Detecting anomalous time series is key for scientific, medical and industrial tasks, but is challenging due to its inherent unsupervised nature. In recent years, progress has been made on this task by learning increasingly more complex features, often using deep neural networks. In this work, we argue that shallow features suffice when combined with distribution distance measures. Our approach models each time series as a high dimensional empirical distribution of features, where each time-point constitutes a single sample. Modeling the distance between a test time series and the normal training set therefore requires efficiently measuring the distance between multivariate probability distributions. We show that by parameterizing each time series using cumulative Radon features, we are able to efficiently and effectively model the distribution of normal time series. Our theoretically grounded but simple-to-implement approach is evaluated on multiple datasets and shown to achieve better results than established, classical methods as well as complex, state-of-the-art deep learning methods. Code is provided.
Anomaly Detection via Mean Shift Density Enhancement
School of Data Science, Indian Institute of Science Education and Research（数据科学学院，印度科学教育与研究学院）；Institute of Computer Science, University of Rostock（计算机科学研究所，罗斯托克大学）；Leibniz-Institute for Food Systems Biology, Technical University of Munich（食品系统生物学莱比锡研究所，慕尼黑技术大学）；Stellenbosch Institute of Advanced Studies (STIAS)（斯托尔波茨堡高级研究 institute (STIAS)）
Episys Science Inc（Episys科学公司）；The Boeing Company（波音公司）
We developed DeepADMR, a novel neural anomaly detector for the deep reinforcement learning (DRL)-based DeepCQ+ MANET routing policy. The performance of DRL-based algorithms such as DeepCQ+ is only verified within the trained and tested environments, hence their deployment in the tactical domain induces high risks. DeepADMR monitors unexpected behavior of the DeepCQ+ policy based on the temporal difference errors (TD-errors) in real-time and detects anomaly scenarios with empirical and non-parametric cumulative-sum statistics. The DeepCQ+ design via multi-agent weight-sharing proximal policy op…
The Alan Turing Institute（艾伦·图灵研究所）；WMG Cyber Security Centre, University of Warwick（华威大学WMG网络安全中心）
The increasing connectivity of data and cyber-physical systems has resulted in a growing number of cyber-attacks. Real-time detection of such attacks, through the identification of anomalous activity, is required so that mitigation and contingent actions can be effectively and rapidly deployed. We propose a new approach for aggregating unsupervised anomaly detection algorithms and incorporating feedback when it becomes available. We apply this approach to open-source real datasets and show that both aggregating models, which we call experts, and incorporating feedback significantly improve the…
University of Virginia（弗吉尼亚大学）；HRL Laboratories, LLC（HRL实验室有限责任公司）；Vanderbilt University（范德堡大学）；U.S. Naval Research Laboratory（美国海军研究实验室）
We present a new supervised image classification method applicable to a broad class of image deformation models. The method makes use of the previously described Radon Cumulative Distribution Transform (R-CDT) for image data, whose mathematical properties are exploited to express the image data in a form that is more suitable for machine learning. While certain operations such as translation, scaling, and higher-order transformations are challenging to model in native image space, we show the R-CDT can capture some of these variations and thus render the associated image classification problem…
Institute of Information Engineering, Automation and Mathematics（信息工程、自动化与数学研究所）；Slovak University of Technology in Bratislava（布拉迪斯拉发斯洛伐克理工大学）
Anomaly detection methods are part of the systems where rare events may endanger an operation's profitability, safety, and environmental aspects. Although many state-of-the-art anomaly detection methods were developed to date, their deployment is limited to the operation conditions present during the model training. Online anomaly detection brings the capability to adapt to data drifts and change points that may not be represented during model development resulting in prolonged service life. This paper proposes an online anomaly detection algorithm for existing real-time infrastructures where …
Evaluating Temporal and Structural Anomaly Detection Paradigms for DDoS Traffic
Institute of Exact and Technological Sciences（精确与技术科学研究所）；Federal University of Viçosa（弗雷塔斯联邦大学）；Department of Informatics -- School of Engineering（信息学院 -- 工程学院）；University of Minho（明霍大学）；University of São Paulo（圣保罗大学）
Failures or breakdowns in factory machinery can be costly to companies, so there is an increasing demand for automatic machine inspection. Existing approaches to acoustic signal-based unsupervised anomaly detection, such as those using a deep autoencoder (DA) or Gaussian mixture model (GMM), have poor anomaly-detection performance. In this work, we propose a new method based on a deep autoencoding Gaussian mixture model with hyper-parameter optimization (DAGMM-HO). In our method, the DAGMM-HO applies the conventional DAGMM to the audio domain for the first time, with the idea that its total op…
Columbia University（哥伦比亚大学）；University of South Florida（南佛罗里达大学）
Timely detection of abrupt anomalies is crucial for real-time monitoring and security of modern systems producing high-dimensional data. With this goal, we propose effective and scalable algorithms. Proposed algorithms are nonparametric as both the nominal and anomalous multivariate data distributions are assumed unknown. We extract useful univariate summary statistics and perform anomaly detection in a single-dimensional space. We model anomalies as persistent outliers and propose to detect them via a cumulative sum-like algorithm. In case the observed data have a low intrinsic dimensionality…
Quantum Machine Learning for Cyber-Physical Anomaly Detection in Unmanned Aerial Vehicles: A Leakage-Free Evaluation with Proxy-Audited Feature Sets
Corporation for Aerospace Initiatives, Research and Innovation (CASIRI)（航空航天研究与创新公司）；Department of Electronics Engineering, Universidad Nacional de Colombia（国立哥伦比亚大学电子工程系）；Department of Electronics Engineering, Universidad del Cauca（卡利学院电子工程系）；Department of Physics, Universidad del Cauca（卡利大学物理系）
University of Victoria（维多利亚大学）；Helwan University（赫尔万大学）
The visualization and detection of anomalies (outliers) are of crucial importance to many fields, particularly cybersecurity. Several approaches have been proposed in these fields, yet to the best of our knowledge, none of them has fulfilled both objectives, simultaneously or cooperatively, in one coherent framework. The visualization methods of these approaches were introduced for explaining the output of a detection algorithm, not for data exploration that facilitates a standalone visual detection. This is our point of departure: UN-AVOIDS, an unsupervised and nonparametric approach for both…
Connected vehicles (CVs), because of the external connectivity with other CVs and connected infrastructure, are vulnerable to cyberattacks that can instantly compromise the safety of the vehicle itself and other connected vehicles and roadway infrastructure. One such cyberattack is the false information attack, where an external attacker injects inaccurate information into the connected vehicles and eventually can cause catastrophic consequences by compromising safety-critical applications like the forward collision warning. The occurrence and target of such attack events can be very dynamic, …
Connected vehicle (CV) systems are cognizant of potential cyber attacks because of increasing connectivity between its different components such as vehicles, roadside infrastructure, and traffic management centers. However, it is a challenge to detect security threats in real-time and develop appropriate or effective countermeasures for a CV system because of the dynamic behavior of such attacks, high computational power requirement, and a historical data requirement for training detection models. To address these challenges, statistical models, especially change point models, have potentials …
DriftGuard: A Hierarchical Framework for Concept Drift Detection and Remediation in Supply Chain Forecasting
Department of Computer Science Engineering, Muffakham Jah College of Engineering and Technology（穆法卡姆·贾赫工程与技术学院计算机科学工程系）；Department of CSE, Shadan Women's College of Engineering and Technology（沙达恩女子工程与技术学院计算机科学与工程系）
Columbia University（哥伦比亚大学）；Beijing Institute of Technology（北京理工大学）；New York University Shanghai（上海纽约大学）
Midterm stock price prediction is crucial for value investments in the stock market. However, most deep learning models are essentially short-term and applying them to midterm predictions encounters large cumulative errors because they cannot avoid anomalies. In this paper, we propose a novel deep neural network Mid-LSTM for midterm stock prediction, which incorporates the market trend as hidden states. First, based on the autoregressive moving average model (ARMA), a midterm ARMA is formulated by taking into consideration both hidden states and the capital asset pricing model. Then, a midterm…
