Unsupervised Learning Model for Real-Time Anomaly Detection in Computer Networks

Huberized one-class support vector machine with truncated loss function in the primal space

As the foundation of global communication networks, optical fibers are vulnerable to various disruptive events, including mechanical damage, such as cuts, and malicious physical layer breaches, such as eavesdropping via fiber bending. Traditional monitoring methods often fail to identify subtle or novel anomalies, stimulating the proliferation of Machine Learning (ML) techniques for detection of threats before they cause significant harm. In this paper, we evaluate the performance of Semi-Supervised Learning (SSL) and Unsupervised Learning (USL) approaches for detecting various abnormal events, such as fiber bending and vibrations, by analyzing polarization signatures with minimal reliance on labeled data. We experimentally collect thirteen polarization signatures on three different types of fiber cable and process them using One-Class Support Vector Machine (OCSVM) as an SSL, and Density-Based Spatial Clustering of Applications with Noise (DBSCAN) as a USL algorithm for anomaly detection. We introduce tailored evaluation metrics designed to guide hyper-parameter tuning and capture generalization over different anomaly types, detection consistency, and robustness to false positives, enabling practical deployment of OCSVM and DBSCAN in optical fiber security. Our findings demonstrate DBSCAN as a strong contender to detect previously unseen threats in scenarios where labeled data are not available, despite some variability in performance between different scenarios, with F1 score values between 0.615 and 0.995. In contrast, OCSVM, trained on normal operating conditions, maintains high F1 scores of 0.98 to 0.998, demonstrating accurate detection of complex anomalies in optical networks.

In order for a machine to operate safely, it is one of the very important factors to quickly and accurately detect an abnormality. However, it is difficult to detect accurately and always monitor the machine by human decision. Daily inspections of machines are generally performed by monitoring images, vibrations, temperature and pressure. However, it is commonly thought that inspections using sound is difficult because sound is different how to hear depending on the person. In addition, machine learning came to be used easily on these days. In this study, we examined whether machine abnormalities can be detected using machine learning. To prepare for the research, the abnormal machine sounds were needed. However, it is difficult to collect the abnormal machine sound. In this research, to generate the abnormal sound easily, we build a machine operation sound generator. Some abnormal sounds were generated by applying a load to this device. We extracted features quantity called Mel-Frequency Cepstrum Coefficient(MFCC) from machine operation sounds. MFCC is one of the feature quantity and is popular as a method of sound recognition. Subsequently, abnormal sounds were detected by using One Class Support Vector Machine (OCSVM). OCSVM is a method to regard normal data as one class and detect other than normal data. The one of the merits of OCSVM can detect abnormal data by using results of learning only normal data. We did some experiments that we assumed that the sounds of first day were normal sounds and the other sounds assumed abnormal sounds. As a result, the abnormality rate on the fourth day was 78.94% and we conclude that abnormal sounds could be detected from machine operation sounds.

PurposeAtherosclerosis plays a significant role in the initiation of coronary artery aneurysms (CAA). Although the treatment options for this kind of vascular disease are developing, there are challenges and limitations in both selecting and applying sufficient medical solutions. For surgical interventions, that are novel therapies, non-invasive specific patient-based studies could lead to obtaining more promising results. Despite medical and pathological tests, these pre-surgical investigations require special biomedical and computer-aided engineering techniques. In this study, a machine learning (ML) model is proposed for the non-invasive detection of atherosclerotic CAA for the first time.MethodsThe database for study was collected from hemodynamic analysis and computed tomography angiography (CTA) of 80 CAAs from 61 patients, approved by the Institutional Review Board (IRB). The proposed ML model is formulated for learning by a one-class support vector machine (1SVM) that is a field of ML to provide techniques for outlier and anomaly detection.ResultsThe applied ML algorithms yield reasonable results with high and significant accuracy in designing a procedure for the non-invasive diagnosis of atherosclerotic aneurysms. This proposed method could be employed as a unique artificial intelligence (AI) tool for assurance in clinical decision-making procedures for surgical intervention treatment methods in the future.ConclusionsThe non-invasive diagnosis of the atherosclerotic CAAs, which is one of the vital factors in the accomplishment of endovascular surgeries, is important due to some clinical decisions. Although there is no accurate tool for managing this kind of diagnosis, an ML model that can decrease the probability of endovascular surgical failures, death risk, and post-operational complications is proposed in this study. The model is able to increase the clinical decision accuracy for low-risk selection of treatment options.

Recent failures of bridges worldwide highlight the need for robust structural health surveillance systems to provide alerts for early damage and prevent severe loss. Structural health monitoring (SHM) continues to evolve and gain wide adoption among asset managers to mitigate catastrophic failure risks of structural systems. With the prolific integration of SHM with artificial intelligence and internet of things systems becoming prevalent, several data-driven approaches have gained popularity in SHM. However, it is challenging to obtain ground-truth-labelled damage samples for supervised machine learning methods. A class of shallow machine learning methods known as unsupervised methods (e.g. the one-class support vector machine (OCSVM)), which only uses unlabelled data from a healthy state, has been shown to achieve promising results. However, shallow machine learning methods require laborious expert-crafted feature inputs for optimal performance. Inspired by the automatic feature-extraction ability of deep neural networks, unsupervised methods (deep learning models trained without supervisory ground truth labels) such as autoencoder (AE)-based methods were explored to detect structural damage. Results obtained on both real-world data from Sydney Harbour Bridge, one of Australia's iconic structures, and data collected from laboratory specimens demonstrate the effectiveness of the AE-based method over conventional shallow methods such as the OCSVM.

The distance and divergence of the probability measures play a central role in statistics, machine learning, and many other related fields. The Wasserstein distance has received much attention in recent years because of its distinctions from other distances or divergences. Although computing the Wasserstein distance is costly, entropy-regularized optimal transport was proposed to computationally efficiently approximate the Wasserstein distance. The purpose of this study is to understand the theoretical aspect of entropy-regularized optimal transport. In this paper, we focus on entropy-regularized optimal transport on multivariate normal distributions and q-normal distributions. We obtain the explicit form of the entropy-regularized optimal transport cost on multivariate normal and q-normal distributions; this provides a perspective to understand the effect of entropy regularization, which was previously known only experimentally. Furthermore, we obtain the entropy-regularized Kantorovich estimator for the probability measure that satisfies certain conditions. We also demonstrate how the Wasserstein distance, optimal coupling, geometric structure, and statistical efficiency are affected by entropy regularization in some experiments. In particular, our results about the explicit form of the optimal coupling of the Tsallis entropy-regularized optimal transport on multivariate q-normal distributions and the entropy-regularized Kantorovich estimator are novel and will become the first step towards the understanding of a more general setting.

As the reliance on digital networks grows, the need for robust security measures becomes paramount. It offers a thorough analysis of creating and assessing a Network Intrusion Detection System (NIDS) incorporating various machine learning algorithms. The selected algorithms consist of K Nearest Neighbour, Naïve Bayes, Decision Tree, Support Vector Machine, and Logistic Regression. Moreover, widely recognised ensemble learning models like CatBoost, AdaBoost, Gradient Boost, Random Forest, and Extreme Gradient Boost. The core objective is to improve the efficiency of intrusion detection by evaluating various machine-learning models. Utilizes feature selection techniques based on chi-square to enhance the relevance and effectiveness of the selected features. The evaluation metrics, particularly Matthews’ Correlation Coefficient (MCC) and ROC Curves, are used in assessing the models’ efficacy. They offer valuable insights into the models’ capability to differentiate between normal and malicious network activities. This study aims to advance cybersecurity by comparing classical machine learning and ensemble models for network intrusion detection. Significantly, our results underscore XGBoost’s effectiveness with 0.996 accuracy and 0.993 MCC, in enhancing digital network security.

Accurate real-time bus arrival information is essential for an efficient public transport network, as it significantly impacts passenger experience, system reliability, reduced waiting times, dwell times, and operational efficiency. In Sri Lanka's public transport system, current bus arrival time computations primarily rely on static data, neglecting real-time information and critical factors influencing travel times. This highlights the need to identify the unique variables affecting bus arrival times within the Sri Lankan context and to develop robust prediction models that account for these influences. While traditional methods such as Historical Average Models, Regression, Time Series Analysis, and Kalman Filtering have been used in previous research for short-term travel time predictions, Machine Learning (ML) approaches have proven to deliver superior accuracy. ML models are regarded as the most effective for heterogeneous, lane-less traffic conditions with varying traffic volumes, such as those found in Sri Lanka. ML techniques excel in processing large, high-quality datasets and provide accurate predictions by accounting for all relevant variables influencing travel times. Although research has been conducted on developing various basic ML models for travel time prediction, there is a noticeable gap in studies comparing these models to determine the most suitable one for the Sri Lankan context. A Long- Short Term Memory (LSTM) neural network is a deep learning model that is capable of handling long-term dependencies. In the context of bus travel time prediction, LSTMs can leverage historical traffic and travel data to capture temporal patterns and fluctuations that influence travel times. By evaluating LSTMs against basic machine learning models, this study seeks to explore the advantages of applying deep learning techniques to transportation forecasting, ultimately contributing to more accurate and efficient predictive systems in transit planning. The ML models selected in this study include two basic traditional models K- Nearest Neighbours (KNN) and Support Vector Regression (SVR) and four advanced models that utilize ensemble techniques and advanced optimization as Random Forest Regression (RFR), Ada Boost, XG Boost and Gradient Boosting Machine (GBM). The performance of these models was compared with the LSTM model to identify the gap in their accuracies.

One-class support vector machines (OCSVM) have been recently applied to detect anomalies in wireless sensor networks (WSNs). Typically, OCSVM is kernelized by radial bais functions (RBF, or Gausian kernel) whereas selecting Gaussian kernel hyperparameter is based upon availability of anomalies, which is rarely applicable in practice. This article investigates the application of OCSVM to detect anomalies in WSNs with data-driven hyperparameter optimization. Specifically, the information of the farthest and the nearest neighbors of each sample is used to construct the objective cost instead of labeling based metrics such as geometric mean accuracy (G-mean) or area under the receiver operating characteristic (AUROC). The efficiency of this method is illustrated over the IBRL dataset whereas the resulting estimated boundary as well as anomaly detection performance are comparable with existing methods.

One-class Classification-Based Machine Learning Model for Estimating the Probability of Wildfire Risk

Machine learning algorithms have been employed extensively in the area of structural health monitoring to compare new measurements with baselines to detect any structural change. One-class support vector machine (OCSVM) with Gaussian kernel function is a promising machine learning method which can learn only from one class data and then classify any new query samples. However, generalization performance of OCSVM is profoundly influenced by its Gaussian model parameter \(\sigma \). This paper proposes a new algorithm named Appropriate Distance to the Enclosing Surface (ADES) for tuning the Gaussian model parameter. The semantic idea of this algorithm is based on inspecting the spatial locations of the edge and interior samples, and their distances to the enclosing surface of OCSVM. The algorithm selects the optimal value of \(\sigma \) which generates a hyperplane that is maximally distant from the interior samples but close to the edge samples. The sets of interior and edge samples are identified using a hard margin linear support vector machine. The algorithm was successfully validated using sensing data collected from the Sydney Harbour Bridge, in addition to five public datasets. The designed ADES algorithm is an appropriate choice to identify the optimal value of \(\sigma \) for OCSVM especially in high dimensional datasets.

Unmanned aerial vehicle (UAV) is a complex system. Its design involves control, aerodynamics, and communication systems. We use the complex linear relationships among UAV attributes (sensor readings, and commands) to propose a new technique to detect contextual faults. The contextual faults mean that a defective sensor shows invalid values concerning the context of other attributes. The proposed approach depends on estimating the values of a focused attribute using dynamic linear regression. Next, it calculates the estimation error at each time step. The values of the estimation error are classified using K-NN (Nearest Neighbour) classifier into two classes (Normal, Abnormal). The abnormal points are flagged as potential faults. Moreover, comparison with other algorithms (K-Means and One-Class SVM) is made. The proposed approach showed better results in most of the cases.

Massive amounts of data are created and collected by data acquisition systems, including SCADA and embedded systems in industrial machines.The data may be analysed by AI algorithms to gain a better understanding of the process and identify any irregularities in the machines.This is a major benefit of Industry 4.0.This paper will examine predictive maintenance as a process in industry and demonstrate how it may make full use of technologies from Industry 4.0.Using a weighted average, our method integrates Three Machine Learning models: Auto encoder (AE), One-Class Support Vector Machine (OCSVM), and Local Outlier Factor (LOF).This allows us to discover anomalies in real-time.Anomaly detection will be enhanced as a result.Improve real-time anomaly detection using the suggested hybrid machine-learning ensemble pipeline by combining the outputs of three ML models: auto encoder (AE), one-class support vector machine (OCSVM), and local outlier factor (LOF).

Abstract: This paper focuses on understanding and solving the problem of phishing websites. Phishing is a type of cyber attack that creates fake websites and URLs that look like real people and tricks people into sharing sensitive information, such as passwords or financial details. These attacks target unsuspecting users and can have serious consequences. In this study, we discuss how AI can help identify and prevent phishing websites. We also explore different AI models that could create smarter, more effective anti-phishing systems in the future. While phishing is quite a common problem, no single method can address all the vulnerabilities. Instead, an amalgamation of techniques is often needed to combat different types of attacks. Machine learning, in particular, is a powerful tool that can mitigate phishing attempts and ensure online safety for everyone. As technology advances, phishing approaches are becoming more sophisticated and often outpacing the potency of present antiphishing tools, which often have limitations. This paper explores how to use machine learning controls to combat phishing. The goal is to create an efficient, accurate, and effective system. To achieve this, we use four machine learning models: K- Nearest Neighbors (KNN), Kernel-SVM, Random Forest Classifier, and Decision Tree. These models rely on labeled datasets to learn and improve their ability to detect phishing attempts. Each of these algorithms brings unique strengths to the classification process, helping to identify and prevent malicious activity. Machine learning allows cybersecurity systems to analyze patterns, adapt to new threats, and take proactive steps to stop future attacks. By integrating machine learning into security, we can take important steps to protect users from these attacks

The high likelihood of noise and the lack of labels in Internet of Things (IoT) time-series sensor readings make the detection of abnormalities an important subject of study. When there is a high correlation between sensor data points, conventional data mining and machine learning algorithms are unable to detect abnormalities. Furthermore, the amount and speed with which IoT sensors report data is one of the reasons why traditional machine and statistical learning algorithms are unable to detect anomalies. In recent years, Artificial Neural Networks (ANN) have been widely used for developing Deep Learning models for learning and classifying unlabeled data for detecting anomalies with high accuracy. In this connection, this paper presents a study on the performance of two well-known ANN models, such as Generative Adversarial Network (GAN) and Variational Auto Encoder (VAE), and a classification model, One Class Support Vector Machine (OCSVM). To evaluate performance, simulations were conducted using a well-known network and sensor datasets. The outcomes show which technique outperformed the others in terms of detection accuracy and training duration.