An Efficient Modelling of Oversampling with Optimal Deep Learning Enabled Anomaly Detection in Streaming Data

Recently,anomaly detection(AD)in streaming data gained significant attention among research communities due to its applicability in finance,business,healthcare,education,etc.The recent developments of deep learning(DL)models find helpful in the detection and classification of anomalies.This article designs an oversampling with an optimal deep learning-based streaming data classification(OS-ODLSDC)model.The aim of the OSODLSDC model is to recognize and classify the presence of anomalies in the streaming data.The proposed OS-ODLSDC model initially undergoes preprocessing step.Since streaming data is unbalanced,support vector machine(SVM)-Synthetic Minority Over-sampling Technique(SVM-SMOTE)is applied for oversampling process.Besides,the OS-ODLSDC model employs bidirectional long short-term memory(Bi LSTM)for AD and classification.Finally,the root means square propagation(RMSProp)optimizer is applied for optimal hyperparameter tuning of the Bi LSTM model.For ensuring the promising performance of the OS-ODLSDC model,a wide-ranging experimental analysis is performed using three benchmark datasets such as CICIDS 2018,KDD-Cup 1999,and NSL-KDD datasets.

Comparative Analysis of ARIMA and LSTM Model-Based Anomaly Detection for Unannotated Structural Health Monitoring Data in an Immersed Tunnel

Structural Health Monitoring(SHM)systems have become a crucial tool for the operational management of long tunnels.For immersed tunnels exposed to both traffic loads and the effects of the marine environment,efficiently identifying abnormal conditions from the extensive unannotated SHM data presents a significant challenge.This study proposed amodel-based approach for anomaly detection and conducted validation and comparative analysis of two distinct temporal predictive models using SHM data from a real immersed tunnel.Firstly,a dynamic predictive model-based anomaly detectionmethod is proposed,which utilizes a rolling time window for modeling to achieve dynamic prediction.Leveraging the assumption of temporal data similarity,an interval prediction value deviation was employed to determine the abnormality of the data.Subsequently,dynamic predictive models were constructed based on the Autoregressive Integrated Moving Average(ARIMA)and Long Short-Term Memory(LSTM)models.The hyperparameters of these models were optimized and selected using monitoring data from the immersed tunnel,yielding viable static and dynamic predictive models.Finally,the models were applied within the same segment of SHM data,to validate the effectiveness of the anomaly detection approach based on dynamic predictive modeling.A detailed comparative analysis discusses the discrepancies in temporal anomaly detection between the ARIMA-and LSTM-based models.The results demonstrated that the dynamic predictive modelbased anomaly detection approach was effective for dealing with unannotated SHM data.In a comparison between ARIMA and LSTM,it was found that ARIMA demonstrated higher modeling efficiency,rendering it suitable for short-term predictions.In contrast,the LSTM model exhibited greater capacity to capture long-term performance trends and enhanced early warning capabilities,thereby resulting in superior overall performance.

A Dual-Task Learning Approach for Bearing Anomaly Detection and State Evaluation of Safe Region

Predictive maintenance has emerged as an effective tool for curbing maintenance costs,yet prevailing research predominantly concentrates on the abnormal phases.Within the ostensibly stable healthy phase,the reliance on anomaly detection to preempt equipment malfunctions faces the challenge of sudden anomaly discernment.To address this challenge,this paper proposes a dual-task learning approach for bearing anomaly detection and state evaluation of safe regions.The proposed method transforms the execution of the two tasks into an optimization issue of the hypersphere center.By leveraging the monotonicity and distinguishability pertinent to the tasks as the foundation for optimization,it reconstructs the SVDD model to ensure equilibrium in the model’s performance across the two tasks.Subsequent experiments verify the proposed method’s effectiveness,which is interpreted from the perspectives of parameter adjustment and enveloping trade-offs.In the meantime,experimental results also show two deficiencies in anomaly detection accuracy and state evaluation metrics.Their theoretical analysis inspires us to focus on feature extraction and data collection to achieve improvements.The proposed method lays the foundation for realizing predictive maintenance in a healthy stage by improving condition awareness in safe regions.

Anomaly Detection in Imbalanced Encrypted Traffic with Few Packet Metadata-Based Feature Extraction

In the IoT(Internet of Things)domain,the increased use of encryption protocols such as SSL/TLS,VPN(Virtual Private Network),and Tor has led to a rise in attacks leveraging encrypted traffic.While research on anomaly detection using AI(Artificial Intelligence)is actively progressing,the encrypted nature of the data poses challenges for labeling,resulting in data imbalance and biased feature extraction toward specific nodes.This study proposes a reconstruction error-based anomaly detection method using an autoencoder(AE)that utilizes packet metadata excluding specific node information.The proposed method omits biased packet metadata such as IP and Port and trains the detection model using only normal data,leveraging a small amount of packet metadata.This makes it well-suited for direct application in IoT environments due to its low resource consumption.In experiments comparing feature extraction methods for AE-based anomaly detection,we found that using flowbased features significantly improves accuracy,precision,F1 score,and AUC(Area Under the Receiver Operating Characteristic Curve)score compared to packet-based features.Additionally,for flow-based features,the proposed method showed a 30.17%increase in F1 score and improved false positive rates compared to Isolation Forest and OneClassSVM.Furthermore,the proposedmethod demonstrated a 32.43%higherAUCwhen using packet features and a 111.39%higher AUC when using flow features,compared to previously proposed oversampling methods.This study highlights the impact of feature extraction methods on attack detection in imbalanced,encrypted traffic environments and emphasizes that the one-class method using AE is more effective for attack detection and reducing false positives compared to traditional oversampling methods.

Anomaly-Based Intrusion DetectionModel Using Deep Learning for IoT Networks

The rapid growth of Internet of Things(IoT)devices has brought numerous benefits to the interconnected world.However,the ubiquitous nature of IoT networks exposes them to various security threats,including anomaly intrusion attacks.In addition,IoT devices generate a high volume of unstructured data.Traditional intrusion detection systems often struggle to cope with the unique characteristics of IoT networks,such as resource constraints and heterogeneous data sources.Given the unpredictable nature of network technologies and diverse intrusion methods,conventional machine-learning approaches seem to lack efficiency.Across numerous research domains,deep learning techniques have demonstrated their capability to precisely detect anomalies.This study designs and enhances a novel anomaly-based intrusion detection system(AIDS)for IoT networks.Firstly,a Sparse Autoencoder(SAE)is applied to reduce the high dimension and get a significant data representation by calculating the reconstructed error.Secondly,the Convolutional Neural Network(CNN)technique is employed to create a binary classification approach.The proposed SAE-CNN approach is validated using the Bot-IoT dataset.The proposed models exceed the performance of the existing deep learning approach in the literature with an accuracy of 99.9%,precision of 99.9%,recall of 100%,F1 of 99.9%,False Positive Rate(FPR)of 0.0003,and True Positive Rate(TPR)of 0.9992.In addition,alternative metrics,such as training and testing durations,indicated that SAE-CNN performs better.

A Power Data Anomaly Detection Model Based on Deep Learning with Adaptive Feature Fusion

With the popularisation of intelligent power,power devices have different shapes,numbers and specifications.This means that the power data has distributional variability,the model learning process cannot achieve sufficient extraction of data features,which seriously affects the accuracy and performance of anomaly detection.Therefore,this paper proposes a deep learning-based anomaly detection model for power data,which integrates a data alignment enhancement technique based on random sampling and an adaptive feature fusion method leveraging dimension reduction.Aiming at the distribution variability of power data,this paper developed a sliding window-based data adjustment method for this model,which solves the problem of high-dimensional feature noise and low-dimensional missing data.To address the problem of insufficient feature fusion,an adaptive feature fusion method based on feature dimension reduction and dictionary learning is proposed to improve the anomaly data detection accuracy of the model.In order to verify the effectiveness of the proposed method,we conducted effectiveness comparisons through elimination experiments.The experimental results show that compared with the traditional anomaly detection methods,the method proposed in this paper not only has an advantage in model accuracy,but also reduces the amount of parameter calculation of the model in the process of feature matching and improves the detection speed.

An intelligent active probing and trace-back scheme for IoT anomaly detection

Due to their simple hardware,sensor nodes in IoT are vulnerable to attack,leading to data routing blockages or malicious tampering,which significantly disrupts secure data collection.An Intelligent Active Probing and Trace-back Scheme for IoT Anomaly Detection(APTAD)is proposed to collect integrated IoT data by recruiting Mobile Edge Users(MEUs).(a)An intelligent unsupervised learning approach is used to identify anomalous data from the collected data by MEUs and help to identify anomalous nodes.(b)Recruit MEUs to trace back and propose a series of trust calculation methods to determine the trust of nodes.(c)The last,the number of active detection packets and detection paths are designed,so as to accurately identify the trust of nodes in IoT at the minimum cost of the network.A large number of experimental results show that the recruiting cost and average anomaly detection time are reduced by 6.5 times and 34.33%respectively,while the accuracy of trust identification is improved by 20%.

Multivariate Time Series Anomaly Detection Based on Spatial-Temporal Network and Transformer in Industrial Internet of Things

In the Industrial Internet of Things(IIoT),sensors generate time series data to reflect the working state.When the systems are attacked,timely identification of outliers in time series is critical to ensure security.Although many anomaly detection methods have been proposed,the temporal correlation of the time series over the same sensor and the state(spatial)correlation between different sensors are rarely considered simultaneously in these methods.Owing to the superior capability of Transformer in learning time series features.This paper proposes a time series anomaly detection method based on a spatial-temporal network and an improved Transformer.Additionally,the methods based on graph neural networks typically include a graph structure learning module and an anomaly detection module,which are interdependent.However,in the initial phase of training,since neither of the modules has reached an optimal state,their performance may influence each other.This scenario makes the end-to-end training approach hard to effectively direct the learning trajectory of each module.This interdependence between the modules,coupled with the initial instability,may cause the model to find it hard to find the optimal solution during the training process,resulting in unsatisfactory results.We introduce an adaptive graph structure learning method to obtain the optimal model parameters and graph structure.Experiments on two publicly available datasets demonstrate that the proposed method attains higher anomaly detection results than other methods.

Advanced Optimized Anomaly Detection System for IoT Cyberattacks Using Artificial Intelligence

While emerging technologies such as the Internet of Things(IoT)have many benefits,they also pose considerable security challenges that require innovative solutions,including those based on artificial intelligence(AI),given that these techniques are increasingly being used by malicious actors to compromise IoT systems.Although an ample body of research focusing on conventional AI methods exists,there is a paucity of studies related to advanced statistical and optimization approaches aimed at enhancing security measures.To contribute to this nascent research stream,a novel AI-driven security system denoted as“AI2AI”is presented in this work.AI2AI employs AI techniques to enhance the performance and optimize security mechanisms within the IoT framework.We also introduce the Genetic Algorithm Anomaly Detection and Prevention Deep Neural Networks(GAADPSDNN)sys-tem that can be implemented to effectively identify,detect,and prevent cyberattacks targeting IoT devices.Notably,this system demonstrates adaptability to both federated and centralized learning environments,accommodating a wide array of IoT devices.Our evaluation of the GAADPSDNN system using the recently complied WUSTL-IIoT and Edge-IIoT datasets underscores its efficacy.Achieving an impressive overall accuracy of 98.18%on the Edge-IIoT dataset,the GAADPSDNN outperforms the standard deep neural network(DNN)classifier with 94.11%accuracy.Furthermore,with the proposed enhancements,the accuracy of the unoptimized random forest classifier(80.89%)is improved to 93.51%,while the overall accuracy(98.18%)surpasses the results(93.91%,94.67%,94.94%,and 94.96%)achieved when alternative systems based on diverse optimization techniques and the same dataset are employed.The proposed optimization techniques increase the effectiveness of the anomaly detection system by efficiently achieving high accuracy and reducing the computational load on IoT devices through the adaptive selection of active features.

FusionNN:A Semantic Feature Fusion Model Based on Multimodal for Web Anomaly Detection

With the rapid development of the mobile communication and the Internet,the previous web anomaly detectionand identificationmodels were built relying on security experts’empirical knowledge and attack features.Althoughthis approach can achieve higher detection performance,it requires huge human labor and resources to maintainthe feature library.In contrast,semantic feature engineering can dynamically discover new semantic featuresand optimize feature selection by automatically analyzing the semantic information contained in the data itself,thus reducing dependence on prior knowledge.However,current semantic features still have the problem ofsemantic expression singularity,as they are extracted from a single semantic mode such as word segmentation,character segmentation,or arbitrary semantic feature extraction.This paper extracts features of web requestsfrom dual semantic granularity,and proposes a semantic feature fusion method to solve the above problems.Themethod first preprocesses web requests,and extracts word-level and character-level semantic features of URLs viaconvolutional neural network(CNN),respectively.By constructing three loss functions to reduce losses betweenfeatures,labels and categories.Experiments on the HTTP CSIC 2010,Malicious URLs and HttpParams datasetsverify the proposedmethod.Results show that compared withmachine learning,deep learningmethods and BERTmodel,the proposed method has better detection performance.And it achieved the best detection rate of 99.16%in the dataset HttpParams.

A Security Trade-Off Scheme of Anomaly Detection System in IoT to Defend against Data-Tampering Attacks

Internet of Things(IoT)is vulnerable to data-tampering(DT)attacks.Due to resource limitations,many anomaly detection systems(ADSs)for IoT have high false positive rates when detecting DT attacks.This leads to the misreporting of normal data,which will impact the normal operation of IoT.To mitigate the impact caused by the high false positive rate of ADS,this paper proposes an ADS management scheme for clustered IoT.First,we model the data transmission and anomaly detection in clustered IoT.Then,the operation strategy of the clustered IoT is formulated as the running probabilities of all ADSs deployed on every IoT device.In the presence of a high false positive rate in ADSs,to deal with the trade-off between the security and availability of data,we develop a linear programming model referred to as a security trade-off(ST)model.Next,we develop an analysis framework for the ST model,and solve the ST model on an IoT simulation platform.Last,we reveal the effect of some factors on the maximum combined detection rate through theoretical analysis.Simulations show that the ADS management scheme can mitigate the data unavailability loss caused by the high false positive rates in ADS.

Anomaly Detection Algorithm of Power System Based on Graph Structure and Anomaly Attention

In this paper, we propose a novel anomaly detection method for data centers based on a combination of graphstructure and abnormal attention mechanism. The method leverages the sensor monitoring data from targetpower substations to construct multidimensional time series. These time series are subsequently transformed intograph structures, and corresponding adjacency matrices are obtained. By incorporating the adjacency matricesand additional weights associated with the graph structure, an aggregation matrix is derived. The aggregationmatrix is then fed into a pre-trained graph convolutional neural network (GCN) to extract graph structure features.Moreover, both themultidimensional time series segments and the graph structure features are inputted into a pretrainedanomaly detectionmodel, resulting in corresponding anomaly detection results that help identify abnormaldata. The anomaly detection model consists of a multi-level encoder-decoder module, wherein each level includesa transformer encoder and decoder based on correlation differences. The attention module in the encoding layeradopts an abnormal attention module with a dual-branch structure. Experimental results demonstrate that ourproposed method significantly improves the accuracy and stability of anomaly detection.

Cross-Dimension Attentive Feature Fusion Network for Unsupervised Time-Series Anomaly Detection

Time series anomaly detection is crucial in various industrial applications to identify unusual behaviors within the time series data.Due to the challenges associated with annotating anomaly events,time series reconstruction has become a prevalent approach for unsupervised anomaly detection.However,effectively learning representations and achieving accurate detection results remain challenging due to the intricate temporal patterns and dependencies in real-world time series.In this paper,we propose a cross-dimension attentive feature fusion network for time series anomaly detection,referred to as CAFFN.Specifically,a series and feature mixing block is introduced to learn representations in 1D space.Additionally,a fast Fourier transform is employed to convert the time series into 2D space,providing the capability for 2D feature extraction.Finally,a cross-dimension attentive feature fusion mechanism is designed that adaptively integrates features across different dimensions for anomaly detection.Experimental results on real-world time series datasets demonstrate that CAFFN performs better than other competing methods in time series anomaly detection.

Challenging situation of coronary artery anomaly associated with ischemia and/or risk of sudden death

Coronary artery anomaly is known as one of the causes of angina pectoris and sudden death and is an important clinical entity that cannot be overlooked.The incidence of coronary artery anomalies is as low as 1%-2%of the general population,even when the various types are combined.Coronary anomalies are practically challenging when the left and right coronary ostium are not found around their normal positions during coronary angiography with a catheter.If there is atherosclerotic stenosis of the coronary artery with an anomaly and percutaneous coronary intervention(PCI)is required,the suitability of the guiding catheter at the entrance and the adequate back up force of the guiding catheter are issues.The level of PCI risk itself should also be considered on a caseby-case basis.In this case,emission computed tomography in the R-1 subtype single coronary artery proved that ischemia occurred in an area where the coronary artery was not visible to the naked eye.Meticulous follow-up would be crucial,because sudden death may occur in single coronary arteries.To prevent atherosclerosis with full efforts is also important,as the authors indicated admirably.

Machine Learning Models for Heterogenous Network Security Anomaly Detection

The increasing amount and intricacy of network traffic in the modern digital era have worsened the difficulty of identifying abnormal behaviours that may indicate potential security breaches or operational interruptions. Conventional detection approaches face challenges in keeping up with the ever-changing strategies of cyber-attacks, resulting in heightened susceptibility and significant harm to network infrastructures. In order to tackle this urgent issue, this project focused on developing an effective anomaly detection system that utilizes Machine Learning technology. The suggested model utilizes contemporary machine learning algorithms and frameworks to autonomously detect deviations from typical network behaviour. It promptly identifies anomalous activities that may indicate security breaches or performance difficulties. The solution entails a multi-faceted approach encompassing data collection, preprocessing, feature engineering, model training, and evaluation. By utilizing machine learning methods, the model is trained on a wide range of datasets that include both regular and abnormal network traffic patterns. This training ensures that the model can adapt to numerous scenarios. The main priority is to ensure that the system is functional and efficient, with a particular emphasis on reducing false positives to avoid unwanted alerts. Additionally, efforts are directed on improving anomaly detection accuracy so that the model can consistently distinguish between potentially harmful and benign activity. This project aims to greatly strengthen network security by addressing emerging cyber threats and improving their resilience and reliability.

Electron G-Factor Anomaly and the Charge Thickness

The electron g-factor relates the magnetic moment to the spin angular momentum. It was originally theoretically calculated to have a value of exactly 2. Experiments yielded a value of 2 plus a very small fraction, referred to as the g-factor anomaly. This anomaly has been calculated theoretically as a power series of the fine structure constant. This document shows that the anomaly is the result of the electron charge thickness. If the thickness were to be zero, g = 2 exactly, and there would be no anomaly. As the thickness increases, the anomaly increases. An equation relating the g-factor and the surface charge thickness is presented. The thickness is calculated to be 0.23% of the electron radius. The cause of the anomaly is very clear, but why is the charge thickness greater than zero? Using the model of the interior structure of the electron previously proposed by the author, it is shown that the non-zero thickness, and thus the g-factor anomaly, are due to the proposed positive charge at the electron center and compressibility of the electron material. The author’s previous publication proposes a theory for splitting the electron into three equal charges when subjected to a strong external magnetic field. That theory is revised in this document, and the result is an error reduced to 0.4% in the polar angle where the splits occur and a reduced magnetic field required to cause the splits.

Investigation of Potential Factors on South Atlantic Magnetic Anomaly

The first part of this investigation analyzes the deep earthquake occurrences in Nazca subducting under South America. The depth taken is to get information about possible influences from the unknown materials and formations under the crust. The results revealed the presence of malleable material, which is unbreakable and, therefore, unable to trigger earthquakes. The structure of those elements is diamagnetic, attracting ionized particles from the Van Allen belt region in the ionosphere. The charged particles travel towards Earth’s surface, enhanced during the geomagnetic storms. The South Atlantic Magnetic Anomaly (SAMA) found that the deformation suffered by the anomaly moving from South Africa to South America is, possibly due to a bulge of unknown flexible material buried underneath the oceanic and continental crust. The continental part is strengthening in weakness because the background also has a high amount of diamagnetic material in this region, and it would not happen over the Atlantic Ocean, where part of the deformation is placed.

Anomaly-Resistant Decentralized State Estimation Under Minimum Error Entropy With Fiducial Points for Wide-Area Power Systems

This paper investigates the anomaly-resistant decentralized state estimation(SE) problem for a class of wide-area power systems which are divided into several non-overlapping areas connected through transmission lines. Two classes of measurements(i.e., local measurements and edge measurements) are obtained, respectively, from the individual area and the transmission lines. A decentralized state estimator, whose performance is resistant against measurement with anomalies, is designed based on the minimum error entropy with fiducial points(MEEF) criterion. Specifically, 1) An augmented model, which incorporates the local prediction and local measurement, is developed by resorting to the unscented transformation approach and the statistical linearization approach;2) Using the augmented model, an MEEF-based cost function is designed that reflects the local prediction errors of the state and the measurement;and 3) The local estimate is first obtained by minimizing the MEEF-based cost function through a fixed-point iteration and then updated by using the edge measuring information. Finally, simulation experiments with three scenarios are carried out on the IEEE 14-bus system to illustrate the validity of the proposed anomaly-resistant decentralized SE scheme.

The Response of Anomalous Vertically Integrated Moisture Flux Patterns Related to Drought and Flood in Southern China to Sea Surface Temperature Anomaly

With the extreme drought(flood)event in southern China from July to August in 2022(1999)as the research object,based on the comprehensive diagnosis and composite analysis on the anomalous drought and flood years from July to August in 1961-2022,it is found that there are significant differences in the characteristics of the vertically integrated moisture flux(VIMF)anomaly circulation pattern and the VIMF convergence(VIMFC)anomaly in southern China in drought and flood years,and the VIMFC,a physical quantity,can be regarded as an indicative physical factor for the"strong signal"of drought and flood in southern China.Specifically,in drought years,the VIMF anomaly in southern China is an anticyclonic circulation pattern and the divergence characteristics of the VIMFC are prominent,while those are opposite in flood years.Based on the SST anomaly in the typical draught year of 2022 in southern China and the SST deviation distribution characteristics of abnormal draught and flood years from 1961 to 2022,five SST high impact areas(i.e.,the North Pacific Ocean,Northwest Pacific Ocean,Southwest Pacific Ocean,Indian Ocean,and East Pacific Ocean)are selected via the correlation analysis of VIMFC and the global SST in the preceding months(May and June)and in the study period(July and August)in 1961-2022,and their contributions to drought and flood in southern China are quantified.Our study reveals not only the persistent anomalous variation of SST in the Pacific and the Indian Ocean but also its impact on the pattern of moisture transport.Furthermore,it can be discovered from the positive and negative phase fitting of SST that the SST composite flow field in high impact areas can exhibit two types of anomalous moisture transport structures that are opposite to each other,namely an anticyclonic(cyclonic)circulation pattern anomaly in southern China and the coastal areas of east China.These two types of opposite anomalous moisture transport structures can not only drive the formation of drought(flood)in southern China but also exert its influence on the persistent development of the extreme weather.

Adverse Geology Identification Through Mineral Anomaly Analysis During Tunneling:Methodology and Case Study

Accurate and effective identification of adverse geology is crucial for safe and efficient tunnel construction.Current methods of identifying adverse geology depend on the experience of geologists and are prone to misjudgment and omissions.Here,we propose a method for adverse geology identification in tunnels based on mineral anomaly analysis.The method is based on the theory of geoanomaly,and the mineral anomalies are geological markers of the presence of adverse geology.The method uses exploration data analysis(EDA)to calculate mineral anomaly thresholds,then evaluates the mineral anomalies based on the thresholds and identifies adverse geology based on the characteristics of the mineral anomalies.We have established a dynamic expansion process for background samples to achieve the dynamic evaluation of mineral anomalies by adjusting anomaly thresholds.This method has been validated and applied in a tunnel excavated in granite.As shown herein,in the tunnel range of 142+800–142+860,the fault F37 was successfully identified based on an anomalous decrease in the diagenetic minerals plagioclase and hornblende,as well as an anomalous increase in the content of the alteration minerals chlorite,laumonite,and epidote.The proposed method provides a timely warning when a tunnel enters areas affected by adverse geology and identifies whether the tunnel is gradually approaching or moving away from the fault.In addition,the applicability,accuracy,and further improvement of the method are discussed.This method improves our ability to identify adverse geology,from qualitative to quantitative,and can provide reference and guidance for the identification of adverse geology in mining and underground engineering.