Deep-Compact-Clustering Based Anomaly Detection Applied to Electromechanical Industrial Systems

The need for detection, identification and prediction of anomalies emerged just a short time ago. This task brings multiple challenges that are mainly associated with recording and detection of novel attacks and influences. It draws attention of experts in network security and diagnostics of information and industrial systems. Detection of anomalies in dynamic dataflows largely determines the efficiency of management of computer network information security within information and industrial systems. At the same time, the technology of dynamic dataflow prediction is also very important for building systems intended to detect anomalies in data protection within industrial control systems. Any automated systems are based on available computer capabilities and advances in management theory, mathematical modeling and optimizations methods. Processes that occur in industrial automated systems and that are reflected in dataflows being observed constitute complex multi-component processes, thus making it more complicated to predict such processes. In this case, complex multi-component time series data should be predicted at different (short-term, medium-term and long-term) time scales. A neural network architecture matching the structure of the multi-component time series being predicted should be built for generating a multi-component prediction. It is proposed to decompose the complex multi-component time series into several basic components using the digital signal processing technology, i. e. to perform a preliminary structural analysis of multi-component time series within the observed range of all time series that reflect operation of the industrial control system. Separate predictions with different time horizon are formed for each basic component of the multi-component time series using the available neural network architecture and machine learning taking into account dynamic characteristics of the above components. Anomalies in the observed range of multiple time series that reflect operation of the industrial control system are detected (identified) through component-wise comparison of each component (resulted from the above preliminary digital processing) of any time series within the observed range of all time series, with each prediction of the relevant component of the above time series within the observed range of all time series. This approach that implies component-wise comparison will allow to detect anomalies within the range of observed time series of the industrial control system separately by their different dynamic characteristics, and thus will improve the efficiency of management of information security within information and industrial systems.

Massive amounts of data are created and collected by data acquisition systems, including SCADA and embedded systems in industrial machines.The data may be analysed by AI algorithms to gain a better understanding of the process and identify any irregularities in the machines.This is a major benefit of Industry 4.0.This paper will examine predictive maintenance as a process in industry and demonstrate how it may make full use of technologies from Industry 4.0.Using a weighted average, our method integrates Three Machine Learning models: Auto encoder (AE), One-Class Support Vector Machine (OCSVM), and Local Outlier Factor (LOF).This allows us to discover anomalies in real-time.Anomaly detection will be enhanced as a result.Improve real-time anomaly detection using the suggested hybrid machine-learning ensemble pipeline by combining the outputs of three ML models: auto encoder (AE), one-class support vector machine (OCSVM), and local outlier factor (LOF).

Nowadays, IoT technology has become an essential part of many aspects of life and business. Nevertheless, such widespread application has come at the cost of many security concerns that threaten data privacy and diminish IoT utilization momentum in critical applications such as the smart grid and intelligent transportation systems. To address this challenge, several approaches have been proposed to detect and prevent IoT cyberthreats from materializing. Anomaly detection is one of these approaches that defines the boundaries of legitimate (normal) behavior. Any behavior that falls outside these boundaries is considered anomalous. However, these solutions should have the capability to adapt and adjust to environmental changes that prompt IoT nodal behavioral aberrations, except they only assume that these nodes show the same behavior. This assumption does not hold due to the heterogeneity of IoT nodes and the dynamic nature of an IoT network topology. Furthermore, existing adaptive solutions rely on static (pre-defined) thresholds to control the moment for retraining updates. The cost is heavy for highly dynamic environments like IoT as it leads to an unnecessary higher frequency of retraining. Consequently, the model becomes unstable and adversely affects its accuracy and robustness. This paper addresses these problems by offering an improved Adaptive Anomaly Detection (AAD) methodology that resolves the heterogeneity issues by building local profiles that define normal behavior at each IoT node. The One Class Support Vector Machines (OC-SVM) was used to build these profiles. Then, K-Means clustering was used to build a global profile that represents all network nodes. A Local-Global Ratio-Based (LGR) Anomaly Detection scheme is advanced and was enlisted to control the adaptation process by adjusting the threshold of adaptive functionality dynamically based on the “current” situation to prevent unnecessary retraining. An Ensemble of Deep Belief Networks (EDBN) is developed and used to train the anomaly detection model. Additionally, this study's proposes a new Minimized Redundancy Discriminative Feature Selection (MRD-FS) technique to resolve the issue of redundant features. The MRD-FS experimental evaluation shows detection accuracy higher than those of the related solutions including lower false alarm rates. This validates the efficacy of the proposed model for various IoT applications such as smart grids, smart homes, smart cities and intelligent transportation systems.

In the realm of smart grids, machine learning (ML) detectors—both binary (or supervised) and anomaly (or unsupervised)—have proven effective in detecting electricity theft (ET). However, binary detectors are designed for specific attacks, making their performance unpredictable against new attacks. Anomaly detectors, conversely, are trained on benign data and identify deviations from benign patterns as anomalies, but their performance is highly sensitive to the selected threshold values. Additionally, ML detectors are vulnerable to evasion attacks, where attackers make minimal changes to malicious samples to evade detection. To address these limitations, we introduce a hybrid anomaly detector that combines a Deep Auto-Encoder (DAE) with a One-Class Support Vector Machine (OCSVM). This detector not only enhances classification performance but also mitigates the threshold sensitivity of the DAE. Furthermore, we evaluate the vulnerability of this detector to benchmark evasion attacks. Lastly, we propose an accurate and robust cluster-based DAE+OCSVM ET anomaly detector, trained using Explainable Artificial Intelligence (XAI) explanations generated by the Shapley Additive Explanations (SHAP) method on consumption readings. Our experimental results demonstrate that the proposed XAI-based detector achieves superior classification performance and exhibits enhanced robustness against various evasion attacks, including gradient-based and optimization-based methods, under a black-box threat model.

The escalating impact of environmental stress on coastal ecosystems necessitates reliable, scalable tools for monitoring marine biodiversity. This study proposes an unsupervised anomaly detection framework to identify parasitic and morphologically abnormal plankton in the waters of Brebes, Indonesia. The primary aim is to develop an interpretable, vision-based system capable of detecting visual anomalies without relying on labeled anomaly data. The research integrates convolutional autoencoders for reconstructing normal plankton images, Principal Component Analysis (PCA) for feature extraction, and One-Class Support Vector Machines (OC-SVM) for classification. Monthly microscopic images were obtained from selected mangrove and aquaculture pond sites in Brebes, Central Java, using portable digital microscopy under standardized field conditions. Images that exceeded a dynamic reconstruction threshold were flagged as anomalous and validated by marine biology experts. The system achieved an F1-score of 86.1%, a precision of 85.3%, and an AUC of 0.94, demonstrating high effectiveness in distinguishing between normal and anomalous plankton. With an average inference time of 0.37 seconds per image, the system supports near real-time monitoring. These results confirm the potential of the proposed method as a low-latency, field-deployable solution for aquatic ecosystem surveillance. By integrating AI-based detection with ecological expert validation, this research offers a scalable approach for marine biodiversity assessment and establishes a foundation for future adaptive environmental monitoring systems.

Anomaly detection can be seen as an unsupervised learning task in which a predictive model created on historical data is used to detect outlying instances in new data. This work addresses possibly promising but relatively uncommon application of anomaly detection to text data. A Polish Internet discussion forum devoted to psychoactive substances received from home-grown plants, such as hashish or marijuana, serves as a text source that is both realistic and possibly interesting on its own, due to potential associations with drug-related crime. Forum posts are preprocessed by stopword removal, spelling correction, stemming, and frequency-based term filtering. The Global Vectors (GloVe) text representation, which is an example of the increasingly popular word embedding approach, is combined with two unsupervised anomaly detection algorithms, based on one-class SVM classification and based on dissimilarity to k-medoids clusters. The cluster dissimilarity approach combined with the GloVe representation outperforms one-class SVM with respect to detection quality and appears a more promising approach to anomaly detection in text data.

Anomaly detection is a cornerstone of modern intelligent systems, with critical applications in healthcare, cybersecurity, smart grids, and IoT environments. While traditional machine learning and deep learning models have shown promise in identifying outliers, they often face challenges such as dependence on large labeled datasets, high computational costs, and limited scalability to edge devices or high-dimensional data streams. This study introduces D2H-AD, a novel anomaly detection framework built upon Hyperdimensional Computing (HDC), a brain-inspired paradigm that encodes information using high-dimensional distributed vectors. Unlike prior HDC-based approaches, D2H-AD fuses distance-based similarity and density-aware encoding in a hybrid design, significantly improving anomaly characterization and detection accuracy. Ablation experiments confirm that hyperdimensional encoding alone contributes up to 5.4% higher ROC-AUC compared to applying the same density-distance scoring in the original Euclidean feature space, and D2H-AD consistently outperforms all five published baselines (HDAD, ODHD, One-Class SVM, Isolation Forest, and Autoencoders) across every evaluated dataset. The method is designed to be lightweight, interpretable, and computationally efficient, suggesting strong suitability for deployment in resource-constrained and real-time environments. To validate its effectiveness, we evaluate D2H-AD on five diverse benchmark datasets, comparing its performance against five leading techniques: HDAD, ODHD, One-Class SVM, Isolation Forest, and Autoencoders. Our results show that D2H-AD consistently achieves superior F1 scores and ROC-AUC metrics, demonstrating robustness against class imbalance, noise, and data complexity. Beyond accuracy, D2H-AD offers practical advantages including scalability, minimal memory footprint, and an expected low-latency profile derived from its binary operations and lightweight design. These characteristics are crucial for TinyML and edge AI applications. This work highlights the untapped potential of HDC for high-performance anomaly detection and opens new avenues for secure, interpretable, and energy-efficient AI solutions in dynamic environments such as IoT, embedded systems, and beyond. Additionally, D2H-AD provides feature-level interpretability through hypervector decoding, enabling transparent explanations for safety-critical applications.

The classification performances of the traditional one-class support vector machine (OCSVM) and its variants are often not satisfying when outliers are complex. To deal with this case, assigning smaller weights to these outliers may alleviate their influence upon the classification boundary and enhance the robustness of OCSVM. In this paper, a novel adaptive-weighted one-class support vector machine (AWOCSVM) is proposed for dealing with the outlier detection problem. The appropriate weights are assigned to training samples by considering both their local densities and distances between them to their center. Experimental results on two synthetic data sets and eight benchmark data sets demonstrate that the proposed AWOCSVM achieves more compact classification boundary and superior performance in comparison with the traditional OCSVM and one related approach.

System call analysis is based on a behavior-oriented anomaly detection technique, which is well accepted due to its consistent performance. This study compares two popular algorithms long short-term memory (LSTM) sequence to sequence (Seq-Seq), and one-class support vector machines (OCSVM) for anomalous system call sequences detection. The proposed framework monitors running processes to recognize compromised virtual machines in hypervisor-based systems. The evaluated results show the comparative analysis and effectiveness of feature extraction strategies and anomaly detection algorithms based on their high detection accuracy and with a low loss. This study demonstrates a comparative analysis of detecting anomalous behavior in any process using OCSVM and LSTM Seq-Seq algorithms. A bag-of-2-g with PCA feature extraction strategy and LSTM Seq-Seq with a sequence length of five provides higher detection accuracy of 97.2%.

Since the nonstationary distribution of the detected objects is general in the real world, the accurate and efficient outlier detection for data analysis within wireless sensor network (WSN) is a challenge. Recently, with high classification precision and affordable complexity, one-class quarter-sphere support vector machine (QSSVM) has been introduced to deal with the online and adaptive outlier detection in WSN. Regarding the one-sided consideration of optimization or iterative updating algorithm for QSSVM model within current techniques, we have proposed comprehensive outlier detection methods in WSN based on the QSSVM algorithm. To reduce the complexity of optimization algorithm for QSSVM model in existing techniques, a fast optimization algorithm based on average Euclidean distance has been developed and employed to the comprehensive outlier detection method. Evaluated by real and synthetic WSN data sets, our methods have shown an excellent outlier detection performance, and they have been proved to meet the requirements of online adaptive outlier detection in the case of nonstationary detection tasks of WSN.

Accurate energy demand prediction is crucial for efficient grid management and resource optimization, particularly across multiple countries with varying consumption patterns. However, real-world energy demand data often contains outliers that can distort forecasting accuracy. This study evaluates the impact of five outlier detection techniques—Z-Score, density- based spatial clustering of applications with noise (DBSCAN), isolation forest (IF), local outlier factor (LOF), and one-class support vector machine (SVM)—on the performance of three time-series forecasting models: long short-term memory (LSTM) networks, convolutional neural network (CNN) Autoencoders, and LSTM with attention mechanisms. The models are tested using energy demand data from four European countries— Germany, France, Spain, and Italy—derived from real-time consumption records. A comparative analysis based on root mean squared error (RMSE) demonstrates that incorporating outlier detection significantly enhances model robustness, reducing forecasting errors caused by anomalous data. The findings emphasize the importance of selecting appropriate outlier detection strategies to improve the accuracy and reliability of energy demand forecasting. This research provides valuable insights into the trade-offs involved in outlier removal, with implications for policy and operational practices in energy management.

One-class Classification-Based Machine Learning Model for Estimating the Probability of Wildfire Risk

Intrusion detection system (IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it is unable to detect unknown attacks, i.e., 0-day attacks, the ultimate challenge in intrusion detection field is how we can exactly identify such an attack by an automated manner. Over the past few years, several studies on solving these problems have been made on anomaly detection using unsupervised learning techniques such as clustering, one-class support vector machine (SVM), etc. Although they enable one to construct intrusion detection models at low cost and effort, and have capability to detect unforeseen attacks, they still have mainly two problems in intrusion detection: a low detection rate and a high false positive rate. In this paper, we propose a new anomaly detection method based on clustering and multiple one-class SVM in order to improve the detection rate while maintaining a low false positive rate. We evaluated our method using KDD Cup 1999 data set. Evaluation results show that our approach outperforms the existing algorithms reported in the literature; especially in detection of unknown attacks.

Anomaly in geoacoustic emission is an important earthquake precursor. Current geoacoustic anomaly detection methods are limited by their low signal-to-noise ratio, low intensity, sample imbalance, and low accuracy. Therefore, this paper proposes a clone selection algorithm optimized one-class support vector machine method (CSA-OCSVM) for geoacoustic anomaly detection. First, the interquartile range (IQR), cubic spline interpolation, and time window are designed to amplify the geoacoustic signal intensity and energy change rules to reduce the interference of geoacoustic signal noise and intensity. Secondly, to address the imbalance of positive and negative samples in geoacoustic anomaly detection, a one-class support vector machine is introduced for anomaly detection. Meanwhile, in view of the optimization capabilities of the clone selection algorithm, it is adopted to optimize the hyperparameters of OCSVM to improve its detection accuracy. Finally, the proposed model is applied to geoacoustic data anomaly detection in nine different datasets, which are derived from our self-developed acoustic electromagnetic to AI (AETA) system, to verify its effectiveness. By designing comparative experiments with IQR, genetic algorithm OCSVM (GA-OCSVM), particle swarm optimization OCSVM (PSO-OCSVM), and evaluating the performance of the true positive rate (TPR) and false positive rate (FPR), the experimental results depict that the proposed model is superior to the existing state-of-the-art geoacoustic anomaly detection approaches.

Research suggests that return and refund fraud poses a significant challenge to the fashion e-commerce, leading to financial losses and operational inefficiency. Traditional anomaly detection methods struggle with class imbalance and inconsistency across a single model approach. In this work, we propose a novel Hybrid Stacking Ensemble Framework which integrates Isolation Forest, One-Class Support Vector Machine (OCSVM), and Autoencoder with a Logistic Regression meta-classifier. To address the severe imbalance in the dataset, SMOTE was used to generate synthetic samples for minority class. Experiment demonstrated that while baseline imbalanced dataset achieved an accuracy of 76% and F1-score of 0.76, the resulted dataset with SMOTE achieved approximately 0.92 F1-score. This paper contributes a hybrid ensemble and data augmentation pipeline that can serve as a foundation for suture anomaly detection research.