Video Anomaly Detection Using Pre-Trained Deep Convolutional Neural Nets and Context Mining
NSF Center for Cloud and Autonomic Computing（NSF云与自主计算中心）；Department of Computer Science（计算机科学系）；The University of Arizona（亚利桑那大学）；The University of North Texas（北得克萨斯大学）
Anomaly detection is critically important for intelligent surveillance systems to detect in a timely manner any malicious activities. Many video anomaly detection approaches using deep learning methods focus on a single camera video stream with a fixed scenario. These deep learning methods use large-scale training data with large complexity. As a solution, in this paper, we show how to use pre-trained convolutional neural net models to perform feature extraction and context mining, and then use denoising autoencoder with relatively low model complexity to provide efficient and accurate surveillance anomaly detection, which can be useful for the resource-constrained devices such as edge devices of the Internet of Things (IoT). Our anomaly detection model makes decisions based on the high-level features derived from the selected embedded computer vision models such as object classification and object detection. Additionally, we derive contextual properties from the high-level features to further improve the performance of our video anomaly detection method. We use two UCSD datasets to demonstrate that our approach with relatively low model complexity can achieve comparable performance compared to the state-of-the-art approaches.
Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）
Mining information from logs is an old and still active research topic. In recent years, with the rapid emerging of cloud computing, log mining becomes increasingly important to industry. This paper focus on one major mission of log mining: anomaly detection, and proposes a novel method for mining abnormal sequences from large logs. Different from previous anomaly detection systems which based on statistics, probabilities and Markov assumption, our approach measures the strangeness of a sequence using compression. It first trains a grammar about normal behaviors using grammar-based compression…
Department of Computer Science, Ben-Gurion University of the Negev（内盖夫本古里安大学计算机科学系）；Israel Atomic Energy Commission（以色列原子能委员会）；Department of Physics, Nuclear Research Center-Negev（内盖夫核研究中心物理系）；Department of Materials, Nuclear Research Center-Negev（内盖夫核研究中心材料系）；Ben-Gurion University of the Negev（本古里安大学）；Nuclear Research Center-Negev（内盖夫核研究中心）；Ben-Gurion University of the Negev, Be’er Sheva, Israel（本古里安大学，以色列贝尔谢巴）；Israel Atomic Energy Commission, Tel Aviv, Israel（以色列原子能委员会，特拉维夫，以色列）；Nuclear Research Center-Negev, Be’er-Sheva, Israel（内盖夫核研究中心，贝尔谢巴，以色列）
The micro-structure of most of the engineering alloys contains some inclusions and precipitates, which may affect their properties, therefore it is crucial to characterize them. In this work we focus on the development of a state-of-the-art artificial intelligence model for Anomaly Detection named MLography to automatically quantify the degree of anomaly of impurities in alloys. For this purpose, we introduce several anomaly detection measures: Spatial, Shape and Area anomaly, that successfully detect the most anomalous objects based on their objective, given that the impurities were already l…
The rapid growth in stored time-oriented data necessitates the development of new methods for handling, processing, and interpreting large amounts of temporal data. One important example of such processing is detecting anomalies in time-oriented data. The Knowledge-Based Temporal Abstraction method was previously proposed for intelligent interpretation of temporal data based on predefined domain knowledge. In this study we propose a framework that integrates the KBTA method with a temporal pattern mining process for anomaly detection. According to the proposed method a temporal pattern mining …
ABV-Indian Institute of Information Technology & Management（ABV印度信息技术与管理学院）
kNN is a very effective Instance based learning method, and it is easy to implement. Due to heterogeneous nature of data, noises from different possible sources are also widespread in nature especially in case of large-scale databases. For noise elimination and effect of pseudo neighbours, in this paper, we propose a new learning algorithm which performs the task of anomaly detection and removal of pseudo neighbours from the dataset so as to provide comparative better results. This algorithm also tries to minimize effect of those neighbours which are distant. A concept of certainty measure is …
Run-Time Monitoring of ERTMS/ETCS Control Flow by Process Mining
University of Naples Federico II（那不勒斯费德里科二世大学）；University of Florence（佛罗伦萨大学）；University of Applied Sciences and Arts of Southern Switzerland（瑞士南瑞士应用科学与艺术大学）
This paper proposes an unsupervised anomaly detection technique for image-based plant disease diagnosis. The construction of large and publicly available datasets containing labeled images of healthy and diseased crop plants led to growing interest in computer vision techniques for automatic plant disease diagnosis. Although supervised image classifiers based on deep learning can be a powerful tool for plant disease diagnosis, they require a huge amount of labeled data. The data mining technique of anomaly detection includes unsupervised approaches that do not require rare samples for training…
University of Cincinnati（辛辛那提大学）；University of Minnesota（明尼苏达大学）
Large volumes of spatio-temporal data are increasingly collected and studied in diverse domains including, climate science, social sciences, neuroscience, epidemiology, transportation, mobile health, and Earth sciences. Spatio-temporal data differs from relational data for which computational approaches are developed in the data mining community for multiple decades, in that both spatial and temporal attributes are available in addition to the actual measurements/attributes. The presence of these attributes introduces additional challenges that needs to be dealt with. Approaches for mining spa…
inIT - Institute Industrial IT, Lemgo, Germany（inIT - 工业信息技术研究所（Lemgo，德国））；Fraunhofer Application Center Industrial Automation IOSB-INA, Lemgo, Germany（弗劳恩霍夫应用中心工业自动化IOSB-INA（Lemgo，德国））
Performing anomaly detection in hybrid systems is a challenging task since it requires analysis of timing behavior and mutual dependencies of both discrete and continuous signals. Typically, it requires modeling system behavior, which is often accomplished manually by human engineers. Using machine learning for creating a behavioral model from observations has advantages, such as lower development costs and fewer requirements for specific knowledge about the system. The paper presents DAD:DeepAnomalyDetection, a new approach for automatic model learning and anomaly detection in hybrid producti…
Shenzhen Institute of Artificial Intelligence and Robotics for Society（深圳人工智能与机器人研究院）；Institute of Robotics and Intelligent Manufacturing, Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳）机器人与智能制造研究院）
As a kind of generative self-supervised learning methods, generative adversarial nets have been widely studied in the field of anomaly detection. However, the representation learning ability of the generator is limited since it pays too much attention to pixel-level details, and generator is difficult to learn abstract semantic representations from label prediction pretext tasks as effective as discriminator. In order to improve the representation learning ability of generator, we propose a self-supervised learning framework combining generative methods and discriminative methods. The generato…
Anomalies are those deviating from the norm. Unsupervised anomaly detection often translates to identifying low density regions. Major problems arise when data is high-dimensional and mixed of discrete and continuous attributes. We propose MIXMAD, which stands for MIXed data Multilevel Anomaly Detection, an ensemble method that estimates the sparse regions across multiple levels of abstraction of mixed data. The hypothesis is for domains where multiple data abstractions exist, a data point may be anomalous with respect to the raw representation or more abstract representations. To this end, ou…
Deakin University（迪肯大学）；University of South Dakota（南达科他大学）
Many existing data mining algorithms use feature values directly in their model, making them sensitive to units/scales used to measure/represent data. Pre-processing of data based on rank transformation has been suggested as a potential solution to overcome this issue. However, the resulting data after pre-processing with rank transformation is uniformly distributed, which may not be very useful in many data mining applications. In this paper, we present a better and effective alternative based on ranks over multiple sub-samples of data. We call the proposed pre-processing technique as ARES | …
In the research area of anomaly detection, novel and promising methods are frequently developed. However, most existing studies exclusively focus on the detection task only and ignore the interpretability of the underlying models as well as their detection results. Nevertheless, anomaly interpretation, which aims to provide explanation of why specific data instances are identified as anomalies, is an equally important task in many real-world applications. In this work, we propose a novel framework which synergizes several machine learning and data mining techniques to automatically learn invar…
On-device Anomaly Detection in Conveyor Belt Operations
Department of Computer and Electrical Engineering, Mid Sweden University（计算机与电气工程系，中瑞典大学）；Instituto de Investigación en Señales, Sistemas e Inteligencia Computacional, sinc(i), FICH-UNL/CONICET（信号、系统与计算智能研究所，sinc(i)，FICH-UNL/CONICET）
Australian Institute for Machine Learning（澳大利亚机器学习研究所）；The University of Adelaide（阿德莱德大学）
Although deep learning has been applied to successfully address many data mining problems, relatively limited work has been done on deep learning for anomaly detection. Existing deep anomaly detection methods, which focus on learning new feature representations to enable downstream anomaly detection methods, perform indirect optimization of anomaly scores, leading to data-inefficient learning and suboptimal anomaly scoring. Also, they are typically designed as unsupervised learning due to the lack of large-scale labeled anomaly data. As a result, they are difficult to leverage prior knowledge …
Beyond Convolution: Advancing Hypergraph Neural Networks with Hypergraph U-Nets
Institute for Financial Services Analytics, University of Delaware（特拉华大学金融服务分析研究所）；Department of Applied Economics and Statistics, University of Delaware（特拉华大学应用经济学与统计学系）；Department of Electrical and Computer Engineering, University of Kentucky（肯塔基大学电气与计算机工程系）；Department of Electrical and Computer Engineering, University of Delaware（特拉华大学电气与计算机工程系）
Huge datasets in cyber security, such as network traffic logs, can be analyzed using machine learning and data mining methods. However, the amount of collected data is increasing, which makes analysis more difficult. Many machine learning methods have not been designed for big datasets, and consequently are slow and difficult to understand. We address the issue of efficient network traffic classification by creating an intrusion detection framework that applies dimensionality reduction and conjunctive rule extraction. The system can perform unsupervised anomaly detection and use this informati…
Ikerlan Technology Research Centre（伊克兰技术研究中心）；University of the Basque Country (UPV/EHU)（巴斯克大学（UPV/EHU））；Basque Center for Applied Mathematics (BCAM)（巴斯克应用数学中心（BCAM））
Recent advances in technology have brought major breakthroughs in data collection, enabling a large amount of data to be gathered over time and thus generating time series. Mining this data has become an important task for researchers and practitioners in the past few years, including the detection of outliers or anomalies that may represent errors or events of interest. This review aims to provide a structured and comprehensive state-of-the-art on outlier detection techniques in the context of time series. To this end, a taxonomy is presented based on the main aspects that characterize an out…
Anomaly detection in process mining focuses on identifying anomalous cases or events in process executions. The resulting diagnostics are used to provide measures to prevent fraudulent behavior, as well as to derive recommendations for improving process compliance and security. Most existing techniques focus on detecting anomalous cases in an offline setting. However, to identify potential anomalies in a timely manner and take immediate countermeasures, it is necessary to detect event-level anomalies online, in real-time. In this paper, we propose to tackle the online event anomaly detection p…
Anomaly detection on multivariate time-series is of great importance in both data mining research and industrial applications. Recent approaches have achieved significant progress in this topic, but there is remaining limitations. One major limitation is that they do not capture the relationships between different time-series explicitly, resulting in inevitable false alarms. In this paper, we propose a novel self-supervised framework for multivariate time-series anomaly detection to address this issue. Our framework considers each univariate time-series as an individual feature and includes tw…
Bridging Classification and Reconstruction: Cooperative Time Series Anomaly Detection
National Key Laboratory of Information Systems Engineering, National University of Defense Technology（信息系统工程国家重点实验室，国防科技大学）；College of Systems Engineering, National University of Defense Technology（系统工程学院，国防科技大学）；Zhejiang University（浙江大学）；Zhejiang Key Laboratory of Space Information Sensing and Transmission, Hangzhou Dianzi University（空间信息感知与传输浙江大学重点实验室，杭州电子科技大学）
ARISE: Graph Anomaly Detection on Attributed Networks via Substructure Awareness
National University of Defense Technology（国防科技大学）；Chongqing University of Posts and Telecommunications（重庆邮电大学）；Intelligent Game and Decision Laboratory（智能博弈与决策实验室）
Correlated anomaly detection (CAD) from streaming data is a type of group anomaly detection and an essential task in useful real-time data mining applications like botnet detection, financial event detection, industrial process monitor, etc. The primary approach for this type of detection in previous researches is based on principal score (PS) of divided batches or sliding windows by computing top eigenvalues of the correlation matrix, e.g. the Lanczos algorithm. However, this paper brings up the phenomenon of principal score degeneration for large data set, and then mathematically and practic…
Macquarie University（麦考瑞大学）；Academy of Mathematics and Systems Science, Chinese Academy of Sciences（中国科学院数学与系统科学研究院）；Rutgers, the State University of New Jersey（罗格斯，新泽西州立大学）；Carnegie Mellon University（卡内基梅隆大学）
Anomalies represent rare observations (e.g., data records or events) that deviate significantly from others. Over several decades, research on anomaly mining has received increasing interests due to the implications of these occurrences in a wide range of disciplines. Anomaly detection, which aims to identify rare observations, is among the most vital tasks in the world, and has shown its power in preventing detrimental events, such as financial fraud, network intrusion, and social spam. The detection task is typically solved by identifying outlying data points in the feature space and inheren…
Texas A&M University（德州农工大学）；Arizona State University（亚利桑那州立大学）
Anomaly detection is a fundamental problem in data mining field with many real-world applications. A vast majority of existing anomaly detection methods predominately focused on data collected from a single source. In real-world applications, instances often have multiple types of features, such as images (ID photos, finger prints) and texts (bank transaction histories, user online social media posts), resulting in the so-called multi-modal data. In this paper, we focus on identifying anomalies whose patterns are disparate across different modalities, i.e., cross-modal anomalies. Some of the d…
In recent years, there has been increased research interest in detecting anomalies in temporal streaming data. A variety of algorithms have been developed in the data mining community, which can be divided into two categories (i.e., general and ad hoc). In most cases, general approaches assume the one-size-fits-all solution model where a single anomaly detector can detect all anomalies in any domain. To date, there exists no single general method that has been shown to outperform the others across different anomaly types, use cases and datasets. In this paper, we propose SAFARI, a general fram…
Labels Matter More Than Models: Rethinking the Unsupervised Paradigm in Time Series Anomaly Detection
School of Future Technology, South China University of Technology（华南理工大学未来技术学院）；Pengcheng Laboratory（鹏城实验室）；School of Computer Science and Engineering, South China University of Technology（华南理工大学计算机科学与工程学院）
Log data anomaly detection is a core component in the area of artificial intelligence for IT operations. However, the large amount of existing methods makes it hard to choose the right approach for a specific system. A better understanding of different kinds of anomalies, and which algorithms are suitable for detecting them, would support researchers and IT operators. Although a common taxonomy for anomalies already exists, it has not yet been applied specifically to log data, pointing out the characteristics and peculiarities in this domain. In this paper, we present a taxonomy for different …
Distributed and Operating Systems, TU Berlin（柏林工业大学分布式与操作系统）；Huawei Munich Research Center, Huawei Technologies（华为技术有限公司慕尼黑研究中心）
The detection of anomalies is essential mining task for the security and reliability in computer systems. Logs are a common and major data source for anomaly detection methods in almost every computer system. They collect a range of significant events describing the runtime system status. Recent studies have focused predominantly on one-class deep learning methods on predefined non-learnable numerical log representations. The main limitation is that these models are not able to learn log representations describing the semantic differences between normal and anomaly logs, leading to a poor gene…
The Hong Kong Polytechnic University（香港理工大学）；Michigan State University（密歇根州立大学）
Graph-based Anomaly Detection (GAD) is becoming prevalent due to the powerful representation abilities of graphs as well as recent advances in graph mining techniques. These GAD tools, however, expose a new attacking surface, ironically due to their unique advantage of being able to exploit the relations among data. That is, attackers now can manipulate those relations (i.e., the structure of the graph) to allow some target nodes to evade detection. In this paper, we exploit this vulnerability by designing a new type of targeted structural poisoning attacks to a representative regression-based…
