Evaluating hyperparameter transferability in unsupervised anomaly detection for smart home environments

The growth of cyber threats and network traffic has highlighted the need for effective methods for detecting anomalies. The purpose of the study was to develop a hybrid model for detecting anomalies in telecommunications networks with increased accuracy based on comparative analysis of uncontrolled algorithms. Four main algorithms were compared: Isolation Forest, Local Outlier Factor (LOF), One-Class Support Vector Machine (SVM), and Elliptic Envelope using simulated network traffic data. Analysis methods included data normalisation using Z-score and Min-Max Scaling to eliminate large-scale differences between traits. An ensemble of 100 decision trees was used to improve the accuracy of anomaly detection. As a result, it was found that Isolation Forest provided the highest accuracy of anomaly detection (F1-Score = 85.8%) and high processing speed (processing time per 10,000 records in 2.5 seconds), which is important for real-world conditions of telecommunications networks with large amounts of data. LOF showed high accuracy in detecting local anomalies, but with greater computational complexity. The one-class SVM algorithm detected global anomalies, but showed lower accuracy for local ones. Elliptic Envelope had limited performance due to the assumption of normal data distribution. Additionally, a comprehensive model was developed that combined the advantages of Isolation Forest, LOF, and Density-Based Spatial Clustering of applications with Noise, which allowed increasing the F1-Score to 88% and exceeding the results of individual models. The hybrid model showed adaptability to multimodal distributions and efficiency in detecting local anomalies. Practical significance lies in improving the accuracy and stability of network security systems and form the basis for adaptive real-time algorithms, which allowed cybersecurity and telecommunications specialists to more effectively monitor and protect networks from threats

IntroductionIn swine disease surveillance, obtaining labeled data for supervised learning models can be challenging because many farms lack standardized diagnostic routines and consistent health monitoring systems. Unsupervised learning is particularly suitable in such scenarios because it does not require labeled data, allowing for detecting anomalies without predefined labels. This study evaluates the effectiveness of unsupervised machine learning models in detecting anomalies in productivity indicators in swine breeding herds.MethodsAnomalies, defined as deviations from expected patterns, were identified in indicators such as abortions per 1000 sows, prenatal losses, preweaning mortality, total born, liveborn, culled sows per 1000 sows, and dead sows per 1000 sows. Three unsupervised models - Isolation Forest, Autoencoder, and K-Nearest Neighbors (KNN) - were applied to data from two swine production systems. The herd-week was used as the unit of analysis, and anomaly scores above the 75th percentile were used to flag anomalous weeks. A permutation test assessed differences between anomalous and non-anomalous weeks. Performance was evaluated using F1-score, precision, and recall, with true anomalous weeks defined as those coinciding with reported health challenges, including porcine reproductive and respiratory syndrome (PRRS) and Seneca Valley virus outbreaks. A total of 8,044 weeks were analyzed.ResultsThe models identified 336 anomalous weeks and 1,008 non-anomalous weeks in Production System 1, and 1,675 anomalous weeks and 5,025 non-anomalous weeks in Production System 2. The results from the permutation test revealed significant differences in productivity indicators between anomalous and non-anomalous weeks, especially during PRRS outbreaks, with more subtle changes observed during Seneca Valley virus outbreaks. The models performed well in detecting the PRRSV anomaly, achieving perfect precision (100%) across all models for both production systems. For anomalies like SVV the models showed lower performance compared to PRRSV.DiscussionThese findings suggest that unsupervised machine learning models are promising tools for early disease detection in swine herds, as they can identify anomalies in productivity data that may signal health challenges.

An unsupervised machine learning model that uses the mechanism of the Local Outlier Factor to flag and detect ambiguous as well as potentially fraudulent claims in Accidental and Healthcare insurance is proposed in this paper. It entirely automates the manual investigation of claims by claim appraisers in any organization. The ethos of this model is to comprehensively automate and expedite the claim investigation process using certain parameters to aid the claim appraiser’s workload of going through straightforward claims and saving their time to investigate more critical and complex claims. The model flags anomalous claims by comparing them to the model’s threshold, and input parameters and alerts are generated. These alerts generated are then investigated for fraud based on the parameters stated. The model can classify these claims and the cost of billable associated with these claims by reporting an accuracy of 99.5% for the Local Outlier Factor model in comparison with other implemented techniques of Isolation Forest which had an accuracy of only 78.37%. Our model has been tested and validated on real-world data and is showing promising results. Being able to identify and flag potentially fraudulent claims before they are paid out can save insurance companies a lot of money and resources.

BACKGROUND Patient heterogeneity is a key challenge in immunotherapy for IDH-wildtype glioblastoma (GBM), where hypermutated tumors or highly immunosuppressive tumor microenvironments (TME) act as clinical outliers affecting treatment response and trial stratification. We developed Alert-GBM, a radiogenomic AI model designed to flag such outliers based on radiomic signatures from diagnostic imaging. MATERIAL AND METHODS We used multicenter open-access radiogenomic datasets (n = 176) to train unsupervised outlier detection models. Principal Component Analysis (PCA) served as a first-pass filter to harmonize data before applying Isolation Forest (IF) modeling. Three IF models were trained using inter-dataset leave-one-out cross-validation (LOOCV) to simulate real-world performance and were benchmarked against each other. The final model was selected using stratified 10-fold cross-validation (CV). Outliers were validated through visual inspection, statistical profiling, comparison with other outlier detection methods (Local Outlier Factor, One-Class SVM, Mahalanobis distance), and correlation with biological and immune profiles from imaging and omics data. RESULTS The PCA filter identified 3 initial outliers based on MRI metadata. The final IF model, following stratified 10-fold CV, detected 6 outliers across the datasets, with anomaly scores plotted. Flagged cases included large, highly enhancing tumors, minimally enhancing tumors, and post-operative scans. Visualizations using PCA, t-SNE, and UMAP were generated to illustrate separability. False positives and negatives were assessed using immune-based scores, and the distribution of anomaly scores was analyzed with KDE plots. Cross-validation against alternative outlier models confirmed consistency of the flagged cases. CONCLUSION Alert-GBM is a proof-of-concept AI architecture for outlier detection in GBM MRI radiogenomics, capable of flagging cases with atypical immune TME profiles. Integrating such models with radiogenomic immune predictors at the time of diagnosis may support multidisciplinary decision-making and improve patient stratification for immunotherapy trials. Incorporating a human-in-the-loop framework ensures that AI outputs remain clinically interpretable and actionable.

This paper describes a technique for using time series data to monitor and diagnose faults in production systems. Predictive maintenance is the focus of research in order to assess equipment condition and anticipate potential failures. The method reduces the need for user intervention by combining Automatic Diagnostic Systems (ADS) with continuous monitoring systems to detect equipment failures early on. Three distinct techniques were tested on temperature sensor time series data: Isolation Forest (IF), Local Outlier Factor (LOF), and One-Class Support Vector Machine (OCSVM). Graphs showing how each method distinguished between normal and abnormal sensor behavior were used to evaluate each method’s efficacy in detecting anomalies. According to the results, IF is best used for ongoing monitoring, OCSVM for more thorough anomaly detection, and LOF for distinguished outlier identification. The findings are intended to improve problem detection and maintenance oversight in production systems.

Behavioral finance has emerged as a critical framework for understanding market dynamics beyond traditional rational agent models. This research presents a comprehensive multimodal approach to behavioral finance analysis, integrating market data, macroeconomic indicators, news sentiment, cryptocurrency metrics, Web3 analytics, GitHub development activity, and social sentiment to test five advanced hypotheses regarding behavioral pattern identification and market anomaly detection. The study employs an ultra-comprehensive data pipeline processing 30,400 samples across seven distinct data sources, generating 91 engineered features representing behavioral biases, investment patterns, and market psychology. Advanced machine learning techniques including Principal Component Analysis, t-Distributed Stochastic Neighbor Embedding, Variational Autoencoders, K-Means, Hierarchical Clustering, DBSCAN, Isolation Forest, One-Class SVM, and Elliptic Envelope are applied to identify behavioral structures and detect anomalies. Statistical validation through chi-square tests, ANOVA, Granger causality analysis, and lagged correlation studies demonstrates that three of five hypotheses (60%) achieve statistical significance at p < 0.05. Key findings reveal that behavioral structures exist and correspond to canonical biases (chi-square = 3406.780, p < 0.001), cluster assignments maintain moderate stability across market regimes (Jaccard similarity = 0.300), and sentiment and macroeconomic factors exhibit 65 significant causal relationships with behavioral patterns. However, multimodal data integration does not uniformly improve clustering quality (Silhouette score decrease of 0.116), and cluster-conditioned anomaly detection fails to outperform global methods (F1-score decrease of 0.017). These findings contribute to behavioral finance theory while providing practical applications for investment management, fraud detection, and regulatory compliance.

Massive amounts of data are created and collected by data acquisition systems, including SCADA and embedded systems in industrial machines.The data may be analysed by AI algorithms to gain a better understanding of the process and identify any irregularities in the machines.This is a major benefit of Industry 4.0.This paper will examine predictive maintenance as a process in industry and demonstrate how it may make full use of technologies from Industry 4.0.Using a weighted average, our method integrates Three Machine Learning models: Auto encoder (AE), One-Class Support Vector Machine (OCSVM), and Local Outlier Factor (LOF).This allows us to discover anomalies in real-time.Anomaly detection will be enhanced as a result.Improve real-time anomaly detection using the suggested hybrid machine-learning ensemble pipeline by combining the outputs of three ML models: auto encoder (AE), one-class support vector machine (OCSVM), and local outlier factor (LOF).

With the increasing adoption of RESTful APIs as the backbone of modern web and mobile applications, ensuring their security has become a critical concern. Traditional security mechanisms such as rule-based firewalls and static rate-limiting policies are often ineffective against sophisticated, evolving threats like zero-day attacks, automated bot traffic, and API abuse patterns. This research proposes an intelligent, machine learning-based framework to detect and prevent malicious activity in REST API traffic. The approach involves collecting and preprocessing real-time API request logs to extract behavioural and contextual features. Supervised and unsupervised machine learning models such as isolation forests, LSTM-based anomaly detectors, and decision trees are evaluated for their effectiveness in detecting anomalies, injection attacks, and abnormal usage behavior. Furthermore, the study incorporates reinforcement learning to dynamically adjust security policies (e.g., rate limits, IP bans) in response to detected threats without impacting legitimate users. A proof-of-concept prototype will be developed and deployed in a controlled environment to evaluate performance in terms of detection accuracy, false positive rates, and system latency. The outcome of this research aims to advance the state-of-the-art in API security by introducing adaptive, self-learning mechanisms capable of protecting APIs from modern security threats while maintaining usability and performance.

It is challenging to predict which patients who meet criteria for subcortical ischemic vascular disease (SIVD) will ultimately progress to subcortical vascular cognitive impairment (SVCI). We collected clinical information, neuropsychological assessments, T1 imaging, diffusion tensor imaging, and resting-state functional magnetic resonance imaging from 83 patients with SVCI and 53 age-matched patients with SIVD without cognitive impairment. We built an unsupervised machine learning model to isolate patients with SVCI. The model was validated using multimodal data from an external cohort comprising 45 patients with SVCI and 32 patients with SIVD without cognitive impairment. The accuracy, sensitivity, and specificity of the unsupervised machine learning model were 86.03%, 79.52%, and 96.23% and 80.52%, 71.11%, and 93.75% for internal and external cohort, respectively. We developed an accurate and accessible clinical tool which requires only data from routine imaging to predict patients at risk of progressing from SIVD to SVCI. Our unsupervised machine learning model provides an accurate and accessible clinical tool to predict patients at risk of progressing from subcortical ischemic vascular disease (SIVD) to subcortical vascular cognitive impairment (SVCI) and requires only data from imaging routinely used during the diagnosis of suspected SVCI. The model yields good accuracy, sensitivity, and specificity and is portable to other cohorts and to clinical practice to distinguish patients with SIVD at risk for progressing to SVCI. The model combines assessment of diffusion tensor imaging and functional magnetic resonance imaging measures in patients with SVCI to analyze whether the "disconnection hypothesis" contributes to functional and structural changes and to the clinical presentation of SVCI.

A comparative investigation of data-driven approaches based on one-class classifiers for condition monitoring of marine machinery system

Accurate energy demand prediction is crucial for efficient grid management and resource optimization, particularly across multiple countries with varying consumption patterns. However, real-world energy demand data often contains outliers that can distort forecasting accuracy. This study evaluates the impact of five outlier detection techniques—Z-Score, density- based spatial clustering of applications with noise (DBSCAN), isolation forest (IF), local outlier factor (LOF), and one-class support vector machine (SVM)—on the performance of three time-series forecasting models: long short-term memory (LSTM) networks, convolutional neural network (CNN) Autoencoders, and LSTM with attention mechanisms. The models are tested using energy demand data from four European countries— Germany, France, Spain, and Italy—derived from real-time consumption records. A comparative analysis based on root mean squared error (RMSE) demonstrates that incorporating outlier detection significantly enhances model robustness, reducing forecasting errors caused by anomalous data. The findings emphasize the importance of selecting appropriate outlier detection strategies to improve the accuracy and reliability of energy demand forecasting. This research provides valuable insights into the trade-offs involved in outlier removal, with implications for policy and operational practices in energy management.

In the rapidly emerging field of transferring healthcare from hospitals to patients' homes, it is essential that signs of remote deterioration at home should be detected early to timely upscale care when needed. As patient deterioration is a rare event, datasets have insufficient event data for supervised machine learning. Personalized anomaly detection (AD) may be a good alternative. Therefore, this study aimed to obtain insight into the use of personalized AD models in detecting early signs of patient deterioration at home using wearable sensor data. To address this, Isolation Forest and Local Outlier Factor models were applied to detect signs of deterioration in terms of mortality or unplanned readmission in the 24 preceding hours in two datasets: one of heterogeneous patients, the other of postoperative patients. A pipeline was developed for continuously updating personalized AD models over time and applying them to detection windows twice per day. Results were compared with the Remote Early Warning Score. Isolation Forest (AUROC: 0.69) and Local Outlier Factor (AUROC: 0.67) models were able to find some early signs of deterioration in heterogeneous patients (n = 113). However, in postoperative patients (n = 193), Isolation Forest (AUROC: 0.41) and Local Outlier Factor (AUROC 0.44) performed badly. The Remote Early Warning Score was able to find some early signs of deterioration for both groups (AUROC: 0.63-0.76). Based on these findings, three requirements were formulated that should be fulfilled for a potentially successful application of personalized AD. First, the training set should be normal and representative of non-deteriorating patients. Second, signs of deterioration should exhibit abnormal characteristics. Third, non-deteriorating patients should not exhibit abnormal characteristics.

While developing continuous authentication systems (CAS), we generally assume that samples from both genuine and impostor classes are readily available. However, the assumption may not be true in certain circumstances. Therefore, we explore the possibility of implementing CAS using only genuine samples. Specifically, we investigate the usefulness of four one-class classifiers OCC (elliptic envelope, isolation forest, local outliers factor, and one-class support vector machines) and their fusion. The performance of these classifiers was evaluated on four distinct behavioral biometric datasets, and compared with eight multi-class classifiers (MCC). The results demonstrate that if we have sufficient training data from the genuine user the OCC, and their fusion can closely match the performance of the majority of MCC. Our findings encourage the research community to use OCC in order to build CAS as they do not require knowledge of impostor class during the enrollment process.

Anomaly detection is a cornerstone of modern intelligent systems, with critical applications in healthcare, cybersecurity, smart grids, and IoT environments. While traditional machine learning and deep learning models have shown promise in identifying outliers, they often face challenges such as dependence on large labeled datasets, high computational costs, and limited scalability to edge devices or high-dimensional data streams. This study introduces D2H-AD, a novel anomaly detection framework built upon Hyperdimensional Computing (HDC), a brain-inspired paradigm that encodes information using high-dimensional distributed vectors. Unlike prior HDC-based approaches, D2H-AD fuses distance-based similarity and density-aware encoding in a hybrid design, significantly improving anomaly characterization and detection accuracy. Ablation experiments confirm that hyperdimensional encoding alone contributes up to 5.4% higher ROC-AUC compared to applying the same density-distance scoring in the original Euclidean feature space, and D2H-AD consistently outperforms all five published baselines (HDAD, ODHD, One-Class SVM, Isolation Forest, and Autoencoders) across every evaluated dataset. The method is designed to be lightweight, interpretable, and computationally efficient, suggesting strong suitability for deployment in resource-constrained and real-time environments. To validate its effectiveness, we evaluate D2H-AD on five diverse benchmark datasets, comparing its performance against five leading techniques: HDAD, ODHD, One-Class SVM, Isolation Forest, and Autoencoders. Our results show that D2H-AD consistently achieves superior F1 scores and ROC-AUC metrics, demonstrating robustness against class imbalance, noise, and data complexity. Beyond accuracy, D2H-AD offers practical advantages including scalability, minimal memory footprint, and an expected low-latency profile derived from its binary operations and lightweight design. These characteristics are crucial for TinyML and edge AI applications. This work highlights the untapped potential of HDC for high-performance anomaly detection and opens new avenues for secure, interpretable, and energy-efficient AI solutions in dynamic environments such as IoT, embedded systems, and beyond. Additionally, D2H-AD provides feature-level interpretability through hypervector decoding, enabling transparent explanations for safety-critical applications.

Leveraging EEG for neurological disorder analysis and detection has become a prominent research area due to its non-invasive nature and portability. One underexplored yet critical problem is the timely detection of seizures, especially in real-world, resource-constrained environments. Because seizures are unpredictable and often go unnoticed by patients, an efficient detection system that can operate on portable or wearable devices is essential. While existing EEG-based seizure detection systems often rely on deep learning models, they typically require considerable computational resources and frequent retraining, which may limit their real-time applicability. In contrast, we propose a lightweight machine learning framework based on low-dimensional features extracted via PCA and autoencoders. Using a One-Class Support Vector Machine (OC-SVM), our method achieved a seizure identification accuracy of 98.1 %, outperforming Local Outlier Factor (LOF) and matching or exceeding performance reported by more complex deep learning models. Compared with existing study results, our approach maintains competitive accuracy while requiring significantly less computational power, making it ideal for deployment on portable or wearable devices. Furthermore, our visualizations reveal data structure characteristics that explain the challenges of seizure detection and guide model selection. Together, these insights underscore the potential of our approach as an efficient, interpretable, and scalable solution for pervasive seizure monitoring.