Complex devices are connected daily and eagerly generate vast streams of multidimensional state measurements. These devices often operate in distinct modes based on external conditions (day/night, occupied/vacant, etc.), and to prevent complete or partial system outage, we would like to recognize as early as possible when these devices begin to operate outside the normal modes. Unfortunately, it is often impractical or impossible to predict failures using rules or supervised machine learning, because failure modes are too complex, devices are too new to adequately characterize in a specific environment, or environmental change puts the device into an unpredictable condition. We propose an unsupervised anomaly detection method that creates a negative sample from the positive, observed sample, and trains a classifier to distinguish between positive and negative samples. Using the Contraction Principle, we explain why such a classifier ought to establish suitable decision boundaries between normal and anomalous regions, and show how Integrated Gradients can attribute the anomaly to specific variables within the anomalous state vector. We have demonstrated that negative sampling with random forest or neural network classifiers yield significantly higher AUC scores than Isolation Forest, One Class SVM, and Deep SVDD, against (a) a synthetic dataset with dimensionality ranging between 2 and 128, with 1, 2, and 3 modes, and with and without noise dimensions; (b) four standard benchmark datasets; and (c) a multidimensional, multimodal dataset from real climate control devices. Finally, we describe how negative sampling with neural network classifiers have been successfully deployed at large scale to predict failures in real time in over 15,000 climate-control and power meter devices in 145 Google office buildings.
Interpretable Graph-Level Anomaly Detection via Contrast with Normal Prototypes
State Key Laboratory for Novel Software Technology, Nanjing University（新型软件技术国家重点实验室，南京大学）；School of Artificial Intelligence, Nanjing University（人工智能学院，南京大学）
Interpretable Maximum Margin Deep Anomaly Detection
School of Statistics and Mathematics, Yunnan University of Finance and Economics（云南财经大学统计与数学学院）；Academy for Multidisciplinary Studies, Capital Normal University（首都师范大学多学科研究院）
University of Warwick（华威大学）；University of Cambridge（剑桥大学）；Amazon（亚马逊）
Anomaly detection at scale is an extremely challenging problem of great practicality. When data is large and high-dimensional, it can be difficult to detect which observations do not fit the expected behaviour. Recent work has coalesced on variations of (random) $k$\emph{d-trees} to summarise data for anomaly detection. However, these methods rely on ad-hoc score functions that are not easy to interpret, making it difficult to asses the severity of the detected anomalies or select a reasonable threshold in the absence of labelled anomalies. To solve these issues, we contextualise these methods…
EVA-Net: Interpretable Anomaly Detection for Brain Health via Learning Continuous Aging Prototypes from One-Class EEG Cohorts
Qilu Hospital, ASU（青岛医院，亚利桑那州立大学）；Zhengzhou University（郑州大学）；University of Science and Technology Beijing（北京科技大学）；Southern University of Science and Technology（南方科技大学）；Qilu Hospital（青岛医院）
Towards Self-Interpretable Graph-Level Anomaly Detection
Monash University（莫纳什大学）；Northwestern University（西北大学）；Data61, CSIRO（澳大利亚联邦科学与工业研究组织Data61）；Northwest A&F University（西北农林科技大学）；The University of Adelaide（阿德莱德大学）；Griffith University（格里菲斯大学）
In the research area of anomaly detection, novel and promising methods are frequently developed. However, most existing studies exclusively focus on the detection task only and ignore the interpretability of the underlying models as well as their detection results. Nevertheless, anomaly interpretation, which aims to provide explanation of why specific data instances are identified as anomalies, is an equally important task in many real-world applications. In this work, we propose a novel framework which synergizes several machine learning and data mining techniques to automatically learn invar…
Johns Hopkins University（约翰斯·霍普金斯大学）；University of Maryland（马里兰大学）
We present a new subspace-based method to construct probabilistic models for high-dimensional data and highlight its use in anomaly detection. The approach is based on a statistical estimation of probability density using densities of random subspaces combined with geometric averaging. In selecting random subspaces, equal representation of each attribute is used to ensure correct statistical limits. Gaussian mixture models (GMMs) are used to create the probability densities for each subspace with techniques included to mitigate singularities allowing for the ability to handle both numerical an…
University of the Witwatersrand（金山大学）；University of Johannesburg（约翰内斯堡大学）
Hybrid methods have been shown to outperform pure statistical and pure deep learning methods at both forecasting tasks, and at quantifying the uncertainty associated with those forecasts (prediction intervals). One example is Multivariate Exponential Smoothing Long Short-Term Memory (MES-LSTM), a hybrid between a multivariate statistical forecasting model and a Recurrent Neural Network variant, Long Short-Term Memory. It has also been shown that a model that ($i$) produces accurate forecasts and ($ii$) is able to quantify the associated predictive uncertainty satisfactorily, can be successfull…
Tsinghua University（清华大学）；Hefei University of Technology（合肥工业大学）；Siemens AG（西门子股份公司）
Recent studies have shown that autoencoder-based models can achieve superior performance on anomaly detection tasks due to their excellent ability to fit complex data in an unsupervised manner. In this work, we propose a novel autoencoder-based model, named StackVAE-G that can significantly bring the efficiency and interpretability to multivariate time series anomaly detection. Specifically, we utilize the similarities across the time series channels by the stacking block-wise reconstruction with a weight-sharing scheme to reduce the size of learned models and also relieve the overfitting to u…
Protecting Federated Learning from Extreme Model Poisoning Attacks via Multidimensional Time Series Anomaly Detection
Department of Computer, Control and Management Engineering, Sapienza University of Rome（计算机、控制与管理工程系，罗马萨皮恩扎大学）；National Research Council in Pisa（比萨国家研究理事会）；Department of Statistics, Ludwig-Maximilians-University of Munich（统计学系，慕尼黑路德维希-马克西米利安大学）；Department of Computer Science, Sapienza University of Rome（计算机科学系，罗马萨皮恩扎大学）
Utrecht University（乌得勒支大学）；ZHAW School of Law and Management（苏黎世应用科技大学法律与管理学院）；Zurich University of Applied Sciences（苏黎世应用科技大学）
We combine the metrics of distance and isolation to develop the Analytic Isolation and Distance-based Anomaly (AIDA) detection algorithm. AIDA is the first distance-based method that does not rely on the concept of nearest-neighbours, making it a parameter-free model. Differently from the prevailing literature, in which the isolation metric is always computed via simulations, we show that AIDA admits an analytical expression for the outlier score, providing new insights into the isolation metric. Additionally, we present an anomaly explanation method based on AIDA, the Tempered Isolation-based…
Virginia Commonwealth University（弗吉尼亚联邦大学）；Idaho National Laboratory（爱达荷国家实验室）
Recent year has brought considerable advancements in Electric Vehicles (EVs) and associated infrastructures/communications. Intrusion Detection Systems (IDS) are widely deployed for anomaly detection in such critical infrastructures. This paper presents an Interpretable Anomaly Detection System (RX-ADS) for intrusion detection in CAN protocol communication in EVs. Contributions include: 1) window based feature extraction method; 2) deep Autoencoder based anomaly detection method; and 3) adversarial machine learning based explanation generation methodology. The presented approach was tested on …
Anomaly Detection is an unsupervised learning task aimed at detecting anomalous behaviours with respect to historical data. In particular, multivariate Anomaly Detection has an important role in many applications thanks to the capability of summarizing the status of a complex system or observed phenomenon with a single indicator (typically called `Anomaly Score') and thanks to the unsupervised nature of the task that does not require human tagging. The Isolation Forest is one of the most commonly adopted algorithms in the field of Anomaly Detection, due to its proven effectiveness and low comp…
Function Based Isolation Forest (FuBIF): A Unifying Framework for Interpretable Isolation-Based Anomaly Detection
Brain, Mind and Computer Science, University of Padova, Italy（脑科学与计算机科学系，帕多瓦大学，意大利）；Department of Mathematics, Sapienza University of Roma, Italy（数学系，罗马萨皮恩扎大学，意大利）；Department of Information Engineering, University of Padova, Italy（信息工程系，帕多瓦大学，意大利）
Virginia Commonwealth University（弗吉尼亚联邦大学）；Idaho National Laboratory（爱达荷国家实验室）
Monitoring traffic in computer networks is one of the core approaches for defending critical infrastructure against cyber attacks. Machine Learning (ML) and Deep Neural Networks (DNNs) have been proposed in the past as a tool to identify anomalies in computer networks. Although detecting these anomalies provides an indication of an attack, just detecting an anomaly is not enough information for a user to understand the anomaly. The black-box nature of off-the-shelf ML models prevents extracting important information that is fundamental to isolate the source of the fault/attack and take correct…
For the highly imbalanced credit card fraud detection problem, most existing methods either use data augmentation methods or conventional machine learning models, while neural network-based anomaly detection approaches are lacking. Furthermore, few studies have employed AI interpretability tools to investigate the feature importance of transaction data, which is crucial for the black-box fraud detection module. Considering these two points together, we propose a novel anomaly detection framework for credit card fraud detection as well as a model-explaining module responsible for prediction exp…
NSF-MAP: Neurosymbolic Multimodal Fusion for Robust and Interpretable Anomaly Prediction in Assembly Pipelines
Artificial Intelligence Institute, University of South Carolina（南卡罗来纳大学人工智能研究所）；Clemson Composites Center, Clemson University（克莱姆森大学复合材料中心）；Intelligent Circuits, Architectures and Systems Lab, University of South Carolina（南卡罗来纳大学智能电路、架构和系统实验室）
DINAMO: Dynamic and INterpretable Anomaly MOnitoring for Large-Scale Particle Physics Experiments
Department of Experimental Physics, European Organization for Nuclear Research (CERN)（欧洲核子研究中心（CERN）实验物理学系）；Laboratory for Nuclear Science, Massachusetts Institute of Technology (MIT)（麻省理工学院核科学实验室）
University of São Paulo（圣保罗大学）；Stanford University（斯坦福大学）；VALE S.A（淡水河谷公司）
Despite the superior performance in modeling complex patterns to address challenging problems, the black-box nature of Deep Learning (DL) methods impose limitations to their application in real-world critical domains. The lack of a smooth manner for enabling human reasoning about the black-box decisions hinder any preventive action to unexpected events, in which may lead to catastrophic consequences. To tackle the unclearness from black-box models, interpretability became a fundamental requirement in DL-based systems, leveraging trust and knowledge by providing ways to understand the model's b…
Utah State University（犹他州立大学）；University of North Carolina at Charlotte（北卡罗来纳大学夏洛特分校）；University of Arkansas（阿肯色大学）
Anomaly detection in sequential data has been studied for a long time because of its potential in various applications, such as detecting abnormal system behaviors from log data. Although many approaches can achieve good performance on anomalous sequence detection, how to identify the anomalous entries in sequences is still challenging due to a lack of information at the entry-level. In this work, we propose a novel framework called CFDet for fine-grained anomalous entry detection. CFDet leverages the idea of interpretable machine learning. Given a sequence that is detected as anomalous, we ca…
Queensland University of Technology（昆士兰科技大学）；M3DICINE Pty Ltd（M3DICINE私人有限公司）
Traditionally, abnormal heart sound classification is framed as a three-stage process. The first stage involves segmenting the phonocardiogram to detect fundamental heart sounds; after which features are extracted and classification is performed. Some researchers in the field argue the segmentation step is an unwanted computational burden, whereas others embrace it as a prior step to feature extraction. When comparing accuracies achieved by studies that have segmented heart sounds before analysis with those who have overlooked that step, the question of whether to segment heart sounds before f…
Transparent Anomaly Detection via Concept-based Explanations
École de Technologie Supérieure（高等技术学院）；Mila-Quebec AI（魁北克人工智能研究所）；McGill University（麦吉尔大学）；CISPA Helmholtz Center for Information Security（CISPA亥姆霍兹信息安全中心）
Anomalies are by definition rare, thus labeled examples are very limited or nonexistent, and likely do not cover unforeseen scenarios. Unsupervised learning methods that don't necessarily encounter anomalies in training would be immensely useful. Generative vision models can be useful in this regard but do not sufficiently represent normal and abnormal data distributions. To this end, we propose constant curvature manifolds for embedding data distributions in unsupervised visual anomaly detection. Through theoretical and empirical explorations of manifold shapes, we develop a novel hyperspheri…
Low-Rank Representations Meets Deep Unfolding: A Generalized and Interpretable Network for Hyperspectral Anomaly Detection
Aerospace Information Research Institute, Chinese Academy of Sciences（中国科学院空天信息创新研究院）；School of Mathematics and Statistics, Southeast University（东南大学数学学院与统计学院）；College of Resources and Environment, University of Chinese Academy of Sciences（中国科学院大学资源与环境学院）；Univ. Grenoble Alpes, Inria, CNRS, Grenoble INP, LJK（格勒诺布尔阿尔卑斯大学、法国国家信息与自动化研究所、法国国家科学研究中心、格勒诺布尔理工学院、约瑟夫·傅里叶大学联合实验室）
Georgia Institute of Technology（佐治亚理工学院）；Queensland University of Technology（昆士兰科技大学）；Jet Propulsion Laboratory（喷气推进实验室）
While anomaly detection stands among the most important and valuable problems across many scientific domains, anomaly detection research often focuses on AI methods that can lack the nuance and interpretability so critical to conducting scientific inquiry. In this application paper we present the results of utilizing an alternative approach that situates the mathematical framing of machine learning based anomaly detection within a participatory design framework. In a collaboration with NASA scientists working with the PIXL instrument studying Martian planetary geochemistry as a part of the sea…
University of Electronic Science and Technology of China（电子科技大学）；Beijing Aerospace Institute for Metrology and Measurement Technology（北京航天计量测试技术研究所）
Spacecraft faces various situations when carrying out exploration missions in complex space, thus monitoring the anomaly status of spacecraft is crucial to the development of \textcolor{blue}{the} aerospace industry. The time series telemetry data generated by on-orbit spacecraft \textcolor{blue}{contains} important information about the status of spacecraft. However, traditional domain knowledge-based spacecraft anomaly detection methods are not effective due to high dimensionality and complex correlation among variables. In this work, we propose an anomaly detection framework for spacecraft …
Deep learning has seen increasing applications in time series in recent years. For time series anomaly detection scenarios, such as in finance, Internet of Things, data center operations, etc., time series usually show very flexible baselines depending on various external factors. Anomalies unveil themselves by lying far away from the baseline. However, the detection is not always easy due to some challenges including baseline shifting, lacking of labels, noise interference, real time detection in streaming data, result interpretability, etc. In this paper, we develop a novel deep architecture…
