Few-shot Anomaly Detection for Aerospace Telemetry Data Based on Model-Agnostic Meta-learning

Relational Database Management Systems (RDBMSs) are foundational to operations across finance, healthcare, and government sectors. However, they remain susceptible to advanced threats such as polymorphic SQL injection, insider misuse, and timing-based data exfiltration.Traditional intrusion detection systems (IDSs), including signature-based and static machine learning models, often struggle to detect evolving and obfuscated attacks, resulting in high false-positive rates and limited adaptability.This paper presents the Triple Loop Learning (TLL) framework—a recursive, multi-tiered architecture that integrates supervised learning, reinforcement learning (RL), and meta-learning for real-time anomaly detection in SQL-based environments. To the best of our knowledge, TLL is the first framework to unify these three learning paradigms into a recursive, explainable, and low-latency anomaly detection system specifically tailored for structured SQL workloads.TLL comprises three interdependent loops: (i) an operational loop utilizing SQL-aware autoencoders for fine-grained anomaly detection, (ii) a tactical loop leveraging Deep Q-Networks (DQN) for adaptive threshold calibration, and (iii) a strategic loop based on Model-Agnostic Meta-Learning (MAML) for rapid cross-domain adaptation.TLL was evaluated on a composite dataset comprising the UNSW-NB15 benchmark, anonymized SQL logs from financial and healthcare institutions, and adversarial samples generated with MAD-GAN. The framework achieved an F1 score of 0.94, an AUC of 0.976, and an average inference latency of 84 ms.The results demonstrate that TLL enables robust, low-latency detection of zero-day and obfuscated SQL threats. Its explain-ability is enhanced through SHAP-based attributions, and its deployment is version-controlled and reproducible, ensuring traceability, compliance, and production readiness.

In recent manufacturing environments, the use of digitally retrofitted equipment has grown substantially, yet this trend also amplifies the challenge of ensuring stable operation through effective anomaly detection. Retrofitted systems suffer from two critical obstacles: a severe scarcity of labeled data and substantial variability in operational patterns across machines and products. To overcome these issues, this study introduces a novel anomaly detection framework that integrates Model-Agnostic Meta-Learning (MAML) with a Long Short-Term Memory Autoencoder (LSTM-Autoencoder) under a multi-machine-based task formulation. By constructing meta-tasks from time-series datasets collected on multiple five-axis computer numerical control (CNC) machines, our method enables rapid adaptation to unseen machines and production scenarios with only a few training examples. The experimental results demonstrate that, even under data-scarce conditions, the proposed model achieves an accuracy of 98.02% and an F1-score of 94.74%, representing improvements of 4.2 percentage points in accuracy and 16.9 percentage points in F1-score over conventional transfer learning approaches. Furthermore, in cross-validation on entirely new machine data, our framework outperforms existing models by 18.1% in accuracy, evidencing superior generalization capability. These findings suggest that the proposed multi-machine-based Model-Agnostic Meta-Learning Long Short-Term Memory Autoencoder (MAML LSTM-Autoencoder) can significantly enhance operational efficiency and reduce maintenance costs in retrofitted manufacturing equipment, thereby improving overall productivity and paving the way for real-time industrial deployment.

With the advancement of technologies like 5G, cloud computing, and microservices, the complexity of network management systems and the variety of technical components have greatly increased. This rise in complexity has rendered traditional operations and maintenance methods inadequate for current monitoring and maintenance demands. Consequently, artificial intelligence for IT operations (AIOps), which harnesses AI and big data technologies, has emerged as a solution. AIOps plays a crucial role in enhancing service quality and customer satisfaction, boosting engineering productivity, and reducing operational costs. This article delves into the primary tasks involved in AIOps, such as anomaly detection, and log fault analysis and classification. A significant challenge identified in many AIOps tasks is the scarcity of fault sample data, indicating a natural alignment of these tasks with few-shot learning. Inspired by model-agnostic meta-learning (MAML), we propose a new anomaly detector, MAML-KAD, for application in various AIOps tasks. Observations confirm that meta-learning algorithms effectively enhance AIOps tasks, showcasing the wide-ranging application prospects of meta-learning algorithms in the field of AIOps. Moreover, we introduced an AIOps platform that embeds meta-learning within its diagnostic core and features streamlined log collection, caching, and alerting to automate the AIOps workflow.

The telemetry data of spacecraft is an ultra-high dimensional time series used to indicate on-orbit operation status, and anomaly detection can effectively ensure safety and reliability. Aiming at the characteristics and complex correlation of high dimensional telemetry data, this paper proposes a novel anomaly detection method based on Generative Adversarial Networks (GAN) for telemetry data anomaly detection. Instead of treating each variable independently, our proposed method captures the latent representation amongst multi-dimensional time series. For normal data, the GAN-based anomaly detection method can obtain a reconstructed time series similar to the original time series, learning the probability distribution model of normal data. For abnormal data, the reconstructed time series deviates greatly from the original time series. In the GAN framework, we use Long Short-Term Memory (LSTM) as the network structure of generator for time series reconstruction and discriminator for calculating the probability of being the real time series, which can learn the temporal features of telemetry data. We also propose a novel anomaly score called GDScore, which comprehensively considers the reconstruction error of the generator and the output of the discriminator. We conduct experiments with two telemetry datasets, which verifies that our proposed GAN-based anomaly detection method can effectively detect outliers.

On-orbit anomaly detection is an open problem for long-term management of satellites, in which defining and extracting effective features based on satellite telemetry data is one of the key points. Classical spectral analytic methods such as Fourier analysis, Wavelet analysis methods and other signal processing methods have make contributions to the cognition and management of satellite telemetry data. However, with satellite running on orbit and huge data accumulated, it is difficult to utilize and cognize the telemetry data features due to the discrete values, huge volumes, containing large noise, loss of data and complex anomaly, which makes the features of telemetry data non-significant and hinders the anomaly detection of telemetry data. This paper proposes a set of fluctuation feature of satellite telemetry data, called state-counting method (SCM), in which the changing frequency and amplitude of satellite telemetry data are extracted to describe the fluctuation features of satellite telemetry data. This extraction method is feasible and efficient, and is not sensitive to noise and outliers in the telemetry data. Based on the fluctuation features, an efficient anomaly detection method based on SPRT is proposed. Comparison of the approach with others shows that the fluctuation features proposed in this article can be used to recognize the normal and anomaly satellite states. From the index system of scoring, this approach has high computational efficiency and better detection performance.

Single feature is difficult to achieve a comprehensive description of the complex orbiting spacecraft telemetry data characteristics and is easy to lose telemetry data information, but the statistical distribution operators can fully reflect the characteristics of statistical distribution information. Aiming at the orbiting telemetry data which meets the character of local stability, we propose an anomaly detection algorithm which is based on the characteristics of concentration, discrete characteristic, shape and boundary in the statistical distribution. Four kinds of statistical features are represented by the distribution characteristic operator, and the different distribution features of abnormal patterns are weighted to construct an efficient model for the anomaly detection of multidimensional feature vectors, which can effectively detect the abnormal changes of the local stationary telemetry data of the spacecraft on orbit in the complex space environment. The experiment results of a satellite power system telemetry sequence anomaly detection indicate that the algorithm can effectively detect the change of amplitude, trend and periodic and complex mutation of telemetry data, and the detection effect is robust.

In the field of launch vehicles, high launch density, heavy work intensity and large data volume have brought the traditional automatic anomaly detection with incomplete coverage, and complex design of criterion, which influencing performance evaluation of launch vehicle. In order to fully mine the data variation law implied in the massive telemetry data, the intelligent anomaly detection algorithm is proposed and designed as a beneficial supplement to the traditional anomaly detection algorithm, and improve the anomaly detection coverage and efficiency. With the telemetry data generated by the liquid launch vehicle taken as the research object, and the intelligent anomaly detection algorithm is compared with the traditional algorithm. It is shown that the algorithm proposed adapts to the anomaly detection scenarios with frequency anomaly and frame loss, which may be difficult for traditional algorithms to design anomaly detection criteria, and the average anomaly detection performance is improved by nearly 30% and the variance is reduced by 85%, providing a reference for improving anomaly detection system and applying intelligent anomaly detection algorithms in aerospace.

The Geostationary Korea Multi-Purpose Satellites 2A and 2B (GK2A and GK2B), developed by Korea Aerospace Research Institute (KARI), were launched in 2018 and 2020, respectively. Following their successful launches and early operation phases (LEOP), the satellites settled into geostationary orbit and began daily monitoring of weather, atmospheric, and oceanic conditions surrounding the Korean Peninsula. This study proposes an enhanced S-band Consultative Committee for Space Data Systems (CCSDS) data format and telemetry packet transmission strategy to ensure reliable and efficient satellite data management while supporting real-time anomaly detection. The proposed data format divides the CCSDS data region into two fixed-length telemetry packet transmission zones and an event log transmission area. For each data area, three packet operation strategies are suggested to improve satellite operation efficiency. Additionally, essential telemetry data for each satellite operation mode is categorized, and a method for managing the downlink transmission interval using packet group IDs is proposed to prioritize critical information during key mission phases. This approach includes a method for detecting anomalies within one second, enabling the immediate transmission of anomaly events for prompt response. The effectiveness of the proposed GK2 S-band satellite data format, anomaly detection, and operation strategies are validated using in-orbit telemetry and event data obtained during the LEOP operations of GK2A in 2018.

The process of human exploration of the universe has accelerated, and aerospace technology has developed rapidly. The health management and prognosis guarantee of spacecraft systems has become an important basic technology. However, with thousands of telemetry data channels and massive data scales, spacecraft systems are increasingly complex. The anomaly detection that relied on simple threshold judgment and expert manual annotation in the past is no longer applicable. In addition, the particularity of the anomaly detection task leads to the lack of fault data for training. Therefore, a data-driven deep transfer learning-based approach is needed for rapid analysis and accurate detection of large-scale data. The control moment gyroscope (CMG) is a significant inertial actuator in the process of large-scale, long-life spacecraft in-orbit operation and mission execution. Its anomaly detection plays a major role in the prevention and elimination of early failures. Based on the research of SincNet and Long Short-Term Memory (LSTM) networks, this paper proposed a Sinc-LSTM neural network based on transfer learning and working condition classification for CMG anomaly detection. First, a two-stage pre-training method is proposed to alleviate the data imbalance, using the Mars Reconnaissance Orbiter (MRO) dataset and a satellite dataset from NASA. Second, the Sinc-LSTM network is designed to enhance the local fitting and long-period memory ability of the model for CMG time series data. Finally, a dynamic threshold judgment anomaly detection method based on working condition classification is designed to accommodate threshold changes for CMG full-cycle anomaly detection. The method is validated on the spacecraft CMG dataset.

Modern software applications increasingly rely on microservice architectures for scalability, flexibility, and rapid deployment. However, this architectural paradigm introduces new complexities in monitoring system behavior, identifying anomalies, and determining their root causes across distributed services. Existing solutions often address anomaly detection and root cause analysis (RCA) in isolation, leading to fragmented insights and delayed resolution. This paper proposes a unified framework that integrates real-time anomaly detection with automated RCA using machine learning and graph-based dependency modeling. The framework continuously monitors telemetry data—including metrics, logs, and traces—and applies an ensemble of statistical and deep learning models for multivariate anomaly detection. Detected anomalies are then contextualized through a service dependency graph and analyzed using causal inference techniques to identify the most probable root causes. We evaluate the framework on both synthetic benchmarks and real-world microservice deployments. Experimental results show that it achieves high precision and recall in anomaly detection while significantly reducing RCA latency compared to baseline methods. By combining anomaly detection and RCA in a cohesive pipeline, the proposed framework enhances system observability and reduces mean time to recovery (MTTR), thus improving operational resilience in complex microservice environments.

Cloud-native infrastructures built on microservices, containers, and distributed tracing systems generate massive volumes of heterogeneous telemetry data, including logs, metrics, and traces. Traditional rule-based anomaly detection techniques are increasingly inadequate due to their rigidity, high false positive rates, and inability to adapt to dynamic workloads. This paper introduces a machine learning-based anomaly detection model of cloud logs and distributed traces that uses machine learning and deep learning frameworks to detect anomalous behavior in a system in real-time. The proposed system incorporates multi-modal telemetry over a scalable Kubernetes implementation and implements methods including Isolation Forest and Autoencoders to perform unsupervised anomaly detection. By fusing log and trace data, the framework captures both semantic and structural dependencies across distributed services. Experimental evaluation in a simulated cloud environment demonstrates strong performance, achieving precision of up to 0.92, recall of 0.95, and F1-score of 0.94 for container escape detection, while maintaining an AUC above 0.95 across scenarios. Resource abuse detection had a precision of 0.91 and recall of 0.93, and unauthorized API usage had an F1-score of 0.89. These outcomes demonstrate high accuracy, memory and strength over the baseline models, which is why the method can be used in contemporary cloud security applications. It also addresses the aspect of scaling and real-time deployment in the setting of a production environment.

Reducing false positives while detecting anomalies is of growing importance for various industrial applications and mission-critical infrastructures, including satellite systems. Undesired false positives can be costly for such systems, bringing the operation to a halt for human experts to determine if the anomalies are true anomalies that need to be mitigated. Although rule-based or machine learning-based anomaly detection approaches have been studied, a tensor-based decomposition method has not been extensively explored. In this work, we introduce an Integrative Tensor-based Anomaly Detection (ITAD) framework to detect anomalies in a satellite system with the goal of minimizing false positives. We construct 3rd-order tensors with telemetry data collected from the Korea Multi-Purpose Satellite-2 (KOMPSAT-2) and calculate the anomaly score using one of the component matrices obtained by applying CANDECOMP/PARAFAC decomposition to detect anomalies. Our result shows that our tensor-based approach outperforms existing methods, achieving higher accuracy and lower false positive rates. And we successfully deployed our anomaly detection system in real KOMPSAT-2 mission operation.

Recent technology evolution allows network equipment to continuously stream a wealth of "telemetry" information, which pertains to multiple protocols and layers of the stack, at a very fine spatial-grain and high-frequency. This deluge of telemetry data clearly offers new opportunities for network control and troubleshooting, but also poses a serious challenge for what concerns its real-time processing. We tackle this challenge by applying streaming machine-learning techniques to the continuous flow of control and data-plane telemetry data, with the purpose of real-time detection of anomalies. In particular, we implement an anomaly detection engine that leverages DenStream, an unsupervised clustering technique, and apply it to features collected from a large-scale testbed comprising tens of routers traversed up to 3Terabit/s worth of real application traffic. We contrast DenStream with offline algorithms such as DBScan and Local Outlier Factor (LOF), as well as online algorithms such as the windowed version of DBScan, ExactSTORM, Continuous Outlier Detection (COD) and Robust Random Cut Forest (RRCF). Our experimental campaign compares these seven algorithms under both accuracy and computational complexity viewpoints: results testify that DenStream (i) achieves detection results on par with RRCF, the best performing algorithm and (ii) is significantly faster than other approaches, notably over two orders of magnitude faster than RRCF. In spirit with the recent trend toward reproducibility of results, we make our code available as open source to the scientific community.

Reducing satellite failures and keeping satellites healthy in orbit are important issues. Current satellite systems have developed modules to detect anomalies on board. However, they only target a subset of anomaly types and heavily rely on expert knowledge. To address these limitations, this paper proposes a data-driven anomaly detection framework to detect point anomalies. We first propose the Deviation Divide Mean over Neighbors (DDMN) method to figure out the fake anomaly problem caused by data errors in the satellite telemetry data. Then, we use the Long Short-Term Memory (LSTM), a deep learning method, to model the multivariable time-series data, and a Gaussian model to detect anomalies. We applied our approach to the telemetry data collected from sensors on an in-orbit satellite for more than two years and demonstrate its superiority. Moreover, we explored what conditions could lead to false alarms. The approach proposed has been deployed to the ground station to monitor the health status of the in-orbit satellites.

Satellite telemetry data contains satellite status information, and ground-monitoring personnel need to promptly detect satellite anomalies from these data. This paper takes the satellite power subsystem as an example and presents a reliable anomaly detection method. Due to the lack of abnormal data, the autoencoder is a powerful method for unsupervised anomaly detection. This study proposes a novel stage-training denoising autoencoder (ST-DAE) that trains the features, in stages. This novel method has better reconstruction capabilities in comparison to common autoencoders, sparse autoencoders, and denoising autoencoders. Meanwhile, a cluster-based anomaly threshold determination method is proposed. In this study, specific methods were designed to evaluate the autoencoder performance in three perspectives. Experiments were carried out on real satellite telemetry data, and the results showed that the proposed ST-DAE generally outperformed the autoencoders, in comparison.