and objective assessment of treatment response. This review examines the role of anomaly detection for discovering clinically relevant retinal imaging biomarkers, by categorizing biomarkers according to their underlying pathophysiology, summarizing the spectrum of anomaly detection methods applied in the field, and highlighting biomarkers that have been identified through these approaches. Current anomaly detection methods favor the identification of established biomarkers characterized by strong intensity contrasts and well-defined structural boundaries, while more subtle abnormalities remain difficult to capture. Future research should prioritize integrating large language models (LLMs), foundation methods, multimodality, and few-shot anomaly detection, and increase explainability to advance the clinical application of anomaly detection for retinal imaging biomarker discovery in ophthalmology.

The prevalence of streaming data across various sectors poses significant challenges for real-time anomaly detection due to its volume, velocity, and variability. Traditional data processing methods often need to be improved for such dynamic environments, necessitating robust, scalable, and efficient real-time analysis systems. This study compares two advanced machine learning approaches—LSTM autoencoders and Matrix Profile algorithms—to identify the most effective method for anomaly detection in streaming environments using the NYC taxi dataset. Existing literature on anomaly detection in streaming data highlights various methodologies, including statistical tests, window-based techniques, and machine learning models. Traditional methods like the Generalized ESD test have been adapted for streaming data but often require a full historical dataset to function effectively. In contrast, machine learning approaches, particularly those using LSTM networks, are noted for their ability to learn complex patterns and dependencies, offering promising results in real-time applications. In a comparative analysis, LSTM autoencoders significantly outperformed other methods, achieving an F1-score of 0.22 for anomaly detection, notably higher than other techniques. This model demonstrated superior capability in capturing temporal dependencies and complex data patterns, making it highly effective for the dynamic and varied data in the NYC taxi dataset. The LSTM autoencoder's advanced pattern recognition and anomaly detection capabilities confirm its suitability for complex, high-velocity streaming data environments. Future research should explore the integration of LSTM autoencoders with other machine-learning techniques to enhance further the accuracy, scalability, and efficiency of anomaly detection systems. This study advances our understanding of scalable machine-learning approaches and underscores the critical importance of selecting appropriate models based on the specific characteristics and challenges of the data involved.

Time series shapelets are small subsequences that maximally differentiate classes of time series. Since the inception of shapelets, researchers have used shapelets for various data domains including anthropology and health care, and in the process suggested many efficient techniques for shapelet discovery. However, multi-dimensional time series data poses unique challenges to shapelet discovery that are yet to be solved. We show that an ensemble of shapelet-based decision trees on individual dimensions works better than shapelets defined over multiple dimensions. Generating a shapelet ensemble for multidimensional time series is computationally expensive. Most of the existing techniques prune shapelet candidates for speed. In this paper, we propose a novel technique for shapelet discovery that evaluates remaining candidates efficiently. Our algorithm uses a multi-length approximate index for time series data to efficiently find the nearest neighbors of the candidate shapelets. We employ a simple skipping technique for additional candidate pruning and a voting based technique to improve accuracy while retaining interpretability. Not only do we find a significant speed increase, our techniques enable us to efficiently discover shapelets on datasets with multi-dimensional and long time series such as hours of brain activity recordings. We demonstrate our approach on a biomedical dataset and find significant differences between patients with schizophrenia and healthy controls.

Anomaly detection (AD) is a challenging problem in computer vision. Particularly in the field of medical imaging, AD poses even more challenges due to a number of reasons, including insufficient availability of ground truth (annotated) data. In recent years, AD models based on generative adversarial networks (GANs) have made significant progress. However, their effectiveness in biomedical imaging remains underexplored. In this paper, we present an overview of using GANs for AD, as well as an investigation of state-of-the-art GAN-based AD methods for biomedical imaging and the challenges encountered in detail. We have also specifically investigated the advantages and limitations of AD methods on medical image datasets, conducting experiments using 3 AD methods on 7 medical imaging datasets from different modalities and organs/tissues. Given the highly different findings achieved across these experiments, we further analyzed the results from both data-centric and model-centric points of view. The results showed that none of the methods had reliable performance for detecting abnormalities in medical images. Factors such as the number of training samples, the subtlety of the anomaly, and the dispersion of the anomaly in the images are among the phenomena that highly impact the performance of the AD models. The obtained results were highly variable (AUC: 0.475-0.991; Sensitivity: 0.17-0.98; Specificity: 0.14-0.97). In addition, we provide recommendations for deployment of AD models in medical imaging and foresee important research directions.

Conventional security methods deployed in power plants have difficulty detecting time delay attacks, since they do not alter network packets. However, these attacks can cause damage and instability in power systems, so detecting them is an urgent anomaly detection problem. Current state-of-the-art anomaly detection methods employ machine learning (ML) or statistical regression models in a supervised fashion, which require large amounts of labeled data for training. This data may be hard to practically obtain, so it is preferable to use unsupervised methods, which do not need labeled data. However, unsupervised anomaly detection solutions suffer from high false positive rates, especially under weak and moderate attacks. To improve on existing unsupervised solutions, we develop and present a dual-stage anomaly detection method using a Recurrent Variational Autoencoder (RVAE) and K-means clustering for detecting time delay attacks in power systems. We focus on samples including weak or moderate attacks which existing solutions cannot accurately detect, but can still harm the system if strategically targeted. We call these cases borderline samples, and use an additional clustering enhancement to more accurately classify them. Evaluation of the proposed approach on our power plant dataset demonstrates that our approach is effective in detecting time delay attacks, with 14.7% higher area under the ROC curve (AUC) than RVAE for borderline samples.

Introduction: Osteoarthritis (OA) is a chronic degenerative disabling worldwide disorder in which the knee osteoarthritis range of motion (ROM) is particularly reduced. Mobilization with Movement (MWM) has shown rapid improvements in pain and functions. The muscle energy technique (MET) is claimed to be effective in muscle lengthening, strengthening, and increasing joint ROM.
 Materials and Methods: A clinical trial was conducted to compare knee Mulligan (lateral, medial, and rotational glides) techniques (n=15), and post-isometric relaxation muscle energy techniques (quadriceps, hamstring, and tensor fascia latae) (n=15) on pain and function in OA.
 Results: Twenty-two subjects (73.3%) were grade-II of knee OA and 8 subjects (26.7%) with grade III. The visual analogue scale (VAS) showed significant changes in the reduction of pain. In the VAS, the main effect of time of treatment shows that the mean value of the VAS score was statistically significant between at least two assessment stages (before the first session, after the third session, and after a month) (P<0.001) in each group. In knee osteoarthritis outcome score (KOOS), the main effect of time of treatment shows that the mean value of KOOS score is statistically significant in increasing KOOS between at least two assessment stages (before the first session, after the third session, and after a month) (P<0.001) in each group. KOOS showed significant changes for increasing function. Timed up and go (TUG) score showed decremental significant changes in time. In the TUG score, the main effect of time of the treatment shows that the mean value of the TUG score was statistically significant between at least two assessment stages (before the first session, after the third session, and after a month ) (P<0.008). In ROM score, the main effect of time of the treatment shows that the mean value of ROM score was statistically significant in increasing ROM between at least two assessment stages (before the first session, after the third session, and after a month) (P<0.002, observed power= 0.927).

<p>Anomaly detection with multivariate time series data collected by multi-sensors is a challenging problem due to the complexity and high dimension of data and the difficulty of manually labelling data. This paper proposes a novel unsupervised anomaly detection model using spatial-temporal self-attention based on transformer architecture, denoted the biself-attention anomaly detection (BSAAD) model. The BSAAD model not only utilizes a time-step encoder with a self-attention mechanism to capture temporal correlation but also constructs a sensor encoder with a self-attention mechanism to capture spatial correlation among multivariate time series data. To amplify the reconstruction errors of anomalous points during network training, a two-phase training style with an adversarial training strategy is used to improve the anomaly detection performance of the BSAAD model. Experiments on six multivariate time series datasets show that the BSAAD model outperforms state-of-the-art anomaly detection methods.</p> <p> </p>