Data center (DC) contains both IT devices and facility equipment, and the operation of a DC requires a high-quality monitoring (anomaly detection) system. There are lots of sensors in computer rooms for the DC monitoring system, and they are inherently related. This work proposes a data-driven pipeline (ts2graph) to build a DC graph of things (sensor graph) from the time series measurements of sensors. The sensor graph is an undirected weighted property graph, where sensors are the nodes, sensor features are the node properties, and sensor connections are the edges. The sensor node property is defined by features that characterize the sensor events (behaviors), instead of the original time series. The sensor connection (edge weight) is defined by the probability of concurrent events between two sensors. A graph of things prototype is constructed from the sensor time series of a real data center, and it successfully reveals meaningful relationships between the sensors. To demonstrate the use of the DC sensor graph for anomaly detection, we compare the performance of graph neural network (GNN) and existing standard methods on synthetic anomaly data. GNN outperforms existing algorithms by a factor of 2 to 3 (in terms of precision and F1 score), because it takes into account the topology relationship between DC sensors. We expect that the DC sensor graph can serve as the infrastructure for the DC monitoring system since it represents the sensor relationships.
The Internet of Things (IoT) is a system that connects physical computing devices, sensors, software, and other technologies. Data can be collected, transferred, and exchanged with other devices over the network without requiring human interactions. One challenge the development of IoT faces is the existence of anomaly data in the network. Therefore, research on anomaly detection in the IoT environment has become popular and necessary in recent years. This survey provides an overview to understand the current progress of the different anomaly detection algorithms and how they can be applied in…
A task of anomaly detection for a smart satellite Internet of things system
School of Mathematics, Hefei University of Technology（合肥工业大学数学学院）；School of Electrical and Automation Engineering, Hefei University of Technology（合肥工业大学电气与自动化工程学院）；CCNU Wollongong Joint Institute, Central China Normal University（华中师范大学伍伦贡联合研究院）
ShaTS: A Shapley-based Explainability Method for Time Series Artificial Intelligence Models applied to Anomaly Detection in Industrial Internet of Things
Departamento de Ingeniería y Tecnología de Computadores, University of Murcia（计算机工程与技术部门，穆尔西亚大学）
Columbia University（哥伦比亚大学）；University of Chicago（芝加哥大学）
Insecure Internet of things (IoT) devices pose significant threats to critical infrastructure and the Internet at large; detecting anomalous behavior from these devices remains of critical importance, but fast, efficient, accurate anomaly detection (also called "novelty detection") for these classes of devices remains elusive. One-Class Support Vector Machines (OCSVM) are one of the state-of-the-art approaches for novelty detection (or anomaly detection) in machine learning, due to their flexibility in fitting complex nonlinear boundaries between {normal} and {novel} data. IoT devices in smart…
Anomaly Detection in Industrial Machinery using IoT Devices and Machine Learning: a Systematic Mapping
SENAI Institute of Innovation for Information and Communication Technologies (ISI-TICs)（SENAI信息与通信技术创新研究所（ISI-TICs））；Federal Rural University of Pernambuco (UFRPE)（伯南布哥联邦农村大学（UFRPE））
University of Bologna（博洛尼亚大学）；INFN（意大利国家核物理研究所）；Federal University of Lavras（拉夫拉斯联邦大学）；INFN-CNAF（意大利国家核物理研究所国家核物理计算中心）
Log-based predictive maintenance of computing centers is a main concern regarding the worldwide computing grid that supports the CERN (European Organization for Nuclear Research) physics experiments. A log, as event-oriented adhoc information, is quite often given as unstructured big data. Log data processing is a time-consuming computational task. The goal is to grab essential information from a continuously changeable grid environment to construct a classification model. Evolving granular classifiers are suited to learn from time-varying log streams and, therefore, perform online classificat…
University of Bologna（博洛尼亚大学）；INFN Bologna（意大利国家核物理研究所博洛尼亚分部）；Federal University of Lavras（拉夫拉斯联邦大学）
Detection of anomalous behaviors in data centers is crucial to predictive maintenance and data safety. With data centers, we mean any computer network that allows users to transmit and exchange data and information. In particular, we focus on the Tier-1 data center of the Italian Institute for Nuclear Physics (INFN), which supports the high-energy physics experiments at the Large Hadron Collider (LHC) in Geneva. The center provides resources and services needed for data processing, storage, analysis, and distribution. Log records in the data center is a stochastic and non-stationary phenomenon…
Deep learning has seen increasing applications in time series in recent years. For time series anomaly detection scenarios, such as in finance, Internet of Things, data center operations, etc., time series usually show very flexible baselines depending on various external factors. Anomalies unveil themselves by lying far away from the baseline. However, the detection is not always easy due to some challenges including baseline shifting, lacking of labels, noise interference, real time detection in streaming data, result interpretability, etc. In this paper, we develop a novel deep architecture…
As the Industrial Internet of Things (IIoT) grows, systems are increasingly being monitored by arrays of sensors returning time-series data at ever-increasing 'volume, velocity and variety' (i.e. Industrial Big Data). An obvious use for these data is real-time systems condition monitoring and prognostic time to failure analysis (remaining useful life, RUL). (e.g. See white papers by Senseye.io, and output of the NASA Prognostics Center of Excellence (PCoE).) However, as noted by Agrawal and Choudhary 'Our ability to collect "big data" has greatly surpassed our capability to analyze it, undersc…
The rapid development in the field of System of Chip (SoC) technology, Internet of Things (IoT), cloud computing, and artificial intelligence has brought more possibilities of improving and solving the current problems. With data analytics and the use of machine learning/deep learning, it is made possible to learn the underlying patterns and make decisions based on what was learned from massive data generated from IoT sensors. When combined with cloud computing, the whole pipeline can be automated, and free of manual controls and operations. In this paper, an implementation of an automated dat…
The problem of anomaly detection has been studied for a long time. In short, anomalies are abnormal or unlikely things. In financial networks, thieves and illegal activities are often anomalous in nature. Members of a network want to detect anomalies as soon as possible to prevent them from harming the network's community and integrity. Many Machine Learning techniques have been proposed to deal with this problem; some results appear to be quite promising but there is no obvious superior method. In this paper, we consider anomaly detection particular to the Bitcoin transaction network. Our goa…
Wireless Sensor Networks (WSNs) have become increasingly valuable in various civil/military applications like industrial process control, civil engineering applications such as buildings structural strength monitoring, environmental monitoring, border intrusion, IoT (Internet of Things), and healthcare. However, the sensed data generated by WSNs is often noisy and unreliable, making it a challenge to detect and diagnose anomalies. Machine learning (ML) techniques have been widely used to address this problem by detecting and identifying unusual patterns in the sensed data. This survey paper pr…
The Internet of Things (IoT) is a ubiquitous system connecting many different devices - the things - which can be accessed from the distance. The cyber-physical systems (CPS) monitor and control the things from the distance. As a result, the concepts of dependability and security get deeply intertwined. The increasing level of dynamicity, heterogeneity, and complexity adds to the system's vulnerability, and challenges its ability to react to faults. This paper summarizes state-of-the-art of existing work on anomaly detection, fault-tolerance and self-healing, and adds a number of other methods…
In the era of Internet of Things (IoT), network-wide anomaly detection is a crucial part of monitoring IoT networks due to the inherent security vulnerabilities of most IoT devices. Principal Components Analysis (PCA) has been proposed to separate network traffics into two disjoint subspaces corresponding to normal and malicious behaviors for anomaly detection. However, the privacy concerns and limitations of devices' computing resources compromise the practical effectiveness of PCA. We propose a federated PCA-based Grassmannian optimization framework that coordinates IoT devices to aggregate …
Georgia Institute of Technology（佐治亚理工学院）；Ben-Gurion University（本-古里安大学）
Due to their rapid growth and deployment, the Internet of things (IoT) have become a central aspect of our daily lives. Unfortunately, IoT devices tend to have many vulnerabilities which can be exploited by an attacker. Unsupervised techniques, such as anomaly detection, can be used to secure these devices in a plug-and-protect manner. However, anomaly detection models must be trained for a long time in order to capture all benign behaviors. Furthermore, the anomaly detection model is vulnerable to adversarial attacks since, during the training phase, all observations are assumed to be benign.…
Due to their rapid growth and deployment, Internet of things (IoT) devices have become a central aspect of our daily lives. However, they tend to have many vulnerabilities which can be exploited by an attacker. Unsupervised techniques, such as anomaly detection, can help us secure the IoT devices. However, an anomaly detection model must be trained for a long time in order to capture all benign behaviors. This approach is vulnerable to adversarial attacks since all observations are assumed to be benign while training the anomaly detection model. In this paper, we propose CIoTA, a lightweight f…
Qufu Normal University（曲阜师范大学）；Weifang University of Science and Technology（潍坊科技学院）；Nanjing University of Science and Technology（南京理工大学）；Shandong First Medical University (Shandong Academy Of Medical Sciences)（山东第一医科大学（山东省医学科学院））
Edge computing enabled smart greenhouse is a representative application of Internet of Things technology, which can monitor the environmental information in real time and employ the information to contribute to intelligent decision-making. In the process, anomaly detection for wireless sensor data plays an important role. However, traditional anomaly detection algorithms originally designed for anomaly detection in static data have not properly considered the inherent characteristics of data stream produced by wireless sensor such as infiniteness, correlations and concept drift, which may pose…
Høgskulen på Vestlandet (HVL)（西挪威应用科学大学）；Norwegian University of Science and Technology（挪威科技大学）
An open-ended time series refers to a series of data points indexed in time order without an end. Such a time series can be found everywhere due to the prevalence of Internet of Things. Providing lightweight and real-time anomaly detection for open-ended time series is highly desirable to industry and organizations since it allows immediate response and avoids potential financial loss. In the last few years, several real-time time series anomaly detection approaches have been introduced. However, they might exhaust system resources when they are applied to open-ended time series for a long tim…
Technische Universität Berlin（柏林工业大学）；Princeton University（普林斯顿大学）
Anomaly detection has various applications including condition monitoring and fault diagnosis. The objective is to sense the environment, learn the normal system state, and then periodically classify whether the instantaneous state deviates from the normal one or not. A flexible and cost-effective way of monitoring a system state is to use a wireless sensor network. In the traditional approach, the sensors encode their observations and transmit them to a fusion center by means of some interference avoiding channel access method. The fusion center then decodes all the data and classifies the co…
Protecting the networks of tomorrow is set to be a challenging domain due to increasing cyber security threats and widening attack surfaces created by the Internet of Things (IoT), increased network heterogeneity, increased use of virtualisation technologies and distributed architectures. This paper proposes SDS (Software Defined Security) as a means to provide an automated, flexible and scalable network defence system. SDS will harness current advances in machine learning to design a CNN (Convolutional Neural Network) using NAS (Neural Architecture Search) to detect anomalous network traffic.…
NSF Center for Cloud and Autonomic Computing（NSF云与自主计算中心）；Department of Computer Science（计算机科学系）；The University of Arizona（亚利桑那大学）；The University of North Texas（北得克萨斯大学）
Anomaly detection is critically important for intelligent surveillance systems to detect in a timely manner any malicious activities. Many video anomaly detection approaches using deep learning methods focus on a single camera video stream with a fixed scenario. These deep learning methods use large-scale training data with large complexity. As a solution, in this paper, we show how to use pre-trained convolutional neural net models to perform feature extraction and context mining, and then use denoising autoencoder with relatively low model complexity to provide efficient and accurate surveil…
It is critical to secure the Industrial Internet of Things (IIoT) devices because of potentially devastating consequences in case of an attack. Machine learning and big data analytics are the two powerful leverages for analyzing and securing the Internet of Things (IoT) technology. By extension, these techniques can help improve the security of the IIoT systems as well. In this paper, we first present common IIoT protocols and their associated vulnerabilities. Then, we run a cyber-vulnerability assessment and discuss the utilization of machine learning in countering these susceptibilities. Fol…
Norwegian University of Science and Technology（挪威科技大学）；Sintef Energy Research（Sintef能源研究所）；Nanjing University of Aeronautics and Astronautics（南京航空航天大学）；University of Stavanger（斯塔万格大学）
The widespread use of information and communication technology (ICT) over the course of the last decades has been a primary catalyst behind the digitalization of power systems. Meanwhile, as the utilization rate of the Internet of Things (IoT) continues to rise along with recent advancements in ICT, the need for secure and computationally efficient monitoring of critical infrastructures like the electrical grid and the agents that participate in it is growing. A cyber-physical system, such as the electrical grid, may experience anomalies for a number of different reasons. These may include phy…
Real-Time Adaptive Anomaly Detection in Industrial IoT Environments
CIISE, Concordia University, Montréal, QC, Canada（Concordia大学）；Ericsson Research, Lund, Sweden（爱立信研究）；Computer Science Programme, University of Western Cape, Capetown, South Africa（南非开普敦大学计算机科学项目）
Seoul National University（首尔大学）；Samsung Electronics Co. Ltd.（三星电子株式会社）
In this paper, we propose Squeezed Convolutional Variational AutoEncoder (SCVAE) for anomaly detection in time series data for Edge Computing in Industrial Internet of Things (IIoT). The proposed model is applied to labeled time series data from UCI datasets for exact performance evaluation, and applied to real world data for indirect model performance comparison. In addition, by comparing the models before and after applying Fire Modules from SqueezeNet, we show that model size and inference times are reduced while similar levels of performance is maintained.
Programmable logic controller (PLC) based industrial control systems (ICS) are used to monitor and control critical infrastructure. Integration of communication networks and an Internet of Things approach in ICS has increased ICS vulnerability to cyber-attacks. This work proposes novel unsupervised machine learning ensemble methods for anomaly detection in PLC-based ICS. The work presents two broad approaches to anomaly detection: a weighted voting ensemble approach with a learning algorithm based on coefficient of determination and a stacking-based ensemble approach using isolation forest met…
Haute Ecole de la Suisse Occidentale (HES-SO)（瑞士西部高等专业学院）；Netguardians SA（Netguardians股份公司）
In classification problems, supervised machine-learning methods outperform traditional algorithms, thanks to the ability of neural networks to learn complex patterns. However, in two-class classification tasks like anomaly or fraud detection, unsupervised methods could do even better, because their prediction is not limited to previously learned types of anomalies. An intuitive approach of anomaly detection can be based on the distances from the centers of mass of the two respective classes. Autoencoders, although trained without supervision, can also detect anomalies: considering the center o…
Mountains of Research Collaborative Laboratory（山地研究合作实验室）
In recent years, the popularity and use of Artificial Intelligence (AI) and large investments on theInternet of Medical Things (IoMT) will be common to use products such as smart socks, smartpants, and smart shirts. These products are known as Smart Textile or E-textile, which has theability to monitor and collect signals that our body emits. These signals make it possible to extractanomalous components using Machine Learning (ML) techniques that play an essential role in thisarea. This study presents a Systematic Review of the Literature (SLR) on Anomaly Detection usingML techniques in Smart …
Efficient Personalized Federated PCA with Manifold Optimization for IoT Anomaly Detection
School of Mechatronic Engineering and Automation, Shanghai University（机电工程与自动化学院，上海大学）；School of Intelligent Systems Engineering, Sun Yat-sen University（智能系统工程学院，中山大学）
Dive into Time-Series Anomaly Detection: A Decade Review
Inria（法国国家信息与自动化研究所）；DI ENS（巴黎高等师范学院数字研究所）；PSL（巴黎文理研究大学）；CNRS（法国国家科学研究中心）；The Ohio State University（俄亥俄州立大学）；Université Paris Cité（巴黎西岱大学）；IUF（法国大学研究院）
University of Jinan（济南大学）；Shandong Jiaotong University（山东交通学院）
Unsupervised representation learning has been extensively employed in anomaly detection, achieving impressive performance. Extracting valuable feature vectors that can remarkably improve the performance of anomaly detection are essential in unsupervised representation learning. To this end, we propose a novel discriminative feature learning framework with gradient preference for anomaly detection. Specifically, we firstly design a gradient preference based selector to store powerful feature points in space and then construct a feature repository, which alleviate the interference of redundant f…
The University of Queensland（昆士兰大学）；Griffith University（格里菲斯大学）
Monitoring and detecting abnormal events in cyber-physical systems is crucial to industrial production. With the prevalent deployment of the Industrial Internet of Things (IIoT), an enormous amount of time series data is collected to facilitate machine learning models for anomaly detection, and it is of the utmost importance to directly deploy the trained models on the IIoT devices. However, it is most challenging to deploy complex deep learning models such as Convolutional Neural Networks (CNNs) on these memory-constrained IIoT devices embedded with microcontrollers (MCUs). To alleviate the m…
German Research Center for Artificial Intelligence（德国人工智能研究中心）
In the context of the Industrial Internet of Things, communication technology, originally used in home and office environments, is introduced into industrial applications. Commercial off-the-shelf products, as well as unified and well-established communication protocols make this technology easy to integrate and use. Furthermore, productivity is increased in comparison to classic industrial control by making systems easier to manage, set up and configure. Unfortunately, most attack surfaces of home and office environments are introduced into industrial applications as well, which usually have …
Macquarie University（麦考瑞大学）；University of Wollongong（伍伦贡大学）；Academy of Mathematics and Systems Science, Chinese Academy of Sciences（中国科学院数学与系统科学研究院）；Beihang University（北京航空航天大学）；IBM T. J. Watson Research Center（IBM托马斯·J·沃森研究中心）
Graph anomaly detection in this paper aims to distinguish abnormal nodes that behave differently from the benign ones accounting for the majority of graph-structured instances. Receiving increasing attention from both academia and industry, yet existing research on this task still suffers from two critical issues when learning informative anomalous behavior from graph data. For one thing, anomalies are usually hard to capture because of their subtle abnormal behavior and the shortage of background knowledge about them, which causes severe anomalous sample scarcity. Meanwhile, the overwhelming …
Federated Quantum Kernel Learning for Anomaly Detection in Multivariate IoT Time-Series
Department of Electrical and Electronic Engineering, Imperial College London（电子工程系，帝国理工学院伦敦分校）；Centre for Quantum Engineering, Science and Technology (QuEST), Imperial College London（量子工程、科学与技术中心（QuEST），帝国理工学院伦敦分校）；Graduate Institute of Applied Physics, National Taiwan University（应用物理研究所，国立台湾大学）
Although home IoT (Internet of Things) devices are typically plain and task oriented, the context of their daily use may affect their traffic patterns. For this reason, anomaly-based intrusion detection systems tend to suffer from a high false positive rate (FPR). To overcome this, we propose a two-step collaborative anomaly detection method which first uses an autoencoder to differentiate frequent (`benign') and infrequent (possibly `malicious') traffic flows. Clustering is then used to analyze only the infrequent flows and classify them as either known ('rare yet benign') or unknown (`malici…
