Anomaly detection is crucial in industrial applications for identifying rare and unseen patterns to ensure system reliability. Traditional models, trained on a single class of normal data, struggle with real-world distributions where normal data exhibit diverse patterns, leading to class imbalance and long-tailed anomaly score distributions (LTD). This imbalance skews model training and degrades detection performance, especially for minority instances. To address this issue, we propose a novel importance-weighted loss designed specifically for anomaly detection. Compared to the previous method for LTD in classification, our method does not require prior knowledge of normal data classes. Instead, we introduce a weighted loss function that incorporates importance sampling to align the distribution of anomaly scores with a target Gaussian, ensuring a balanced representation of normal data. Extensive experiments on three benchmark image datasets and three real-world hyperspectral imaging datasets demonstrate the robustness of our approach in mitigating LTD-induced bias. Our method improves anomaly detection performance by 0.043, highlighting its effectiveness in real-world applications.
Nowadays, advanced intrusion detection systems (IDSs) rely on a combination of anomaly detection and signature-based methods. An IDS gathers observations, analyzes behavioral patterns, and reports suspicious events for further investigation. A notorious issue anomaly detection systems (ADSs) and IDSs face is the possibility of high false alarms, which even state-of-the-art systems have not overcome. This is especially a problem with large and complex systems. The number of non-critical alarms can easily overwhelm administrators and increase the likelihood of ignoring future alerts. Mitigation …
Deep Learning for Network Anomaly Detection under Data Contamination: Evaluating Robustness and Mitigating Performance Degradation
Groupe de Recherche Interdisciplinaire en Cybersécurité (GRIC)（跨学科网络安全研究组（GRIC））；Department of Computer Science, Université de Sherbrooke（谢布鲁克大学计算机科学系）；Department of Management School, Université de Sherbrooke（谢布鲁克大学管理学院）
This work proposes a novel method to robustly and accurately model time series with heavy-tailed noise, in non-stationary scenarios. In many practical application time series have heavy-tailed noise that significantly impacts the performance of classical forecasting models; in particular, accurately modeling a distribution over extreme events is crucial to performing accurate time series anomaly detection. We propose a Spliced Binned-Pareto distribution which is both robust to extreme observations and allows accurate modeling of the full distribution. Our method allows the capture of time depe…
Reward hacking -- where RL agents exploit gaps in misspecified reward functions -- has been widely observed, but not yet systematically studied. To understand how reward hacking arises, we construct four RL environments with misspecified rewards. We investigate reward hacking as a function of agent capabilities: model capacity, action space resolution, observation space noise, and training time. More capable agents often exploit reward misspecifications, achieving higher proxy reward and lower true reward than less capable agents. Moreover, we find instances of phase transitions: capability th…
Mitigating Homophily Disparity in Graph Anomaly Detection: A Scalable and Adaptive Approach
State Key Laboratory for Novel Software Technology（新型软件技术国家重点实验室）；Nanjing University（南京大学）；National Engineering Laboratory for Big Data Analysis and Applications（大数据分析与应用国家工程实验室）；Peking University（北京大学）
Mitigating Convergence Collapse in Fixed-Target Anomaly Detectors via Kernel-Anchored Locality Regularization
Université Paris-Saclay（巴黎-萨克雷大学）；CNRS（法国国家科学研究中心）；CentraleSupélec（中央理工-高等电力学院）；LISN UMR 9015（数字科学跨学科实验室）；Laboratoire Interdisciplinaire des Sciences du Numérique（数字科学跨学科实验室）
Cornell University（康奈尔大学）；University of California, Davis（加利福尼亚大学戴维斯分校）
We consider the problem of detecting a few targets among a large number of hierarchical data streams. The data streams are modeled as random processes with unknown and potentially heavy-tailed distributions. The objective is an active inference strategy that determines, sequentially, which data stream to collect samples from in order to minimize the sample complexity under a reliability constraint. We propose an active inference strategy that induces a biased random walk on the tree-structured hierarchy based on confidence bounds of sample statistics. We then establish its order optimality in …
LIAAD-INESC TEC（波尔图LIAAD-INESC技术研究所）；Dalhousie University（达尔豪斯大学）；University of Porto（波尔图大学）；Fraunhofer AICOS Portugal（弗劳恩霍夫葡萄牙AICOS研究所）
The early detection of anomalous events in time series data is essential in many domains of application. In this paper we deal with critical health events, which represent a significant cause of mortality in intensive care units of hospitals. The timely prediction of these events is crucial for mitigating their consequences and improving healthcare. One of the most common approaches to tackle early anomaly detection problems is standard classification methods. In this paper we propose a novel method that uses a layered learning architecture to address these tasks. One key contribution of our w…
Budapest University of Technology and Economics（布达佩斯技术与经济大学）；University of Debrecen（德布勒森大学）
The anomaly detection method presented by this paper has a special feature: it does not only indicate whether an observation is anomalous or not but also tells what exactly makes an anomalous observation unusual. Hence, it provides support to localize the reason of the anomaly. The proposed approach is model-based; it relies on the multivariate probability distribution associated with the observations. Since the rare events are present in the tails of the probability distributions, we use copula functions, that are able to model the fat-tailed distributions well. The presented procedure scales…
Norwegian University of Science and Technology（挪威科技大学）；University of Stavanger（斯塔万格大学）
Over the last few decades, extensive use of information and communication technologies has been the main driver of the digitalization of power systems. Proper and secure monitoring of the critical grid infrastructure became an integral part of the modern power system. Using phasor measurement units (PMUs) to surveil the power system is one of the technologies that have a promising future. Increased frequency of measurements and smarter methods for data handling can improve the ability to reliably operate power grids. The increased cyber-physical interaction offers both benefits and drawbacks, …
Bridging Classification and Reconstruction: Cooperative Time Series Anomaly Detection
National Key Laboratory of Information Systems Engineering, National University of Defense Technology（信息系统工程国家重点实验室，国防科技大学）；College of Systems Engineering, National University of Defense Technology（系统工程学院，国防科技大学）；Zhejiang University（浙江大学）；Zhejiang Key Laboratory of Space Information Sensing and Transmission, Hangzhou Dianzi University（空间信息感知与传输浙江大学重点实验室，杭州电子科技大学）
Decentralized Federated Anomaly Detection in Smart Grids: A P2P Gossip Approach
Centre for Cyber Resilience and Trust (CREST), Deakin University（网络弹性与信任中心（CREST），迪肯大学）；Department of Computer Science & IT, Latrobe University（计算机科学与信息技术系，拉筹伯大学）
Reconciling Attribute and Structural Anomalies for Improved Graph Anomaly Detection
School of Computer and Information Engineering, Henan University（河南大学计算机与信息工程学院）；School of Information and Software Engineering, University of Electronic Science and Technology of China（电子科技大学信息与软件工程学院）；Yangtze Delta Region Institute (Quzhou), University of Electronic Science and Technology of China（电子科技大学长江三角洲地区研究所（衢州））；Quzhou Affiliated Hospital of Wenzhou Medical University, Quzhou People’s Hospital（温州医学院衢州附属医院，衢州人民医院）
National University of Science and Technology（国立科技大学）；Technical Universität Kaiserslautern（凯泽斯劳滕工业大学）；Deutsches Forschungszentrum für Künstliche Intelligenz（德国人工智能研究中心）
End-to-end data-driven machine learning methods often have exuberant requirements in terms of quality and quantity of training data which are often impractical to fulfill in real-world applications. This is specifically true in time series domain where problems like disaster prediction, anomaly detection, and demand prediction often do not have a large amount of historical data. Moreover, relying purely on past examples for training can be sub-optimal since in doing so we ignore one very important domain i.e knowledge, which has its own distinct advantages. In this paper, we propose a novel kn…
LTCI, Télécom Paris, Institut Polytechnique de Paris（巴黎电信学院，巴黎理工学院）；Université Paris Cité, Université Paris Saclay, ENS Paris Saclay, CNRS, SSA, INSERM, Centre Borelli（巴黎西岱大学，巴黎萨克雷大学，巴黎高等师范学校巴黎萨克雷分校，法国国家科学研究中心，SSA，INSERM，博尔莱中心）
