Object-Centric Anomaly Detection Using Memory Augmentation

Outlier detection is to separate anomalous data from inliers in the dataset. Recently, the most deep learning methods of outlier detection leverage an auxiliary reconstruction task by assuming that outliers are more difficult to recover than normal samples (inliers). However, it is not always true in deep auto-encoder (AE) based models. The auto-encoder based detectors may recover certain outliers even if outliers are not in the training data, because they do not constrain the feature learning. Instead, we think outlier detection can be done in the feature space by measuring the distance between outliers' features and the consistency feature of inliers. To achieve this, we propose an unsupervised outlier detection method using a memory module and a contrastive learning module (MCOD). The memory module constrains the consistency of features, which merely represent the normal data. The contrastive learning module learns more discriminative features, which boosts the distinction between outliers and inliers. Extensive experiments on four benchmark datasets show that our proposed MCOD performs well and outperforms eleven state-of-the-art methods.

Anomaly detection is one of the basic issues in data processing that addresses different problems in healthcare sensory data. Technology has made it easier to collect large and highly variant time series data; however, complex predictive analysis models are required to ensure consistency and reliability. With the rise in the size and dimensionality of collected data, deep learning techniques, such as autoencoder (AE), recurrent neural networks (RNN), and long short-term memory (LSTM), have gained more attention and are recognized as state-of-the-art anomaly detection techniques. Recently, developments in transformer-based architecture have been proposed as an improved attention-based knowledge representation scheme. We present an unsupervised transformer-based method to evaluate and detect anomalies in electrocardiogram (ECG) signals. The model architecture comprises two parts: an embedding layer and a standard transformer encoder. We introduce, implement, test, and validate our model in two well-known datasets: ECG5000 and MIT-BIH Arrhythmia. Anomalies are detected based on loss function results between real and predicted ECG time series sequences. We found that the use of a transformer encoder as an alternative model for anomaly detection enables better performance in ECG time series data. The suggested model has a remarkable ability to detect anomalies in ECG signal and outperforms deep learning approaches found in the literature on both datasets. In the ECG5000 dataset, the model can detect anomalies with 99% accuracy, 99% F1-score, 99% AUC score, 98.1% recall, and 100% precision. In the MIT-BIH Arrhythmia dataset, the model achieved an accuracy of 89.5%, F1 score of 92.3%, AUC score of 93%, recall of 98.2%, and precision of 87.1%.

Deep anomaly detection models using a supervised mode of learning usually work under a closed set assumption and suffer from overfitting to previously seen rare anomalies at training, which hinders their applicability in a real scenario. In addition, obtaining annotations for X-rays is very time consuming and requires extensive training of radiologists. Hence, training anomaly detection in a fully unsupervised or self-supervised fashion would be advantageous, allowing a significant reduction of time spent on the report by radiologists. In this paper, we present SALAD, an end-to-end deep self-supervised methodology for anomaly detection on X-Ray images. The proposed method is based on an optimization strategy in which a deep neural network is encouraged to represent prototypical local patterns of the normal data in the embedding space. During training, we record the prototypical patterns of normal training samples via a memory bank. Our anomaly score is then derived by measuring similarity to a weighted combination of normal prototypical patterns within a memory bank without using any anomalous patterns. We present extensive experiments on the challenging NIH Chest X-rays and MURA dataset, which indicate that our algorithm improves state-of-the-art methods by a wide margin.

Attribute Subspace Partitioning with Neural Regression for Contextual Outlier Detection

Time series anomaly detection is the process of identifying anomalies within time series data. The primary challenge of this task lies in the necessity for the model to comprehend the characteristics of time-independent and abnormal data patterns. In this study, a novel algorithm called adaptive memory broad learning system (AdaMemBLS) is proposed for time series anomaly detection. This algorithm leverages the rapid inference capabilities of the broad learning algorithm and the memory bank's capacity to differentiate between normal and abnormal data. Furthermore, an incremental algorithm based on multiple data augmentation techniques is introduced and applied to multiple ensemble learners, thereby enhancing the model's effectiveness in learning the characteristics of time series data. To bolster the model's anomaly detection capabilities, a more diverse ensemble approach and a discriminative anomaly score are recommended. Extensive experiments conducted on various real-world datasets demonstrate that the proposed method exhibits superior inference speed and more accurate anomaly detection compared to the existing competitors. A detailed experimental investigation is presented to elucidate the effectiveness of the proposed method and the underlying reasons for its efficacy.

Anomaly detection is of great importance due to its wide application in industrial areas. Deep auto-encoders have enabled significant advances in anomaly detection over the past decade. However, it has been observed that sometimes the auto-encoder are likely to reconstruct anomalies due to the “excellent” generalization ability, resulting in the miss detection of anomalies. To mitigate this deficiency, scholars have proposed the memory-augmented deep auto-encoder method recently. However, more recent work on memory-augmented uses continuous memory representations or key-values pairs in memory for read/write without forgetting mechanism, and it is assumed that data such as early access to the network are normal data. To deal with those imperfectness, we present a VAE-based memory-augmented network with a trained memory network: MEMVAE, addressing scheme to provide a strong guarantee to detect anomalous. In particular, Gated Recurrent Unit (GRU) cells are employed as the encoder and decoder to capture latent temporal structure. We then train an external memory module that records common patterns of the prototype. In addition, we present a weighted regular score that simply updates our memory entries. Our detector reports a reconstruction probability as the anomaly score. Experimental results on tabular data and time series data show that MEMVAE demonstrates significant improvements and better performance.

Most data collected in real-world scenarios is contaminated, adversely affecting the performance of existing anomaly detection methods that typically rely on clean training data to learn normal patterns. While some approaches have made progress in addressing data contamination, they still face the following challenges: 1) Most methods use pixel-level constraints between the contaminated and reconstructed data as the training loss, and the contaminated data is preferentially learned due to the larger error; 2) Current anomaly detection methods based on frequency-domain do not fully utilize the complex spectral characteristics nor the cross-domain consistency of time series data, which limits the further improvement of the anomaly detection performance. This paper proposes a filter-enhanced reconstruction network with domain-adversarial training for multivariate time series anomaly detection (FERDA), which enables the model to extract normal patterns and high-level semantic information more accurately by training with the error of filtered and reconstructed data. FERDA designs a dual-domain contamination filtering module consisting of the multi-head memory module and the complex linear network. The module is trained to learn normal patterns and cross-domain information through adversarial learning of intra-domain semantic consistency and inter-domain distinguishability. Moreover, a two-stage contamination suppression strategy is proposed. The contamination degree of data is quantified by the difference between pre- and post-filtering, and the impact of contamination is further mitigated by two-stage training with different losses. The proposed method outperforms 23 state-of-the-art baselines in experiments on five benchmark datasets across different domains.

In industry, sensor-based monitoring of equipment or environment has become a necessity. Instead of using a single sensor, multi-sensor system is used to fully detect abnormalities in complex scenarios. Recently, physical models, signal processing technology, and various machine learning models have improved the performance. However, these methods either do not consider the potential correlation between features or do not take advantage of the sequential changes of correlation while constructing an anomaly detection model. This paper firstly analyzes the correlation characteristic of a multi-sensor system, which shows a lot of clues to the anomaly/fault propagation. Then, a multi-sensor anomaly detection method, which finds and uses the correlation between features contained in the multidimensional time-series data, is proposed. The method converts the multidimensional time-series data into temporal correlation graphs according to time window. By transforming time-series data into graph structure, the task of anomaly detection is considered as a graph classification problem. Moreover, based on the stability and dynamics of the correlation between features, a structure-sensitive graph neural network is used to establish the anomaly detection model, which is used to discover anomalies from multi-sensor system. Experiments on three real-world industrial multi-sensor systems with anomalies indicate that the method obtained better performance than baseline methods, with the mean value of F1 score reaching more than 0.90 and the mean value of AUC score reaching more than 0.95. That is, the method can effectively detect anomalies of multidimensional time series.

Real-time anomaly detection based on long short-Term memory and Gaussian Mixture Model

Several computer vision algorithms have been proposed to detect anomalous activities (robberies, murders, vandalism, among others) in videos. According to the learning approach, they can be classified into probabilistic distribution modeling, sparse coding, and deep learning based methods. The main drawbacks of these approaches are (i) extraction of low-level features that do not capture complex behaviors of instances on the scene, (ii) generation of features from irrelevant regions, (iii) overlooking of relationships among objects, and (iv) omission of long-term dependencies. To solve these issues, we propose a deep learning architecture that leverages the relationships among objects. It achieves this by using an attention mechanism and learning long-term dependencies using a multilayer recurrent neural network (multilayer LSTM). An AUC score of 0.749 on the UCF-Crime dataset confirms that the proposed algorithm competes effectively against several state-of-the-art approaches for anomaly detection in surveillance videos. It also explains the relationship between regions in the video frames and the anomaly detections.

This paper explores the use of several ensemble learning algorithms Gradient Boosting, XGBoost, LightGBM, Bagging, AdaBoost, and Voting Classifier on the CICIoT2023 dataset within the framework of Industrial Internet of Things (IIoT) and Intrusion Detection Systems (IDS). The main goal is to improve anomaly detection and predictive maintenance in smart manufacturing environments. The models' performance was assessed using key metrics such as precision, recall, accuracy, F1 score, and ROC AUC score, in addition to evaluating their training and prediction times. Results show that Bagging and Voting Classifiers achieved the highest accuracy and ROC AUC scores, making them highly effective for complex detection tasks. However, XGBoost and LightGBM demonstrated superior computational efficiency, making them suitable for real-time systems requiring fast prediction times. The findings indicate that ensemble learning techniques can significantly improve both the accuracy and speed of anomaly detection in IIoT systems, providing a robust framework for enhancing cybersecurity and operational efficiency in smart factories.

With the growing use of information technology in all life domains, hacking has become more negatively effective than ever before. Also with developing technologies, attacks numbers are growing exponentially every few months and become more sophisticated so that traditional IDS becomes inefficient detecting them. This paper proposes a solution to detect not only new threats with higher detection rate and lower false positive than already used IDS, but also it could detect collective and contextual security attacks. We achieve those results by using Networking Chatbot, a deep recurrent neural network: Long Short Term Memory (LSTM) on top of Apache Spark Framework that has an input of flow traffic and traffic aggregation and the output is a language of two words, normal or abnormal. We propose merging the concepts of language processing, contextual analysis, distributed deep learning, big data, anomaly detection of flow analysis. We propose a model that describes the network abstract normal behavior from a sequence of millions of packets within their context and analyzes them in near real-time to detect point, collective and contextual anomalies. Experiments are done on MAWI dataset, and it shows better detection rate not only than signature IDS, but also better than traditional anomaly IDS. The experiment shows lower false positive, higher detection rate and better point anomalies detection. As for prove of contextual and collective anomalies detection, we discuss our claim and the reason behind our hypothesis. But the experiment is done on random small subsets of the dataset because of hardware limitations, so we share experiment and our future vision thoughts as we wish that full prove will be done in future by other interested researchers who have better hardware infrastructure than ours.

Climate change poses significant challenges to agriculture, leading to increased crop damage owing to extreme weather conditions. Detecting and analyzing such damage is crucial for mitigating its effects on crop yield. This study proposes a novel autoencoder (AE)-based model, termed “Memory Ganomaly,” designed to detect and analyze weather-induced crop damage under conditions of significant class imbalance. The model integrates memory modules into the Ganomaly architecture, thereby enhancing its ability to identify anomalies by focusing on normal (undamaged) states. The proposed model was evaluated using apple and peach datasets, which included both damaged and undamaged images, and was compared with existing robust Convolutional neural network (CNN) models (ResNet-50, EfficientNet-B3, and ResNeXt-50) and AE models (Ganomaly and MemAE). Although these CNN models are not the latest technologies, they are still highly effective for image classification tasks and are deemed suitable for comparative analyses. The results showed that CNN and Transformer baselines achieved very high overall accuracy (94–98%) but completely failed to identify damaged samples, with precision and recall equal to zero under severe class imbalance. Few-shot learning partially alleviated this issue (up to 75.1% recall in the 20-shot setting for the apple dataset) but still lagged behind AE-based approaches in terms of accuracy and precision. In contrast, the proposed Memory Ganomaly delivered a more balanced performance across accuracy, precision, and recall (Apple: 80.32% accuracy, 79.4% precision, 79.1% recall; Peach: 81.06% accuracy, 83.23% precision, 80.3% recall), outperforming AE baselines in precision and recall while maintaining comparable accuracy. This study concludes that the Memory Ganomaly model offers a robust solution for detecting anomalies in agricultural datasets, where data imbalance is prevalent, and suggests its potential for broader applications in agricultural monitoring and beyond. While both Ganomaly and MemAE have shown promise in anomaly detection, they suffer from limitations—Ganomaly often lacks long-term pattern recall, and MemAE may miss contextual cues. Our proposed Memory Ganomaly integrates the strengths of both, leveraging contextual reconstruction with pattern recall to enhance detection of subtle weather-related anomalies under class imbalance.

Cloud environment is highly prone to failures due to its distributed nature and inherent complexity. Proactive identification of failures aids the service providers to avert these failures by taking corrective actions before they actually happen. In this paper, we analyze the resource usage patterns to identify failures due to resource contention in cloud. The resource usage and performance metrics of the working system are analyzed at regular time instants to model the normal and anomalous working behaviors. A two stage framework has been implemented where a hybrid of long short term memory (LSTM) and bidirectional long short term memory (BLSTM) is used to predict the future resource usage and performance metric values in the first stage. In the second stage, the hybrid model is used to classify the expected state as either normal or abnormal. We evaluate the proposed anomaly detection model in a virtual environment set up using Docker containers. The experimental results show that the proposed algorithm outperforms state-of-the-art algorithms.

A multi-scale reconstruction method for the anomaly detection in stochastic dynamic networks