MSFlow: Multiscale Flow-Based Framework for Unsupervised Anomaly Detection.

Anomaly detection is the process of identifying unexpected items or events in datasets, which differ from the norm. In contrast to standard classification tasks, anomaly detection is often applied on unlabeled data, taking only the internal structure of the dataset into account. This challenge is known as unsupervised anomaly detection and is addressed in many practical applications, for example in network intrusion detection, fraud detection as well as in the life science and medical domain. Dozens of algorithms have been proposed in this area, but unfortunately the research community still lacks a comparative universal evaluation as well as common publicly available datasets. These shortcomings are addressed in this study, where 19 different unsupervised anomaly detection algorithms are evaluated on 10 different datasets from multiple application domains. By publishing the source code and the datasets, this paper aims to be a new well-funded basis for unsupervised anomaly detection research. Additionally, this evaluation reveals the strengths and weaknesses of the different approaches for the first time. Besides the anomaly detection performance, computational effort, the impact of parameter settings as well as the global/local anomaly detection behavior is outlined. As a conclusion, we give an advise on algorithm selection for typical real-world tasks.

Supervised deep learning approaches provide state-of-the-art performance on medical image classification tasks for disease screening. However, these methods require large labeled datasets that involve resource-intensive expert annotation. Further, disease screening applications have low prevalence of abnormal samples; this class imbalance makes the task more akin to anomaly detection. While the machine learning community has proposed unsupervised deep learning methods for anomaly detection, they have yet to be characterized on medical images where normal vs. anomaly distinctions may be more subtle and variable. In this work, we characterize existing unsupervised anomaly detection methods on retinal fundus images, and find that they require significant fine tuning and offer unsatisfactory performance. We thus propose an efficient and effective transfer-learning based approach for unsupervised anomaly detection. Our method employs a deep convolutional neural network trained on ImageNet as a feature extractor, and subsequently feeds the learned feature representations into an existing unsupervised anomaly detection method. We show that our approach significantly outperforms baselines on two natural image datasets and two retinal fundus image datasets, all with minimal fine-tuning. We further show the ability to leverage very small numbers of labelled anomalies to improve performance. Our work establishes a strong unsupervised baseline for image-based anomaly detection, alongside a flexible and scalable approach for screening applications.

Guided wave-based structural health monitoring is extensively utilized in various industrial applications to ensure the integrity of components within industrial systems. Among these monitoring techniques, principal component analysis (PCA) reconstruction methods are widely used for anomaly detection due to their computational efficiency and interoperability. However, existing PCA reconstruction methods are semisupervised anomaly detection approaches that require training on historical normal data and fail to detect anomalous signals within the training set. To address this limitation, this work proposes a correntropy PCA (C-PCA), enabling fully unsupervised anomaly detection on raw training data without requiring label information, when the dataset contains a high proportion of abnormal signals. This method allows anomaly detection on real-time measurements without the need for precleaned historical normal data or can also be used to generate clean data for existing semisupervised anomaly detection methods. In correntropy PCA, principal components are extracted from the correntropy matrix rather than the correlation matrix. The correntropy, representing the statistical dependence between samples of guided waves, is estimated utilizing a Gaussian kernel with a specified kernel width. Through the optimization of the kernel width, the correntropy PCA reconstruction method demonstrates superior anomaly detection performance compared with the standard PCA reconstruction method, especially in scenarios where training data are contaminated by a significant proportion of abnormal signals. Guidelines for the optimization of the kernel width are provided. The effectiveness of the correntropy PCA reconstruction-based anomaly detection method is validated using data collected from ten regions over an 80-day period, encompassing guided waves induced by damage occurring over durations ranging from 2 to 20 days.

To defend a network system from security risks, intrusion detection systems (IDSs) have been playing an important role in recent years. There are two types of detection algorithms of IDSs: misuse detection and anomaly detection. Because misuse detection is based on a signature which is created from the features of attack traffic by security experts, it can achieve accurate and stable detection. However, its weakness is the difficulty of detecting new attacks (i.e., 0-day attack), and the cost of maintaining the latest signature version. Thinking of the increase of the skillful intrusion, e.g., intrusion showing similar access behavior to normal, misuse detection cannot handle these critical attacks, which results in a large number of false alarms. To cope with these problems, we present a clustering algorithm based on an unsupervised anomaly detection. We evaluated our system using Kyoto2006+ data set and KDD Cup 1999 data set. Evaluation results show that our approach achieved a higher detection rate in the region of very low false positive rate and real-time preprocessing capability.

Effectively monitoring the operational status of reactor coolant pumps (RCPs) is crucial for enhancing the safety and stability of nuclear power operations. To address the challenges of limited interpretability and suboptimal detection performance in existing methods for detecting abnormal operating states of RCPs, this paper proposes an interpretable, unsupervised anomaly detection approach. This innovative method designs a framework that combines Kernel Self-Organizing Map (Kernel SOM) clustering with Bayesian Posterior Inference. Specifically, the proposed method uses Kernel SOM to extract typical patterns from normal operation data. Subsequently, a distance probability distribution model reflecting the data distribution structure within each cluster is constructed, providing a robust tool for data distribution analysis for anomaly detection. Finally, based on prior knowledge, such as distance probability distribution, the Bayesian Posterior Inference is employed to infer the probability of the equipment being in a normal state. By constructing distribution models that reflect data distribution structures and combining them with posterior inference, this approach realizes the traceability and interpretability of the anomaly detection process, improving the transparency of anomaly detection and enabling operators to understand the decision logic and the analysis of the causes of anomalous occurrences. Verification via real-world operational data demonstrates the method’s superior effectiveness. This work offers a highly interpretable solution for RCP anomaly detection, with significant implications for safety-critical applications in the nuclear energy sector.

Anomaly detection (AD) aims to distinguish the data points that are inconsistent with the overall pattern of the data. Recently, unsupervised anomaly detection methods have aroused huge attention. Among these methods, feature representation (FR) plays an important role, which can directly affect the performance of anomaly detection. Sparse representation (SR) can be regarded as one of matrix factorization (MF) methods, which is a powerful tool for FR. However, there are some limitations in the original SR. On the one hand, it just learns the shallow feature representations, which leads to the poor performance for anomaly detection. On the other hand, the local geometry structure information of data is ignored. To address these shortcomings, a graph regularized deep sparse representation (GRDSR) approach is proposed for unsupervised anomaly detection in this work. In GRDSR, a deep representation framework is first designed by extending the single layer MF to a multilayer MF for extracting hierarchical structure from the original data. Next, a graph regularization term is introduced to capture the intrinsic local geometric structure information of the original data during the process of FR, making the deep features preserve the neighborhood relationship well. Then, a L1-norm-based sparsity constraint is added to enhance the discriminant ability of the deep features. Finally, a reconstruction error is applied to distinguish anomalies. In order to demonstrate the effectiveness of the proposed approach, we conduct extensive experiments on ten datasets. Compared with the state-of-the-art methods, the proposed approach can achieve the best performance.

Data anomaly detection plays a pivotal role in structural health monitoring (SHM), enabling reliable and accurate assessment of structural condition. This paper proposes an unsupervised anomaly detection method based on the spatio-temporal sparse integration framework (STSIF), which aims to effectively distinguish various types of anomalous patterns in practical applications. First, the anomaly patterns are classified into three-level categories—normal, mild anomaly, and significant anomaly—and then a three-stage unsupervised anomaly detection framework is designed for these categories. At each stage, the characteristics-based detection indicators are proposed to detect significant, mild, and local anomaly progressively. For significant anomaly, the spatial-sparse fusion indicator is proposed and clustered with the unsupervised Gaussian mixture model (GMM). For mild anomaly, the sparse-based reconstruction detection method is proposed for qualitative analysis of noise levels, in which the Pearson correlation between the original and sparse-based reconstructed signal is computed for the GMM clustering. Overall accuracy of 98.36% and 95.51% is obtained for the data sets on two real-world bridges, respectively. Finally, regarding local anomaly detection, the proposed mask-based ResNet18 effectively emphasizes the local contextual information within the signal and substantially reduces the risk of overgeneralization. In summary, the proposed STSIF could efficiently detect various anomaly patterns without substantial training data or complex parameter tuning, providing a comprehensive detection paradigm for SHM.

An increase in the collection of physiological signals, whether done implicitly in wearable or IoT device or explicitly in experimental and laboratory environments, creates the need for development of smart systems and tools capable of data analysis with limited expert knowledge. Anomaly detection, specifically unsupervised anomaly detection can be used to design a tool or even as a tool to help remedy this issue. This paper will focus on how unsupervised anomaly detection can be utilized for the development of such systems. A systematic, robust, and customizable approach will be presented and preliminary results will be shown that open the door for future research and algorithm development.

BackgroundChemical exchange saturation transfer (CEST) magnetic resonance imaging (MRI) demonstrates significant potential for early disease detection, yet encounters challenges in lesion analysis due to interference from concomitant effects during imaging. Although machine learning-based unsupervised anomaly detection (UAD) methods offer feasible solutions for identifying subtle lesions in contaminated images, current UAD approaches primarily dependent on convolutional neural network (CNN) or Transformer architectures to process image-level data from conventional imaging modalities, exhibit limitations when applied to CEST data characterized by spectral information. This study aimed to propose a novel UAD framework tailored for CEST spectral data to overcome these limitations, enabling precise pixel-wise anomaly detection for early-stage lesions.MethodsThe proposed framework named Mamba-AE employs a multi-layers encoder-decoder architecture with stacked Mamba blocks as the core component. Each Mamba block integrates three key modules: selective state-space models (SSMs) to dynamically adjust parameters based on input sequences, enabling adaptive long-range dependency modeling of CEST spectral data; Gated Multi-Layer Perceptron with Sigmoid Linear Unit (SiLU) activation and residual connections to enhance non-linear feature learning and stability; Multi-Scale Feature Alignment that aligns hierarchical encoder-decoder features via cosine similarity, preserving physiological semantics across scales. The framework adopts a dual-domain reconstruction strategy: data-space reconstruction minimizes pixel-wise spectral errors through Huber loss, while feature-space reconstruction enforces consistency between paired encoder-decoder layer features via cosine similarity loss. Anomaly scores are generated by combining normalized residuals from data-space errors and discrepancies in feature-space alignment, enabling precise pixel-level lesion localization in early-stage CEST data. For quantitative evaluation of lesion detection performance, the area under the curve (AUC) and Dice similarity coefficient are employed as core metrics. The framework was trained exclusively on CEST spectra from healthy rat brain tissue and validated on an independent dataset from a rat model of transient focal cerebral ischemia induced by middle cerebral artery occlusion (MCAO) with reperfusion.ResultsThe proposed method has been validated on ischemic stroke rat datasets at 2, 6, and 24 hours post-occlusion. Mamba-AE demonstrated superior performance across all stages. At the critical 2-hour time point, it achieved the highest performance among all methods, with an AUC of 95.91% and a Dice score of 88.43% (sensitivity >89%, specificity >92%). The advantage remained substantial at 6 hours (AUC: 92.19%, Dice: 85.23%) and 24 hours (AUC: 94.64%, Dice: 87.79%), consistently outperforming other approaches. Furthermore, anomaly heatmaps revealed precise lesion localization capabilities, with spatial accuracy correlating strongly with histopathological ground truth measurements.ConclusionsMamba-AE provides a computationally efficient and robust solution for early disease detection in CEST MRI. Its integration of spectral feature learning and structural preservation highlights its potential for clinical applications requiring high sensitivity to subtle pathological changes.

Purpose: The target disorders of emergency head CT are wide-ranging. Therefore, people working in an emergency department desire a computer-aided detection system for general disorders. In this study, we proposed an unsupervised anomaly detection method in emergency head CT using an autoencoder and evaluated the anomaly detection performance of our method in emergency head CT. Methods: We used a 3D convolutional autoencoder (3D-CAE), which contains 11 layers in the convolution block and 6 layers in the deconvolution block. In the training phase, we trained the 3D-CAE using 10,000 3D patches extracted from 50 normal cases. In the test phase, we calculated abnormalities of each voxel in 38 emergency head CT volumes (22 abnormal cases and 16 normal cases) for evaluation and evaluated the likelihood of lesion existence. Results: Our method achieved a sensitivity of 68% and a specificity of 88%, with an area under the curve of the receiver operating characteristic curve of 0.87. It shows that this method has a moderate accuracy to distinguish normal CT cases to abnormal ones. Conclusion: Our method has potentialities for anomaly detection in emergency head CT.

In vivo confocal microscopy (IVCM) is a crucial imaging modality for assessing corneal diseases, yet distinguishing pathological features from normal variations remains challenging due to the complex multi-layered corneal structure. Existing anomaly detection methods often struggle to generalize across diverse disease manifestations. To address these limitations, we propose a Transformer-based unsupervised anomaly detection method for IVCM images, capable of identifying corneal abnormalities without prior knowledge of specific disease features. Our method consists of three submodules: an EfficientNet network, a Multi-Scale Feature Fusion Network, and a Transformer Network. A total of 7,063 IVCM images (95 eyes) were included for analysis. The model was trained exclusively on normal IVCM images to capture and differentiate structural variations across four distinct corneal layers: epithelium, sub-basal nerve plexus, stroma, and endothelium. During inference, anomaly scores were computed to distinguish pathological from normal images. The model's performance was evaluated on both internal and external datasets, and comparative analyses were conducted against existing anomaly detection methods, including generative adversarial networks (AnoGAN), generate to detect anomaly model (G2D), and discriminatively trained reconstruction anomaly embedding model (DRAEM). Additionally, explainable anomaly maps were generated to enhance the interpretability of model decisions. The proposed method achieved an the areas under the receiver operating characteristic curve of 0.933 on internal validation and 0.917 on an external test dataset, outperforming AnoGAN, G2D, and DRAEM in both accuracy and generalizability. The model effectively distinguished normal and pathological images, demonstrating statistically significant differences in anomaly scores (p < 0.001). Furthermore, visualization results indicated that the detected anomalous regions corresponded to morphological deviations, highlighting potential imaging biomarkers for corneal diseases. This study presents an efficient and interpretable unsupervised anomaly detection model for IVCM images, effectively identifying corneal abnormalities without requiring labeled pathological samples. The proposed method enhances screening efficiency, reduces annotation costs, and holds great potential for scalable intelligent diagnosis of corneal diseases.

The detection of anomalous structures in natural image data is of utmost importance for numerous tasks in the field of computer vision. The development of methods for unsupervised anomaly detection requires data on which to train and evaluate new approaches and ideas. We introduce the MVTec Anomaly Detection (MVTec AD) dataset containing 5354 high-resolution color images of different object and texture categories. It contains normal, i.e., defect-free, images intended for training and images with anomalies intended for testing. The anomalies manifest themselves in the form of over 70 different types of defects such as scratches, dents, contaminations, and various structural changes. In addition, we provide pixel-precise ground truth regions for all anomalies. We also conduct a thorough evaluation of current state-of-the-art unsupervised anomaly detection methods based on deep architectures such as convolutional autoencoders, generative adversarial networks, and feature descriptors using pre-trained convolutional neural networks, as well as classical computer vision methods. This initial benchmark indicates that there is considerable room for improvement. To the best of our knowledge, this is the first comprehensive, multi-object, multi-defect dataset for anomaly detection that provides pixel-accurate ground truth regions and focuses on real-world applications.

Nowadays, systems providing user-oriented services often demonstrate periodic patterns due to the repetitive behaviors from people's daily routines. The monitoring data of such systems are time series of observations that record observed system status at sampled times during each day. The periodic feature and multidimensional character of such monitoring data can be well utilized by anomaly detection algorithms to enhance their detection capability. The data periodicity can be used to provide proactive anomaly prediction capability and the correlation among multidimensional series can provide more accurate results than processing the observations separately. However, existing anomaly detection methods only handle one dimensional series and do not consider the data periodicity. In addition, they often require sufficient labelled data to train the models before they can be used. In this paper, we present an unsupervised anomaly detection algorithm called Periodic Self-Organizing Maps (PSOM) to detect anomalies in periodic time series. PSOMs can be used to detect anomalies in multidimensional periodic series as well as one dimensional periodic series and aperiodic series. Our real data evaluation shows that the PSOM outperforms other supervised methods such as SARIMA and Holt-Winters method.

With the realisation of the Internet of Things (IoT) paradigm, the analysis of the Activities of Daily Living (ADLs), in a smart home environment, is becoming an active research domain. The existence of representative datasets is a key requirement to advance the research in smart home design. Such datasets are an integral part of the visualisation of new smart home concepts as well as the validation and evaluation of emerging machine learning models. Machine learning techniques that can learn ADLs from sensor readings are used to classify, predict and detect anomalous patterns. Such techniques require data that represent relevant smart home scenarios, for training, testing and validation. However, the development of such machine learning techniques is limited by the lack of real smart home datasets, due to the excessive cost of building real smart homes. This paper provides two datasets for classification and anomaly detection. The datasets are generated using OpenSHS, (Open Smart Home Simulator), which is a simulation software for dataset generation. OpenSHS records the daily activities of a participant within a virtual environment. Seven participants simulated their ADLs for different contexts, e.g., weekdays, weekends, mornings and evenings. Eighty-four files in total were generated, representing approximately 63 days worth of activities. Forty-two files of classification of ADLs were simulated in the classification dataset and the other forty-two files are for anomaly detection problems in which anomalous patterns were simulated and injected into the anomaly detection dataset.

Unsupervised anomaly detection in pressurized water reactor digital twins using autoencoder neural networks