PN-BBN: A Petri Net-Based Bayesian Network for Anomalous Behavior Detection

Data centers are growing in size and complexity driven by trends such as cloud computing and on-line services. Such large data centers pose several challenges for system management. Key among them is anomaly detection which is required to monitor and analyze metrics across several thousands servers and across multiple layers of abstractions to detect anomalous system behavior. In practice, multiple anomaly detection tools are used to continuously raise alarms across multiple metrics and servers. These alarms include both true positives and false alarms. Administrators and management tools act on these alarms for diagnosis and deeper root cause analysis and take appropriate management actions to mitigate the anomalous behaviors. Given the scale and scope of the system, the administrators and management tools are overwhelmed with the large number of alarms at any given instant, many of which are false alarms. It is therefore necessary to prioritize and rank these alarms, so as to take timely actions that maintain the service level agreements for the data center. Existing techniques for such ranking are ad-hoc and not scalable. We propose ranking windows of monitored metrics based on their probability of occurrence. We explain how these probabilities can be computed based either on the false positive rates for which the accompanying anomaly detectors were designed, or, when available, on the probability models underlying the false positive rates. In the simplest case, the ranking procedure reduces to computing the Z-score of the observed measurements and computing a statistic from a window of Z-scores to use as a basis for ranking. The proposed techniques are reliable, lightweight and easy to deploy in the modern data center. We have validated these techniques on synthetic data containing injected anomalies and on data acquired from production data centers.

A fuzzy logic-based approach for fault diagnosis and condition monitoring of industry 4.0 manufacturing processes

This paper presents a hybrid unsupervised architecture for anomalous lane-changing behavior recognition. Anomaly detection aims to identify unusual driving behavior caused by either environmental or phycological stimuli, and is of great important in road safety. First, a Recurrent Convolutional Autoencoder (RC-AE) is built to explore the spatial-temporal features derived from the high-dimensional behavior data. Second, Reconstruct Error analysis of the autoencoder and one-class support vector machine method are both applied to identify anomalous lane-changing behavior in the learned feature space by autoencoder. Last, we employ T-Distributed Stochastic Neighbor Embedding (T-SNE) for data visualization in the anomaly detection. Based on the kernel density estimation analysis, anomalous and normal lane-changing sample groups display distinct difference over probability distributions. The findings contribute to a better understanding on drivers' natural lane-changing behavior, and can provide important insight into real-time personalized unusual lane-changing behavior monitoring system development.

Previous works demonstrated that dispersion increases with heterogeneities and travel distance in heterogeneous reservoirs. Therefore, scale-up of input dispersivity and reservoir attributes to the transport modeling scale should account for subscale heterogeneity and its variability. A quantitative procedure to scale-up both rock and flow-related properties is presented. First, to scale-up porosity and permeability, volume variance at the transport modeling scale is computed corresponding to a given spatial correlation model; numerous sets of “conditioning data” are sampled from probability distributions whose mean is the block average of the actual measure values and the variance is the variance of block mean. Stochastic simulations are subsequently performed to generate multiple realizations at the transport modeling scale. Next, a stochastic random walk particle tracking (RWPT) method, which is not prone to numerical dispersion, is applied. Multiple sub-grid realizations illustrating fine-scale heterogeneities and of the same sizes as the transport modelling mesh size are subjected to RWPT simulation. Effective longitudinal and transverse dispersivities are computed simultaneously by matching the corresponding breakthrough concentration history for each realization with an equivalent medium consisting of averaged homogeneous properties. Probability distributions of scaled-up dispersivities conditioned to average porosity and permeability values are established. Tracer injection responses obtained with the coarse-scale models and fine-scale models are compared. Anomalous behavior is observed, and the interplay between large-scale heterogeneity and sub-scale variability is studied. Scaled-up dispersivity is shown to increase with scale. This study demonstrates that (1) accounting for variability owing to scale-up could capture the actual fine-scale behavior; and (2) the ensuing uncertainty in transport response is underestimated when sub-scale variability is ignored. It underlines the significance of quantification and integration of uncertainty in subsurface “hard” data.

This chapter presents an original approach to anomalous behavior analysis in trajectory data by means of a recursive Bayesian filter. The anomalous pattern detection is of great interest in the areas of navigation, driver assistant system, surveillance and emergency management. In this work we focus on the GPS trajectories finding where the driver is encountering navigation problems, i.e., taking a wrong turn, performing a detour or tending to lose his way. To extract the related features, i.e., turns and their density, degree of detour and route repetition, a long-term perspective is required to observe data sequences instead of individual data points. We therefore employ high-order Markov chain to remodel the trajectory integrating these long-term features. A recursive Bayesian filter is conducted to process the Markov model and deliver an optimal probability distribution of the potential anomalous driving behaviors dynamically over time. The proposed filter performs unsupervised detection in single trajectory with solely the local features. No training process is required to characterize the anomalous behaviors. Based on the results of individual trajectories collective behaviors can be analyzed as well to indicate some traffic issues, e.g., turn restriction, blind alley, temporary road-block, etc. Experiments are performed on the trajectory data in urban areas demonstrating the potential of this approach.

Autonomous driving cars need highly complex hardware and software systems, which require high performance computing platforms in order to enable a real time AI-based perception and decision making pipeline. The industry has been exploring various in-vehicle accelerators such as GPUs, ASICs and FPGAs. Yet the autonomous driving platform design is far from mature when taking into account of system reliability, redundancy and higher level of autonomy. In this work, we propose a hybrid computing system design, which integrates a GPU as the primary computing system and a FPGA as a secondary system. This hybrid system architecture has multiple advantages: 1) The FPGA can be constantly running as a complementary system with very short latency, helping to detect main system failure and anomalous behavior, contributing to system functionality verification and reliability. 2) If the primary system fails (mostly from sensor or interconnection error), the FPGA will quickly detect the failure and run a safe-mode task with a subset of sensors. 3) The FPGA can be used as an independent computing system to run extra algorithm components to improve the overall system autonomy. For example, FPGA can handle driver monitoring tasks while GPU focuses on driving functions. Together they can boost the driving function from L2 (constantly requires driver's attention) to L3 (allows driver to mind off for 10 seconds). This paper defines how such a system works, discusses various use cases and potential design challenges, and shares some initial results and insights about how to make such a system deliver the maximum value for autonomous driving.

The rapid expansion of digital financial services has led to an exponential increase in online transactions, making financial fraud one of the most critical challenges for banks, fintech companies, and payment gateways. Traditional fraud detection methods, including rule-based systems and conventional machine learning algorithms, often fail to detect sophisticated and evolving fraudulent patterns due to their limited ability to process large-scale, high-dimensional, and dynamic datasets. To address these challenges, this study proposes a Hybrid Deep Neural Ensemble for Intelligent Financial Fraud Detection, integrating multiple deep learning models into a unified framework to enhance detection accuracy and robustness. The ensemble leverages the complementary strengths of different neural network architectures to effectively capture transactional patterns, temporal dependencies, and anomalous behaviours. By aggregating predictions from multiple models, the proposed approach reduces false positives and improves overall system reliability. The framework further incorporates advanced feature engineering, data preprocessing techniques, and real-time monitoring for timely identification of suspicious transactions. Experimental evaluation on benchmark financial datasets demonstrates that the proposed hybrid model significantly outperforms traditional machine learning and standalone deep learning models in terms of precision, recall, F1-score, and overall detection rate.

The issues of ensuring the reliability of the control system of a biogas plant should be given special attention in the design of the system, in the manufacture of all hardware, in the development of mathematical and software, in the creation of information support, during installation and commissioning, during the technical operation of the system. A research aim is development of measures on providing of operating reliability of the systems of automatic control by biogas plants due to their optimal service. The choice of the optimal strategy allows you to achieve the best results from the operation of biogas plants without attracting additional resources. The importance of the early resumption of the operation of control systems after failures, as well as planning and organizing their effective preventive maintenance, is noted. The need for collection, processing, analysis and use of data on the reliability of control systems is noted. According to the obtained values of failure time and recovery time, the values of the readiness factor for devices of each type and for the control system as a whole are determined. Analysis of the obtained data on failure time, recovery time after failure, readiness factor will allow to develop organizational and technical measures, the implementation of which will increase the operational reliability of the control system of the biogas plant. To assess the reliability, a complex integral indicator is proposed that characterizes the state of normal functioning of the system. Changing the strategy of preventive maintenance and the organization of work to restore the operation of system devices after failures, based on the analysis of the value of the coefficient of normal functioning, it is possible to obtain the necessary values of the reliability of automatic control systems for biogas plants.

Case study investigating the application of neural networks for process modelling and condition monitoring

Input modeling is the selection of a probability distribution to capture the uncertainty in the input environment of a stochastic system. Example applications of input modeling include the representation of the randomness in the time to failure for a machining process, the time between arrivals of calls to a call center, and the demand received for a product of an inventory system. Building simulations of stochastic systems requires the development of input models that adequately represent the uncertainty in such random variables. Since there are an abundance of probability distributions that can be used for this purpose, a natural question to ask is how to identify the probability distribution that best represents the particular situation under study. For example, is the exponential distribution a reasonable choice to represent the time to failure for a machining process, or is it better to use an empirical distribution function obtained from the historical time-to-failure data? Recognizing the fact that there is no true input model waiting to be found, the goal of stochastic input modeling is to obtain an approximation that captures the key characteristics of the system inputs. The development of a good input model requires the collection of as much information as possible about the relevant randomness in the system as well as the historical data consisting of the past realizations of the random variables of interest. In the presence of a data set, the input model can be identified by fitting a probability distribution to the historical data. However, it may be difficult and/or costly to collect data for the stochastic system under study; it can also be impossible to properly collect any data at all such as when the proposed system does not exist. In the absence of historical data, any relevant information (e.g., expert opinion and the conventional bounds suggested by the underlying physical situation) can be used for input modeling. This article addresses the key issues that arise in stochastic input modeling both in the presence and in the absence of historical data. The first step in input modeling is to identify the sources of randomness in the input environment of the system under study. Many stochastic systems contain multiple sources of uncertainty, e.g., the completion time of an item on a particular machine, the potential breakdown of the machine, and the percentage of defective items produced by the machine might be among the sources of uncertainty in a manufacturing setting. Throughout, the random vector X = (X1, X2, …, X K )′ is used to represent the collection of K different inputs of a stochastic system, where X k is the random variable denoting the kth system input. The K components of this random vector might also be correlated with each other. Therefore, the stochastic properties of the random inputs X k , k = 1, 2, …, K, are captured in the joint probability

Process discovery aims to discover process models from event logs to describe actual business processes. The quality of event logs has an impact on the quality of process models, so preprocessing methods can be used to improve the quality of event logs. Chaotic activities may exist in real business scenarios, and the occurrence of chaotic activities is independent of other activities in the process and can occur at any location in the event log at any frequency. Therefore, chaotic activities seriously affect the model quality of process discovery. Filtering chaotic activities in event logs can effectively improve the quality of event logs and thus improve the quality of process models. The traditional chaotic activity filtering algorithm makes it difficult to balance accuracy and time performance. Therefore, a direct method for filtering chaotic activities is proposed in this paper. By analyzing the relationship between activities, chaotic activities are identified in the log according to the characteristics of chaotic activities and the direct following relationship of activities as the judgment condition, and the filtering of chaotic activities in the event log is realized. In addition, this paper proposes an indirect chaotic activity filtering method, which identifies and filters chaotic activities in the log by analyzing the influence of the existence of different activities on the overall chaos degree of the log. The proposed method is compared with the traditional chaotic activity filtering method on several simulation/real data sets, and the accuracy and running time between the multi-group event logs and the process models generated before and after chaotic activity filtering are analyzed, further verifying the effectiveness and feasibility of the proposed method. By summarizing the experimental results, it is found that the accuracy of the proposed chaotic activity filtering methods is greater than that of the frequency-based filtering method and is close to that of the entropy-based chaotic activity filtering methods. Moreover, compared with other filtering methods used in the experiment, the chaotic activity filtering method proposed in this paper can improve the efficiency by 23.4% on average for simulation logs, and by 84.25% on average for real event logs. It is concluded that compared with other filtering methods, the proposed chaotic activity filtering methods have higher accuracy and can effectively improve the time performance of chaotic activity filtering. Therefore, the chaotic activity filtering method proposed in this paper can balance the accuracy and time performance, and can ensure the integrity of the filtered event log to a certain extent.

System reliability performance is usually based on average customer interruption indices. The average values are valuable information, but provide only a single customer risk dimension without the underlying probability distributions. The average annual indices give no insight on how reliability may vary from year to year as a result of the random behavior of a bulk electric system. Reliability index probability distributions, therefore, provide additional valuable information and a more complete understanding of composite power system behavior. A significant advantage when utilizing sequential Monte Carlo simulation in bulk electric system reliability analysis is the ability to provide reliability index probability distributions in addition to the expected values of their indices. This paper illustrates the development of probability distributions for bulk electric system reliability performance indices using sequential simulation. The results obtained using the developed software show that the system performance index probability distributions have unique characteristics that are basically dependent on the system topology, operating philosophy and conditions. System conditions such as the peak load level and system reinforcement options have significant impacts on the performance index probability distribution characteristics. The basic concepts and their application in composite power system reliability evaluation are illustrated by application to a small practical test system

Anomalous actors are becoming increasingly sophisticated both in methodology and technical ability. Fortunately, the companies impacted by anomalous behaviour are also generating more data and insights on potential anomalous cases than ever before. In this paper, a unified approach to managing the complexity of constructing a useable anomaly detection system is presented. The unified approach is comprised of three algorithms, a Neural Architecture Search (NAS) implementation for autoencoders, an anomaly score threshold optimisation algorithm, and a Gaussian scaling function for anomaly scores. NAS is applied to a data set containing instances of credit card fraud. The NAS algorithm is used to simulate a population of 50 candidate deep learning architectures, with the best performing architecture being selected based on a balanced score, comprised of an average of the Area under the ROC curve, Average Precision and normalised Matthews Correlation Coefficient scores. The threshold optimisation algorithm is used to determine the appropriate threshold between the classes, for the purposes of producing the binary classification outcome of each architecture. The Gaussian scaling algorithm is applied to the raw anomaly scores of the optimal architecture into order to generate useable probability scores. Not only did the proposed unified approach simplify the process of selecting an optimal neural architecture whose output is interpretable by business practitioners and comparable with other probability score producing models, but it also contributes to anomaly detection in a transactional setting by eliminating subjective thresholds when classifying anomalous transactions.

Anomalous bedload transport has been widely observed in both laboratory settings and natural rivers. Previous studies have utilized the fractional advection‐diffusion equation (FADE) model to characterize the observed anomalous bedload transport behaviors, with the model's parameters being determined by the tail distributions of the probability density functions (PDFs) for particle resting times and step lengths. FADE model captures sub‐diffusion and super‐diffusion behavior resulting from the heavy‐tailed PDFs of step lengths and resting times; however, it overlooks the temporal variability of advection and diffusion coefficients throughout the transport process. This study developes a novel microscopic stochastic process that incorporates nonstationary Lévy motion. The scaling limit of the stochastic process leads to the development of a hybrid Hausdorff‐fractional model. In the upscaling model, sub‐diffusion is represented by a time‐metric transformation, while super‐diffusion is characterized by nonlocal particle movements. Applications show that the novel model serves a generalized tool to characterize anomalous bedload transport processes across various scales. The upscaling model bridges the microscopic stochastic particle dynamics and macroscopic bedload transport behavior, and the microscopic stochastic framework provides a comprehensive physical interpretation for each parameter in the macroscopic equations, thereby enhancing the understanding of collective particle dynamics.

Contingency Estimation of States for Unmanned Aerial Vehicle using a Spherical Simplex Unscented Filter