Industrial anomaly detection is dedicated to identifying and locating regions that deviate from the standard appearance.The prevailing approach achieves unsupervised anomaly detection through the reconstruction of ima...Industrial anomaly detection is dedicated to identifying and locating regions that deviate from the standard appearance.The prevailing approach achieves unsupervised anomaly detection through the reconstruction of images using autoencoders.Due to the simplistic structure of some abnormal regions,the autoencoder can effectively reconstruct these areas,consequently diminishing the model’s anomaly detection capabilities.To address this issue,this paper transforms the reconstruction task into the inpainting-filling-reconstruction task to increase the reconstruction error between abnormal samples and normal samples.The masked regions inpainted by the filling network are used to fill in the input image,thereby achieving an effect similar to masking.Unlike typical masking processes,this approach retains partial authentic information in the input image,rendering it partially visible.This is beneficial for the reconstruction network to repair the masked areas.Due to the consistent structure between the masked region inpainted by the filling network and the normal region,the filled abnormal regions display a complex structure that has not been learned,making it difficult for the reconstruction network to reconstruct the abnormal regions.Experimental results indicate that our method performs better than other methods on both the MVTec AD dataset and the MVTec LOCO AD dataset.展开更多
With the rapid development of Artificial Intelligence of Things(AIoT)technologies,the security of Industrial Internet of Things(IIoT)data faces increasing challenges,particularly in time series anomaly detection.IIoT ...With the rapid development of Artificial Intelligence of Things(AIoT)technologies,the security of Industrial Internet of Things(IIoT)data faces increasing challenges,particularly in time series anomaly detection.IIoT data are typically scarce in abnormal samples and noisy,making unsupervised learning a common solution.The security challenges of IIoT data in AIoT environments require robust unsupervised anomaly detection methods.While Variational Autoencoders(VAEs)excel in noise resilience,they face two critical challenges in IIoT data:difficulties in single-variable time-series modeling and conflicts between static prior assumptions and dynamic temporal features.To address these challenges,we propose the Greater Cane Rat Algorithm-enhanced FourierWavelet Conditional Variational Autoencoder(GCRA-FWVAE).Our method introduces a time-frequency dualbranch architecture that synergistically combines wavelet transforms for localized transient feature extraction and Fourier transforms for global spectral characterization.These complementary representations jointly regulate the Conditional Variational Autoencoder(CVAE)reconstruction process,effectively preserving critical anomaly signatures while suppressing noise interference.The architecture is further optimized through bioinspired Greater Cane Rat Algorithm(GCRA)to improve adaptive learning capabilities.Extensive validation on the Yahoo benchmark indicates state-of-the-art performance,achieving an F1-score of 93.6%(an improvement of 4.5% over baseline VAEs)and a precision of 95.1%.These improvements significantly increase anomaly detection accuracy and robustness,particularly in the AIoT environment,where it effectively handles more complex and dynamic industrial data.展开更多
Log anomaly detection is essential for maintaining the reliability and security of large-scale networked systems.Most traditional techniques rely on log parsing in the reprocessing stage and utilize handcrafted featur...Log anomaly detection is essential for maintaining the reliability and security of large-scale networked systems.Most traditional techniques rely on log parsing in the reprocessing stage and utilize handcrafted features that limit their adaptability across various systems.In this study,we propose a hybrid model,BertGCN,that integrates BERT-based contextual embedding with Graph Convolutional Networks(GCNs)to identify anomalies in raw system logs,thereby eliminating the need for log parsing.TheBERT module captures semantic representations of log messages,while the GCN models the structural relationships among log entries through a text-based graph.This combination enables BertGCN to capture both the contextual and semantic characteristics of log data.BertGCN showed excellent performance on the HDFS and BGL datasets,demonstrating its effectiveness and resilience in detecting anomalies.Compared to multiple baselines,our proposed BertGCN showed improved precision,recall,and F1 scores.展开更多
Maintaining constant mold level variations during the continuous casting process is essential to guarantee the effectiveness and quality of steel production. An unsupervised deep learning-based mold level anomaly dete...Maintaining constant mold level variations during the continuous casting process is essential to guarantee the effectiveness and quality of steel production. An unsupervised deep learning-based mold level anomaly detection (MLAD) model for real-time monitoring of mold level fluctuations under varying operating conditions was proposed. The MLAD framework employs a two-stage encoder-decoder structure with adversarial training to accurately reconstruct time-series mold level data. In the first stage, the model learns long-term trends by reconstructing input windows, while in the second stage, it employs reconstruction errors as focus scores to capture short-term anomaly patterns. A transformer-based architecture, incorporating multi-head attention mechanisms and positional encoding, enables MLAD to capture both local and global temporal dependencies. In addition, a novel multi-threshold strategy, based on extreme value theory, is implemented to enhance the model’s ability and to adapt to varying operating conditions, including startup, steady-state, and shutdown phases. The model was validated with over 240-h real data from a steel factory. The results demonstrate its superior performance in anomaly detection compared to popular methods, with a precision of 0.9937, recall of 0.9932, and a low false alarm rate of 0.0038. MLAD represents a significant advancement in the detection of nonlinear and nonstationary anomalies in industrial processes, offering an efficient solution for smart manufacturing systems. Therefore, the established model could be used for online anomaly detection of mold level with real-time data.展开更多
Multivariate time series anomaly detection(MTSAD)is a critical task for real-time risk control and fault diagnosis in industrial monitoring,aerospace,and financial domains.Unsupervised MTSAD confronts three core chall...Multivariate time series anomaly detection(MTSAD)is a critical task for real-time risk control and fault diagnosis in industrial monitoring,aerospace,and financial domains.Unsupervised MTSAD confronts three core challenges:label scarcity in practical scenarios,diverse anomaly patterns that demand adaptive modeling,and weak feature discriminability between normal and anomalous samples.To address these challenges,we propose a Prototype Memory and Contrastive Learning Based Unsupervised Anomaly Detection for Multivariate Time Series method named PC-UAD.PC-UAD comprises three core modules with hierarchical functionalities:(1)A Temporal PatchEmbedder,which adopts learnable positional encoding for dynamic temporal representation and incorporates channel projection to model adaptive cross-sensor dependencies in multivariate data;(2)A Prototype Memory Encoder,which embeds a prototype attention mechanism to explicitly memorize typical normal patterns,forming a“normal pattern dictionary”that enhances the model’s perception of normal behavioral boundaries;(3)A ContrastFusion module,which leverages contrastive learning to amplify feature distribution discrepancies between normal and anomalous data,strengthening the model’s ability to distinguish subtle anomalies.Experiments on five public multivariate time series datasets demonstrate that our method achieves superior detection accuracy compared to eight state-of-the-art approaches,with the average F1-score and ROC-AUC both ranking first.展开更多
Efficient and accurate anomaly detection in a network is of great significance for maintaining network and device security.Most anomaly detection methods assume that different anomalous network data distributions are ...Efficient and accurate anomaly detection in a network is of great significance for maintaining network and device security.Most anomaly detection methods assume that different anomalous network data distributions are the same or similar and ignore data privacy preservation.In this paper,a novel Federated Learning(FL)is proposed that it can quickly detect different types of anomalies in Non-Independent and Identically Distributed(Non-IID)data.First,we design a multi-domain machine learning model for multi-domain data,named Aegean,which consists of two modules:an ensemble AutoEncoder(AE)and a Generative Adversarial Network(GAN).Second,because data from different domains are non-IID,we model the anomaly detection problem as a dual problem,which can be recast as a robust optimization problem.The robust optimization problem is non-convex and therefore difficult to solve.As a remedy,we formulate and solve a dual problem by taking the Lagrangian dual function of the original problem.Experiments demonstrate that Aegean significantly outperforms the current state-of-the-art methods,with a 16%F1 score improvement over that of a One-Class Support Vector Machine(OCSVM).The designed FL significantly reduces the communication overhead of FedAvg without sacrificing anomaly detection performance.展开更多
Maritime Domain Awareness(MDA)is critical for global security and economic stability,yet it is increasingly challenged by sophisticated adversarial tactics such as signal spoofing and“dark vessel”activities.Traditio...Maritime Domain Awareness(MDA)is critical for global security and economic stability,yet it is increasingly challenged by sophisticated adversarial tactics such as signal spoofing and“dark vessel”activities.Traditional surveillance systems,often reliant on single-sensor modalities,are ill-equipped to handle these deceptive behaviors.To address this,we propose the Multimodal Attention-based Fusion Transformer(MAFT),a novel deep learning architecture that integrates four distinct data modalities—Aerial imagery,Synthetic Aperture Radar(SAR),acoustic signatures,and Automatic Identification System(AIS)data—to achieve robust and interpretable maritime anomaly detection.A key contribution of our work is a principled synthetic data generation pipeline that creates a large-scale,labeled dataset(16,000 samples)for four critical anomaly types:Correlated Activity,Dark Vessels,AIS Spoofing,and Kinematic Anomalies.MAFT architecture employs modality-specific encoders to project heterogeneous data into a common 320-dimensional embedding space.These embeddings are then tokenized and supplied to a multi-layer Transformer Encoder,which leverages a self-attention mechanism for late-fusion,learning complex,non-linear inter-modal relationships.We also introduce“modality dropout”(p=0.3)as a regularization technique to enhance model robustness against sensor failure or data unavailability.Quantitative analysis shows our model achieves a 97.02%F1-score and a significantly improved Expected Calibration Error(ECE)of 0.011,outperforming Early Fusion CNN,Mid-Fusion MLP,and Decision-Ensemble baselines.Furthermore,computational profiling confirms an inference latency of 26.54 ms,demonstrating operational readiness for real-time deployment.Analysis of the model’s attention weights suggests that MAFT not only accurately classifies maritime activities but also provides a high degree of model interpretability,offering crucial,data-driven insights for maritime security operators.展开更多
The deployment of supervised anomaly detection is typically limited by the high cost of annotation,privacy constraints,and the scarcity of anomalous samples.These constraints have motivated the use of vision-language ...The deployment of supervised anomaly detection is typically limited by the high cost of annotation,privacy constraints,and the scarcity of anomalous samples.These constraints have motivated the use of vision-language pre-trained models for zero-shot anomaly detection.However,existing CLIP-based methods still face three limitations:a shared set of prompts is applied across feature layers,anomaly maps are fused by fixed strategies,and image-level anomaly scores are determined solely by global image-text similarity.These limitations reduce the accuracy of pixel-level localization and weaken the reliability of image-level anomaly prediction.To overcome these limitations,LaRP-CLIP is proposed.It introduces layer-aware prompt decoupling to better match feature layers with different semantic characteristics,adaptive fusion with error-prior-guided local refinement to produce cleaner and more precise anomaly maps,and a prototype branch to improve image-level scoring.Experiments on four industrial datasets and seven medical datasets show that LaRP-CLIP achieves strong performance in both image-level detection and pixel-level localization.展开更多
How computers can acquire the capability of radiologists to identify various anomalies within 3D medical images remains a central and challenging problem in intelligent imaging diagnosis.Supervised learning methods re...How computers can acquire the capability of radiologists to identify various anomalies within 3D medical images remains a central and challenging problem in intelligent imaging diagnosis.Supervised learning methods relying on lesion-level annotations are restricted to detecting a limited set of lesion types similar to those in the training data.Furthermore,obtaining voxel-level annotations is notoriously labor-intensive and time-consuming.To address these challenges,researchers have proposed unsupervised anomaly detection(UAD)methods for 3D medical images that learn from normal(healthy)samples.These approaches aim to identify any lesion that deviates from the learned normal anatomical distribution.Centered on this principle,three distinct UAD paradigms have emerged:self-supervised learning-based methods that train supervised models by constructing synthetic anomalies;deep feature embedding-based methods that measure the distance between test features and normal feature distribution;and reconstruction-based methods that transform abnormal images into pseudo-healthy images based on learned normal patterns.This paper provides a comprehensive review,analysis,and comparison of key studies within these three categories,highlighting their respective strengths,limitations,and potential research directions.Moreover,existing UAD methods are often validated using inconsistent datasets or preprocessing pipelines,making fair performance comparisons challenging.To address this issue,we establish a unified benchmark for evaluating UAD methods on 3D medical images,comprising nine brain MRI datasets(4365 cases)and six liver CT datasets(376 cases).Using this benchmark,we evaluate the performance of 21 representative state-of-the-art algorithms on the 3D voxel-level anomaly localization task,objectively revealing the advantages and limitations of these methods.展开更多
Anomaly detection in system logs is a critical technical means for identifying potential faults and security risks.In distributed environments,traditional deep learning-based log anomaly detection methods often suffer...Anomaly detection in system logs is a critical technical means for identifying potential faults and security risks.In distributed environments,traditional deep learning-based log anomaly detection methods often suffer from shortcomings in transparency,computational overhead,and data privacy protection.To address these issues,this paper proposes a federated learning-driven lightweight and explainable log anomaly detection framework named FedXLog.The framework adapts to heterogeneous logs through hierarchical feature extraction,introduces the Federated Gradient Trajectory Aggregation algorithm(FedGradTrace)to enhance the explainability of the parameter aggregation process,constructs lightweight models using knowledge distillation,and achieves globally consistent explanatory capabilities by integrating hash feature alignment.Experimental results demonstrate that FedXLog possesses the dual advantages of high detection accuracy and lightweight deployment for heterogeneous logs in distributed scenarios.It can effectively identify key decision-making features and locate typical root causes of anomalies.Notably,the framework has been specifically optimized for the unique characteristics of distributed logs.Distinguished from general federated explainable methods,it can directly support abnormal root cause localization in Operations and Maintenance scenarios.This further verifies the application value of scenario-specific adaptation of federated learning in the field of log analysis,thereby expanding the scope of application of explainable log anomaly detection.展开更多
Improving the energy efficiency of information transmission is very critical to the development of future Internet of Things(IoT).Considering the sporadic characteristics for IoT transmissions,the energy consumption o...Improving the energy efficiency of information transmission is very critical to the development of future Internet of Things(IoT).Considering the sporadic characteristics for IoT transmissions,the energy consumption of a specific transmission session significantly varies with channel condition and Quality of Service(QoS)requirements.In this study,we focus on the analysis and optimization for wireless relaying communications'statistical energy consumption.Particularly,we investigate a wirelessly-powered DF relaying communication system.Under Time Switching(TS)and Power Splitting(PS)modes,we analyze and minimize the statistical energy consumption of transmitting a fixed amount of data using mathematical analysis.Through showing some selected numerical examples,we discuss various design tradeoffs.These results will provide some important guidelines for the design of green IoT communication systems.展开更多
Deep transfer learning has achieved significant success in anomaly detection over the past decade,but data acquisition challenges in practical engineering hinder high-quality feature representation for few-shot learni...Deep transfer learning has achieved significant success in anomaly detection over the past decade,but data acquisition challenges in practical engineering hinder high-quality feature representation for few-shot learning tasks.To address this issue,a novel time-frequency-assisted deep feature enhancement(TFE)mechanism is proposed.Unlike traditional methods that integrate time-frequency analysis with deep neural networks,TFE employs a wavelet scattering transform to establish a parallel time-frequency feature space,where a dual interaction strategy facilitates collaboration between deep feature and time-frequency spaces through two operations:1)Enhancement,where a frequency-importance-driven contrastive learning(FICL)network transfers physically-aware information from wavelet scattering features to deep features,and 2)Feedback,which uses a detection rule adaptation module to minimize bias in wavelet scattering features based on deep feature performance.TFE is applied to a domain-adversarial anomaly detection framework and,through alternating training,significantly enhances both deep feature discriminative power and few-shot anomaly detection.Theoretical analysis confirms that the proposed dual interaction strategy reduces the upper bound of classification error.Experiments on benchmark datasets and a real-world industrial dataset from a large steel factory demonstrate TFE's superior performance and highlight the importance of frequency saliency in transfer learning.Thus,collaboration is shown to outperform integration for few-shot transfer learning in anomaly detection.展开更多
Blockchain networks are under mounting pressure from emerging complex zero-day attacks that cannot be prevented with conventional security measures.In this paper,we introduce NeuroChain Sentinel,a new bio-inspired cyb...Blockchain networks are under mounting pressure from emerging complex zero-day attacks that cannot be prevented with conventional security measures.In this paper,we introduce NeuroChain Sentinel,a new bio-inspired cybersecurity model based on spiking neural networks for detecting anomalies in a distributed ledger system in real time.The main innovations are:a Temporal Spike Pattern Recognition algorithm for simulating the biological timing of the neural system to detect malicious transaction patterns;a distributed consensus-verification topology combined with blockchain algorithms;and small-scale neuromorphic engineering,resulting in an 87%reduction in computational load over conventional deep neural networks.In contrast to current rule-based or supervised mechanisms that use labeled attack data,NeuroChain Sentinel uses unsupervised learning with spike-timing-dependent plasticity and automatically discovers novel attack vectors,such as smart contract exploits,51%attacks,and vulnerabilities in consensus mechanisms.An extensive analysis of Ethereum fraud detection data reveals that 99.64%of all data is detected with a 0.8%false-positive(FP)rate,and the Receiver Operating Characteristic-Area Under the Curve(ROC-AUC)value is 0.9999.The Matthews Correlation Coefficient(MCC)is 0.9897.Given these advantages,the existing implementation is tested only against Ethereum transaction information and has not yet been extended to heterogeneous blockchain architectures.The framework will be generalized to many blockchain platforms,scalability in high-throughput environments will be improved,and its robustness against adversarial attacks will be enhanced.展开更多
Hybrid and multi-cloud infrastructures make IP address management(IPAM)difficult,especially when IP and Domain Name System(DNS)records must stay consistent across on-premises networks and cloud platforms.Traditional I...Hybrid and multi-cloud infrastructures make IP address management(IPAM)difficult,especially when IP and Domain Name System(DNS)records must stay consistent across on-premises networks and cloud platforms.Traditional IPAM tools often lack deep automation and cross-platform visibility,which leads to DNS drift,IP conflicts,and configuration errors.This paper proposes a unified,Application Programming Interface(API)-driven IPAM framework that integrates Infoblox Network Identity Operating System(NIOS)with Amazon Web Services(AWS)Route53 and Azure DNS using Infrastructure-as-Code and CI/CD pipelines.We generate an IPAM event log from Infoblox API simulations and fuse it with the UNSW-NB15 cybersecurity dataset to train a deep Long Short-Term Memory(LSTM)-based anomaly detection model.On this fused dataset,the propose model achieves an accuracy of 0.912 and an F1-score of 0.900,outperforming Random Forest,Logistic Regression,one-dimensional convolutional neural network(1D-CNN),and Gated Recurrent Unit(GRU)baselines.The automation pipeline also reduces end-to-end provisioning latency to 1010 ms and improves DNS consistency to 99.1%across Infoblox,AWS,and Azure.The framework provides scalable,auditable,and policy-driven IPAM while reducing manual work and configuration drift in hybrid cloud environments.展开更多
Smart Grid infrastructures have enhanced energy distribution efficiency,reliability,and sustainability,but their proper operation requires robust anomaly detection to mitigate risks from equipment failures,cyberattack...Smart Grid infrastructures have enhanced energy distribution efficiency,reliability,and sustainability,but their proper operation requires robust anomaly detection to mitigate risks from equipment failures,cyberattacks,and natural disasters.Federated Learning(FL)offers a privacy-preserving solution by allowing power plants and grid sectors to collaboratively train models without sharing raw data,addressing privacy concerns,regulatory compliance,and single points of failure that often emerge in centralized approaches.FL also improves real-time anomaly detection and scalability by adapting dynamically to different grid topologies while incurring minimal communication overhead.Within our FL framework,Transformer models excel in anomaly detection due to their self-attention mechanisms that capture intricate temporal dependencies in sensor data.Unlike traditional models,Transformers effectively learn long-range patterns,enhancing detection accuracy and responsiveness.This work conducts a comparative study of two state-of-the-art Tranformer models in an FL environment,evaluating their anomaly detection performance across four diverse smart grid datasets.To assess robustness,we introduce a GAN-based Anomaly Injection Attack(GAIA)that generates and injects realistic syntheitc anomalies.Our results indicate that both federated Transformer models achieve high detection performance across seven metrics,even under adversarial conditions,offering valuable insights into their capabilities in decentralized smart grid applications.展开更多
Multivariate anomaly detection plays a critical role in maintaining the stable operation of information systems.However,in existing research,multivariate data are often influenced by various factors during the data co...Multivariate anomaly detection plays a critical role in maintaining the stable operation of information systems.However,in existing research,multivariate data are often influenced by various factors during the data collection process,resulting in temporal misalignment or displacement.Due to these factors,the node representations carry substantial noise,which reduces the adaptability of the multivariate coupled network structure and subsequently degrades anomaly detection performance.Accordingly,this study proposes a novel multivariate anomaly detection model grounded in graph structure learning.Firstly,a recommendation strategy is employed to identify strongly coupled variable pairs,which are then used to construct a recommendation-driven multivariate coupling network.Secondly,a multi-channel graph encoding layer is used to dynamically optimize the structural properties of the multivariate coupling network,while a multi-head attention mechanism enhances the spatial characteristics of the multivariate data.Finally,unsupervised anomaly detection is conducted using a dynamic threshold selection algorithm.Experimental results demonstrate that effectively integrating the structural and spatial features of multivariate data significantly mitigates anomalies caused by temporal dependency misalignment.展开更多
Anomaly detection(AD)aims to identify abnormal patterns that deviate from normal behaviour,playing a critical role in applications such as industrial inspection,medical imaging and autonomous driving.However,AD often ...Anomaly detection(AD)aims to identify abnormal patterns that deviate from normal behaviour,playing a critical role in applications such as industrial inspection,medical imaging and autonomous driving.However,AD often faces a scarcity of labelled data.To address this challenge,we propose a novel semi-supervised anomaly detection method,DASAD(Deviation-Guided Attention for Semi-Supervised Anomaly Detection),which integrates deviation-guided attention with contrastive regularisation to reduce the unreliability of pseudo-labels.Specifically,a deviation-guided attention mechanism is designed to combine three types of deviations:latent embeddings,residual direction vectors and hierarchical reconstruction errors to capture anomaly specific cues effectively,thereby enhancing the credibility of pseudo-labels for unlabelled samples.Furthermore,a class-asymmetric contrastive loss is constructed to promote compact representations of normal instances while preserving the structural diversity of anomalies.Extensive experiments on 8 benchmark datasets demonstrate that DASAD consistently outperforms state-of-the-art methods and exhibits strong generalisation across 6 anomaly detection domains.展开更多
The explosive increase in connectivity has multiplied the volume and speed of network traffic,putting the world at greater risk from sophisticated and emerging cyber-attacks.Smart learning environments,which rely on c...The explosive increase in connectivity has multiplied the volume and speed of network traffic,putting the world at greater risk from sophisticated and emerging cyber-attacks.Smart learning environments,which rely on cloud-based learning management systems,virtual classrooms,and interconnected educational devices,generate large volumes of dynamic network traffic that must be continuously monitored to protect sensitive academic data and ensure uninterrupted learning services.In this study,three supervised machine learning classifiers,namely Random Forest,Logistic Regression,and k-Nearest Neighbours(kNN),are designed and evaluated for anomaly detection using the UNSW-NB15 benchmark.Models are trained and evaluated using a comprehensive set of metrics,including accuracy,precision,recall,F1-score,ROC-AUC,and confusion matrix analysis,following rigorous preprocessing and stratified cross-validation.Consistent with observed patterns in the dataset,Random Forest achieves near-perfect detection accuracy with very low false alarm rates,kNN performs well with moderate error rates,and Logistic Regression shows comparatively lower performance.This study develops a reproducible anomaly detection pipeline and provides a comparative evaluation that highlights the conditions under which ensemble and instance-based models outperform linear approaches in high-dimensional network traffic analysis.These findings align with existing evidence highlighting the effectiveness of data-centric machine learning pipelines in improving decision-making in high-volume digital environments.In the context of smart learning environments,these models can support the development of intelligent intrusion detection systems capable of monitoring educational network infrastructures and identifying abnormal traffic patterns associated with cyber threats targeting digital learning platforms.The findings provide practical guidance for selecting machine learning models in intrusion detection systems where detection performance must be balanced with computational efficiency and deployment constraints.展开更多
The rapid digitalization of the energy sector has led to the deployment of large-scale smart metering systems that generate high-frequency time series data,creating new opportunities and challenges for energy anomaly ...The rapid digitalization of the energy sector has led to the deployment of large-scale smart metering systems that generate high-frequency time series data,creating new opportunities and challenges for energy anomaly detection.Accurate identification of anomalous patterns in building energy consumption is essential for optimizing operations,improving energy efficiency,and supporting grid reliability.This study investigates advanced feature engineering and machine learning modeling techniques for large-scale time series anomaly detection in building energy systems.Expanding upon previous benchmark frameworks,we introduce additional features such as oil price indices and solar cycle indicators,including sunset and sunrise times,to enhance the contextual understanding of consumption patterns.Our comparative modeling approach encompasses an extensive suite of algorithms,including KNeighborsUnif,KNeighborsDist,LightGBMXT,LightGBM,RandomForestMSE,CatBoost,ExtraTreesMSE,NeuralNetFastAI,XGBoost,NeuralNetTorch,and LightGBMLarge.Data preprocessing includes rigorous handling of missing values and normalization,while feature engineering focuses on temporal,environmental,and value-change attributes.The models are evaluated on a comprehensive dataset of smart meter readings,with performance assessed using metrics such as the Area Under the Receiver Operating Characteristic Curve(AUC-ROC).The results demonstrate that the integration of diverse exogenous variables and a hybrid ensemble of traditional tree-based and neural network models can significantly improve anomaly detection performance.This work provides new insights into the design of robust,scalable,and generalizable frameworks for energy anomaly detection in complex,real-world settings.展开更多
In the field of intelligent surveillance,weakly supervised video anomaly detection(WSVAD)has garnered widespread attention as a key technology that identifies anomalous events using only video-level labels.Although mu...In the field of intelligent surveillance,weakly supervised video anomaly detection(WSVAD)has garnered widespread attention as a key technology that identifies anomalous events using only video-level labels.Although multiple instance learning(MIL)has dominated the WSVAD for a long time,its reliance solely on video-level labels without semantic grounding hinders a fine-grained understanding of visually similar yet semantically distinct events.In addition,insufficient temporal modeling obscures causal relationships between events,making anomaly decisions reactive rather than reasoning-based.To overcome the limitations above,this paper proposes an adaptive knowledgebased guidance method that integrates external structured knowledge.The approach combines hierarchical category information with learnable prompt vectors.It then constructs continuously updated contextual references within the feature space,enabling fine-grained meaning-based guidance over video content.Building on this,the work introduces an event relation analysis module.This module explicitly models temporal dependencies and causal correlations between video snippets.It constructs an evolving logic chain of anomalous events,revealing the process by which isolated anomalous snippets develop into a complete event.Experiments on multiple benchmark datasets show that the proposed method achieves highly competitive performance,achieving an AUC of 88.19%on UCF-Crime and an AP of 86.49%on XD-Violence.More importantly,the method provides temporal and causal explanations derived from event relationships alongside its detection results.This capability significantly advances WSVAD from a simple binary classification to a new level of interpretable behavior analysis.展开更多
基金supported by the National Natural Science Foundation of China(Nos.12372020,12202106 and 12102299).
摘要Industrial anomaly detection is dedicated to identifying and locating regions that deviate from the standard appearance.The prevailing approach achieves unsupervised anomaly detection through the reconstruction of images using autoencoders.Due to the simplistic structure of some abnormal regions,the autoencoder can effectively reconstruct these areas,consequently diminishing the model’s anomaly detection capabilities.To address this issue,this paper transforms the reconstruction task into the inpainting-filling-reconstruction task to increase the reconstruction error between abnormal samples and normal samples.The masked regions inpainted by the filling network are used to fill in the input image,thereby achieving an effect similar to masking.Unlike typical masking processes,this approach retains partial authentic information in the input image,rendering it partially visible.This is beneficial for the reconstruction network to repair the masked areas.Due to the consistent structure between the masked region inpainted by the filling network and the normal region,the filled abnormal regions display a complex structure that has not been learned,making it difficult for the reconstruction network to reconstruct the abnormal regions.Experimental results indicate that our method performs better than other methods on both the MVTec AD dataset and the MVTec LOCO AD dataset.
基金supported by the National Natural Science Foundation of China(No.62472118)the Guangxi Science and Technology Program(No.AB24010315)+2 种基金the Central Guidance on Local Science and Technology Development Fund of Guangxi Province(No.ZY23055008)the Innovation Project of Guangxi Graduate Education(No.YCSW2025348)the Innovation Platform and Talent Program of Guilin City(No.20220124-12).
摘要With the rapid development of Artificial Intelligence of Things(AIoT)technologies,the security of Industrial Internet of Things(IIoT)data faces increasing challenges,particularly in time series anomaly detection.IIoT data are typically scarce in abnormal samples and noisy,making unsupervised learning a common solution.The security challenges of IIoT data in AIoT environments require robust unsupervised anomaly detection methods.While Variational Autoencoders(VAEs)excel in noise resilience,they face two critical challenges in IIoT data:difficulties in single-variable time-series modeling and conflicts between static prior assumptions and dynamic temporal features.To address these challenges,we propose the Greater Cane Rat Algorithm-enhanced FourierWavelet Conditional Variational Autoencoder(GCRA-FWVAE).Our method introduces a time-frequency dualbranch architecture that synergistically combines wavelet transforms for localized transient feature extraction and Fourier transforms for global spectral characterization.These complementary representations jointly regulate the Conditional Variational Autoencoder(CVAE)reconstruction process,effectively preserving critical anomaly signatures while suppressing noise interference.The architecture is further optimized through bioinspired Greater Cane Rat Algorithm(GCRA)to improve adaptive learning capabilities.Extensive validation on the Yahoo benchmark indicates state-of-the-art performance,achieving an F1-score of 93.6%(an improvement of 4.5% over baseline VAEs)and a precision of 95.1%.These improvements significantly increase anomaly detection accuracy and robustness,particularly in the AIoT environment,where it effectively handles more complex and dynamic industrial data.
基金funded by the Deanship of Scientific Research(DSR)at King Abdulaziz University,Jeddah,under grant no.(GPIP:1074-612-2024).
摘要Log anomaly detection is essential for maintaining the reliability and security of large-scale networked systems.Most traditional techniques rely on log parsing in the reprocessing stage and utilize handcrafted features that limit their adaptability across various systems.In this study,we propose a hybrid model,BertGCN,that integrates BERT-based contextual embedding with Graph Convolutional Networks(GCNs)to identify anomalies in raw system logs,thereby eliminating the need for log parsing.TheBERT module captures semantic representations of log messages,while the GCN models the structural relationships among log entries through a text-based graph.This combination enables BertGCN to capture both the contextual and semantic characteristics of log data.BertGCN showed excellent performance on the HDFS and BGL datasets,demonstrating its effectiveness and resilience in detecting anomalies.Compared to multiple baselines,our proposed BertGCN showed improved precision,recall,and F1 scores.
基金supported by the Key Science and Technology Project of HBIS Materials Institute(No.HG2022328)the Innovation Group Project of Southern Marine Science and Engineering Guangdong Laboratory(Zhuhai)(No.311021013).
摘要Maintaining constant mold level variations during the continuous casting process is essential to guarantee the effectiveness and quality of steel production. An unsupervised deep learning-based mold level anomaly detection (MLAD) model for real-time monitoring of mold level fluctuations under varying operating conditions was proposed. The MLAD framework employs a two-stage encoder-decoder structure with adversarial training to accurately reconstruct time-series mold level data. In the first stage, the model learns long-term trends by reconstructing input windows, while in the second stage, it employs reconstruction errors as focus scores to capture short-term anomaly patterns. A transformer-based architecture, incorporating multi-head attention mechanisms and positional encoding, enables MLAD to capture both local and global temporal dependencies. In addition, a novel multi-threshold strategy, based on extreme value theory, is implemented to enhance the model’s ability and to adapt to varying operating conditions, including startup, steady-state, and shutdown phases. The model was validated with over 240-h real data from a steel factory. The results demonstrate its superior performance in anomaly detection compared to popular methods, with a precision of 0.9937, recall of 0.9932, and a low false alarm rate of 0.0038. MLAD represents a significant advancement in the detection of nonlinear and nonstationary anomalies in industrial processes, offering an efficient solution for smart manufacturing systems. Therefore, the established model could be used for online anomaly detection of mold level with real-time data.
基金supported by the National Natural Science Foundation of China under Grant No.62376043Sichuan Provincial Natural Science Foundation under Grant No.2024NSFTD0008+3 种基金Science and Technology Program of Sichuan Province under Grant No.2024ZHCG0016Science and Technology Program of Chengdu under Grant No.2025-GH02-00020-HZScience and Technology Program of Quzhou under Grant No.2024K008the Open Project Program of the State Key Laboratory of CAD and CG(Grant No.A2509),Zhejiang University.
摘要Multivariate time series anomaly detection(MTSAD)is a critical task for real-time risk control and fault diagnosis in industrial monitoring,aerospace,and financial domains.Unsupervised MTSAD confronts three core challenges:label scarcity in practical scenarios,diverse anomaly patterns that demand adaptive modeling,and weak feature discriminability between normal and anomalous samples.To address these challenges,we propose a Prototype Memory and Contrastive Learning Based Unsupervised Anomaly Detection for Multivariate Time Series method named PC-UAD.PC-UAD comprises three core modules with hierarchical functionalities:(1)A Temporal PatchEmbedder,which adopts learnable positional encoding for dynamic temporal representation and incorporates channel projection to model adaptive cross-sensor dependencies in multivariate data;(2)A Prototype Memory Encoder,which embeds a prototype attention mechanism to explicitly memorize typical normal patterns,forming a“normal pattern dictionary”that enhances the model’s perception of normal behavioral boundaries;(3)A ContrastFusion module,which leverages contrastive learning to amplify feature distribution discrepancies between normal and anomalous data,strengthening the model’s ability to distinguish subtle anomalies.Experiments on five public multivariate time series datasets demonstrate that our method achieves superior detection accuracy compared to eight state-of-the-art approaches,with the average F1-score and ROC-AUC both ranking first.
基金supported by the MSIT(Ministry of Science and ICT),Korea,under the ITRC(Information Technology Research Center)support program(IITP-2023-2018-0-01431)supervised by the IITP(Institute for Information&Communications Technology Planning&Evaluation)the Brain Korea 21(BK21)FOUR program of the National Research Foundation of Korea funded by the Ministry of Education(NRF5199991514504).
摘要Efficient and accurate anomaly detection in a network is of great significance for maintaining network and device security.Most anomaly detection methods assume that different anomalous network data distributions are the same or similar and ignore data privacy preservation.In this paper,a novel Federated Learning(FL)is proposed that it can quickly detect different types of anomalies in Non-Independent and Identically Distributed(Non-IID)data.First,we design a multi-domain machine learning model for multi-domain data,named Aegean,which consists of two modules:an ensemble AutoEncoder(AE)and a Generative Adversarial Network(GAN).Second,because data from different domains are non-IID,we model the anomaly detection problem as a dual problem,which can be recast as a robust optimization problem.The robust optimization problem is non-convex and therefore difficult to solve.As a remedy,we formulate and solve a dual problem by taking the Lagrangian dual function of the original problem.Experiments demonstrate that Aegean significantly outperforms the current state-of-the-art methods,with a 16%F1 score improvement over that of a One-Class Support Vector Machine(OCSVM).The designed FL significantly reduces the communication overhead of FedAvg without sacrificing anomaly detection performance.
基金funding from the European Union’s Horizon Europe research and innovation programme under the Grant Agreement 101168489.
摘要Maritime Domain Awareness(MDA)is critical for global security and economic stability,yet it is increasingly challenged by sophisticated adversarial tactics such as signal spoofing and“dark vessel”activities.Traditional surveillance systems,often reliant on single-sensor modalities,are ill-equipped to handle these deceptive behaviors.To address this,we propose the Multimodal Attention-based Fusion Transformer(MAFT),a novel deep learning architecture that integrates four distinct data modalities—Aerial imagery,Synthetic Aperture Radar(SAR),acoustic signatures,and Automatic Identification System(AIS)data—to achieve robust and interpretable maritime anomaly detection.A key contribution of our work is a principled synthetic data generation pipeline that creates a large-scale,labeled dataset(16,000 samples)for four critical anomaly types:Correlated Activity,Dark Vessels,AIS Spoofing,and Kinematic Anomalies.MAFT architecture employs modality-specific encoders to project heterogeneous data into a common 320-dimensional embedding space.These embeddings are then tokenized and supplied to a multi-layer Transformer Encoder,which leverages a self-attention mechanism for late-fusion,learning complex,non-linear inter-modal relationships.We also introduce“modality dropout”(p=0.3)as a regularization technique to enhance model robustness against sensor failure or data unavailability.Quantitative analysis shows our model achieves a 97.02%F1-score and a significantly improved Expected Calibration Error(ECE)of 0.011,outperforming Early Fusion CNN,Mid-Fusion MLP,and Decision-Ensemble baselines.Furthermore,computational profiling confirms an inference latency of 26.54 ms,demonstrating operational readiness for real-time deployment.Analysis of the model’s attention weights suggests that MAFT not only accurately classifies maritime activities but also provides a high degree of model interpretability,offering crucial,data-driven insights for maritime security operators.
基金funded by the Key Research and Development Program of Zhejiang Province No.2023C01141the Science and Technology Innovation Community Project of Yangtze RiverDelta No.23002410100.
摘要The deployment of supervised anomaly detection is typically limited by the high cost of annotation,privacy constraints,and the scarcity of anomalous samples.These constraints have motivated the use of vision-language pre-trained models for zero-shot anomaly detection.However,existing CLIP-based methods still face three limitations:a shared set of prompts is applied across feature layers,anomaly maps are fused by fixed strategies,and image-level anomaly scores are determined solely by global image-text similarity.These limitations reduce the accuracy of pixel-level localization and weaken the reliability of image-level anomaly prediction.To overcome these limitations,LaRP-CLIP is proposed.It introduces layer-aware prompt decoupling to better match feature layers with different semantic characteristics,adaptive fusion with error-prior-guided local refinement to produce cleaner and more precise anomaly maps,and a prototype branch to improve image-level scoring.Experiments on four industrial datasets and seven medical datasets show that LaRP-CLIP achieves strong performance in both image-level detection and pixel-level localization.
基金supported by the Major Program of the National Natural Science Foundation of China(No.12090024)。
摘要How computers can acquire the capability of radiologists to identify various anomalies within 3D medical images remains a central and challenging problem in intelligent imaging diagnosis.Supervised learning methods relying on lesion-level annotations are restricted to detecting a limited set of lesion types similar to those in the training data.Furthermore,obtaining voxel-level annotations is notoriously labor-intensive and time-consuming.To address these challenges,researchers have proposed unsupervised anomaly detection(UAD)methods for 3D medical images that learn from normal(healthy)samples.These approaches aim to identify any lesion that deviates from the learned normal anatomical distribution.Centered on this principle,three distinct UAD paradigms have emerged:self-supervised learning-based methods that train supervised models by constructing synthetic anomalies;deep feature embedding-based methods that measure the distance between test features and normal feature distribution;and reconstruction-based methods that transform abnormal images into pseudo-healthy images based on learned normal patterns.This paper provides a comprehensive review,analysis,and comparison of key studies within these three categories,highlighting their respective strengths,limitations,and potential research directions.Moreover,existing UAD methods are often validated using inconsistent datasets or preprocessing pipelines,making fair performance comparisons challenging.To address this issue,we establish a unified benchmark for evaluating UAD methods on 3D medical images,comprising nine brain MRI datasets(4365 cases)and six liver CT datasets(376 cases).Using this benchmark,we evaluate the performance of 21 representative state-of-the-art algorithms on the 3D voxel-level anomaly localization task,objectively revealing the advantages and limitations of these methods.
基金supported by National Science Foundation of China(U2333201)National Key R&D Program of China(2021YFF0603902)Civil Aviation Safety Capacity Building Foundation of China(PESA2024111,RJ2025039).
摘要Anomaly detection in system logs is a critical technical means for identifying potential faults and security risks.In distributed environments,traditional deep learning-based log anomaly detection methods often suffer from shortcomings in transparency,computational overhead,and data privacy protection.To address these issues,this paper proposes a federated learning-driven lightweight and explainable log anomaly detection framework named FedXLog.The framework adapts to heterogeneous logs through hierarchical feature extraction,introduces the Federated Gradient Trajectory Aggregation algorithm(FedGradTrace)to enhance the explainability of the parameter aggregation process,constructs lightweight models using knowledge distillation,and achieves globally consistent explanatory capabilities by integrating hash feature alignment.Experimental results demonstrate that FedXLog possesses the dual advantages of high detection accuracy and lightweight deployment for heterogeneous logs in distributed scenarios.It can effectively identify key decision-making features and locate typical root causes of anomalies.Notably,the framework has been specifically optimized for the unique characteristics of distributed logs.Distinguished from general federated explainable methods,it can directly support abnormal root cause localization in Operations and Maintenance scenarios.This further verifies the application value of scenario-specific adaptation of federated learning in the field of log analysis,thereby expanding the scope of application of explainable log anomaly detection.
基金supported in part by the National Key Research and Development Program of China under Grant 2022YFB3104500in part by the China Postdoctoral Science Foundation under Grants 2023M732835+1 种基金in part by the Qinchuangyuan Innovation and Entrepreneurship Talent Project of Shaanxi under Grant QCYRCXM-2023172in part by the National Natural Science Foundation of China under Grant 62471382。
摘要Improving the energy efficiency of information transmission is very critical to the development of future Internet of Things(IoT).Considering the sporadic characteristics for IoT transmissions,the energy consumption of a specific transmission session significantly varies with channel condition and Quality of Service(QoS)requirements.In this study,we focus on the analysis and optimization for wireless relaying communications'statistical energy consumption.Particularly,we investigate a wirelessly-powered DF relaying communication system.Under Time Switching(TS)and Power Splitting(PS)modes,we analyze and minimize the statistical energy consumption of transmitting a fixed amount of data using mathematical analysis.Through showing some selected numerical examples,we discuss various design tradeoffs.These results will provide some important guidelines for the design of green IoT communication systems.
基金supported in part by the National Natural Science Foundation of China(62472146)the Key Technologies Research Development Joint Foundation of Henan Province of China(225101610001)。
摘要Deep transfer learning has achieved significant success in anomaly detection over the past decade,but data acquisition challenges in practical engineering hinder high-quality feature representation for few-shot learning tasks.To address this issue,a novel time-frequency-assisted deep feature enhancement(TFE)mechanism is proposed.Unlike traditional methods that integrate time-frequency analysis with deep neural networks,TFE employs a wavelet scattering transform to establish a parallel time-frequency feature space,where a dual interaction strategy facilitates collaboration between deep feature and time-frequency spaces through two operations:1)Enhancement,where a frequency-importance-driven contrastive learning(FICL)network transfers physically-aware information from wavelet scattering features to deep features,and 2)Feedback,which uses a detection rule adaptation module to minimize bias in wavelet scattering features based on deep feature performance.TFE is applied to a domain-adversarial anomaly detection framework and,through alternating training,significantly enhances both deep feature discriminative power and few-shot anomaly detection.Theoretical analysis confirms that the proposed dual interaction strategy reduces the upper bound of classification error.Experiments on benchmark datasets and a real-world industrial dataset from a large steel factory demonstrate TFE's superior performance and highlight the importance of frequency saliency in transfer learning.Thus,collaboration is shown to outperform integration for few-shot transfer learning in anomaly detection.
基金funded by the School of Engineering,Cardiff University,Cardiff,CF243AA,UK。
摘要Blockchain networks are under mounting pressure from emerging complex zero-day attacks that cannot be prevented with conventional security measures.In this paper,we introduce NeuroChain Sentinel,a new bio-inspired cybersecurity model based on spiking neural networks for detecting anomalies in a distributed ledger system in real time.The main innovations are:a Temporal Spike Pattern Recognition algorithm for simulating the biological timing of the neural system to detect malicious transaction patterns;a distributed consensus-verification topology combined with blockchain algorithms;and small-scale neuromorphic engineering,resulting in an 87%reduction in computational load over conventional deep neural networks.In contrast to current rule-based or supervised mechanisms that use labeled attack data,NeuroChain Sentinel uses unsupervised learning with spike-timing-dependent plasticity and automatically discovers novel attack vectors,such as smart contract exploits,51%attacks,and vulnerabilities in consensus mechanisms.An extensive analysis of Ethereum fraud detection data reveals that 99.64%of all data is detected with a 0.8%false-positive(FP)rate,and the Receiver Operating Characteristic-Area Under the Curve(ROC-AUC)value is 0.9999.The Matthews Correlation Coefficient(MCC)is 0.9897.Given these advantages,the existing implementation is tested only against Ethereum transaction information and has not yet been extended to heterogeneous blockchain architectures.The framework will be generalized to many blockchain platforms,scalability in high-throughput environments will be improved,and its robustness against adversarial attacks will be enhanced.
基金supported by the Competitive Research Fund of the University of Aizu,Japan.
摘要Hybrid and multi-cloud infrastructures make IP address management(IPAM)difficult,especially when IP and Domain Name System(DNS)records must stay consistent across on-premises networks and cloud platforms.Traditional IPAM tools often lack deep automation and cross-platform visibility,which leads to DNS drift,IP conflicts,and configuration errors.This paper proposes a unified,Application Programming Interface(API)-driven IPAM framework that integrates Infoblox Network Identity Operating System(NIOS)with Amazon Web Services(AWS)Route53 and Azure DNS using Infrastructure-as-Code and CI/CD pipelines.We generate an IPAM event log from Infoblox API simulations and fuse it with the UNSW-NB15 cybersecurity dataset to train a deep Long Short-Term Memory(LSTM)-based anomaly detection model.On this fused dataset,the propose model achieves an accuracy of 0.912 and an F1-score of 0.900,outperforming Random Forest,Logistic Regression,one-dimensional convolutional neural network(1D-CNN),and Gated Recurrent Unit(GRU)baselines.The automation pipeline also reduces end-to-end provisioning latency to 1010 ms and improves DNS consistency to 99.1%across Infoblox,AWS,and Azure.The framework provides scalable,auditable,and policy-driven IPAM while reducing manual work and configuration drift in hybrid cloud environments.
基金supported by the Korea Institute of Energy Technology Evaluation and Planning(KETEP)grant funded by the Korea government(MOTIE)(RS-2023-00303559,A Study on Development of Cyber-Physical Attack Response System and Security Management System for Maximizing Availability of Real-Time Distributed Resources).
摘要Smart Grid infrastructures have enhanced energy distribution efficiency,reliability,and sustainability,but their proper operation requires robust anomaly detection to mitigate risks from equipment failures,cyberattacks,and natural disasters.Federated Learning(FL)offers a privacy-preserving solution by allowing power plants and grid sectors to collaboratively train models without sharing raw data,addressing privacy concerns,regulatory compliance,and single points of failure that often emerge in centralized approaches.FL also improves real-time anomaly detection and scalability by adapting dynamically to different grid topologies while incurring minimal communication overhead.Within our FL framework,Transformer models excel in anomaly detection due to their self-attention mechanisms that capture intricate temporal dependencies in sensor data.Unlike traditional models,Transformers effectively learn long-range patterns,enhancing detection accuracy and responsiveness.This work conducts a comparative study of two state-of-the-art Tranformer models in an FL environment,evaluating their anomaly detection performance across four diverse smart grid datasets.To assess robustness,we introduce a GAN-based Anomaly Injection Attack(GAIA)that generates and injects realistic syntheitc anomalies.Our results indicate that both federated Transformer models achieve high detection performance across seven metrics,even under adversarial conditions,offering valuable insights into their capabilities in decentralized smart grid applications.
基金supported by Natural Science Foundation of Qinghai Province(2025-ZJ-994M)Scientific Research Innovation Capability Support Project for Young Faculty(SRICSPYF-BS2025007)National Natural Science Foundation of China(62566050).
摘要Multivariate anomaly detection plays a critical role in maintaining the stable operation of information systems.However,in existing research,multivariate data are often influenced by various factors during the data collection process,resulting in temporal misalignment or displacement.Due to these factors,the node representations carry substantial noise,which reduces the adaptability of the multivariate coupled network structure and subsequently degrades anomaly detection performance.Accordingly,this study proposes a novel multivariate anomaly detection model grounded in graph structure learning.Firstly,a recommendation strategy is employed to identify strongly coupled variable pairs,which are then used to construct a recommendation-driven multivariate coupling network.Secondly,a multi-channel graph encoding layer is used to dynamically optimize the structural properties of the multivariate coupling network,while a multi-head attention mechanism enhances the spatial characteristics of the multivariate data.Finally,unsupervised anomaly detection is conducted using a dynamic threshold selection algorithm.Experimental results demonstrate that effectively integrating the structural and spatial features of multivariate data significantly mitigates anomalies caused by temporal dependency misalignment.
基金supported by the National Natural Science Foundation of China under Grant U24A20279.
摘要Anomaly detection(AD)aims to identify abnormal patterns that deviate from normal behaviour,playing a critical role in applications such as industrial inspection,medical imaging and autonomous driving.However,AD often faces a scarcity of labelled data.To address this challenge,we propose a novel semi-supervised anomaly detection method,DASAD(Deviation-Guided Attention for Semi-Supervised Anomaly Detection),which integrates deviation-guided attention with contrastive regularisation to reduce the unreliability of pseudo-labels.Specifically,a deviation-guided attention mechanism is designed to combine three types of deviations:latent embeddings,residual direction vectors and hierarchical reconstruction errors to capture anomaly specific cues effectively,thereby enhancing the credibility of pseudo-labels for unlabelled samples.Furthermore,a class-asymmetric contrastive loss is constructed to promote compact representations of normal instances while preserving the structural diversity of anomalies.Extensive experiments on 8 benchmark datasets demonstrate that DASAD consistently outperforms state-of-the-art methods and exhibits strong generalisation across 6 anomaly detection domains.
摘要The explosive increase in connectivity has multiplied the volume and speed of network traffic,putting the world at greater risk from sophisticated and emerging cyber-attacks.Smart learning environments,which rely on cloud-based learning management systems,virtual classrooms,and interconnected educational devices,generate large volumes of dynamic network traffic that must be continuously monitored to protect sensitive academic data and ensure uninterrupted learning services.In this study,three supervised machine learning classifiers,namely Random Forest,Logistic Regression,and k-Nearest Neighbours(kNN),are designed and evaluated for anomaly detection using the UNSW-NB15 benchmark.Models are trained and evaluated using a comprehensive set of metrics,including accuracy,precision,recall,F1-score,ROC-AUC,and confusion matrix analysis,following rigorous preprocessing and stratified cross-validation.Consistent with observed patterns in the dataset,Random Forest achieves near-perfect detection accuracy with very low false alarm rates,kNN performs well with moderate error rates,and Logistic Regression shows comparatively lower performance.This study develops a reproducible anomaly detection pipeline and provides a comparative evaluation that highlights the conditions under which ensemble and instance-based models outperform linear approaches in high-dimensional network traffic analysis.These findings align with existing evidence highlighting the effectiveness of data-centric machine learning pipelines in improving decision-making in high-volume digital environments.In the context of smart learning environments,these models can support the development of intelligent intrusion detection systems capable of monitoring educational network infrastructures and identifying abnormal traffic patterns associated with cyber threats targeting digital learning platforms.The findings provide practical guidance for selecting machine learning models in intrusion detection systems where detection performance must be balanced with computational efficiency and deployment constraints.
摘要The rapid digitalization of the energy sector has led to the deployment of large-scale smart metering systems that generate high-frequency time series data,creating new opportunities and challenges for energy anomaly detection.Accurate identification of anomalous patterns in building energy consumption is essential for optimizing operations,improving energy efficiency,and supporting grid reliability.This study investigates advanced feature engineering and machine learning modeling techniques for large-scale time series anomaly detection in building energy systems.Expanding upon previous benchmark frameworks,we introduce additional features such as oil price indices and solar cycle indicators,including sunset and sunrise times,to enhance the contextual understanding of consumption patterns.Our comparative modeling approach encompasses an extensive suite of algorithms,including KNeighborsUnif,KNeighborsDist,LightGBMXT,LightGBM,RandomForestMSE,CatBoost,ExtraTreesMSE,NeuralNetFastAI,XGBoost,NeuralNetTorch,and LightGBMLarge.Data preprocessing includes rigorous handling of missing values and normalization,while feature engineering focuses on temporal,environmental,and value-change attributes.The models are evaluated on a comprehensive dataset of smart meter readings,with performance assessed using metrics such as the Area Under the Receiver Operating Characteristic Curve(AUC-ROC).The results demonstrate that the integration of diverse exogenous variables and a hybrid ensemble of traditional tree-based and neural network models can significantly improve anomaly detection performance.This work provides new insights into the design of robust,scalable,and generalizable frameworks for energy anomaly detection in complex,real-world settings.
摘要In the field of intelligent surveillance,weakly supervised video anomaly detection(WSVAD)has garnered widespread attention as a key technology that identifies anomalous events using only video-level labels.Although multiple instance learning(MIL)has dominated the WSVAD for a long time,its reliance solely on video-level labels without semantic grounding hinders a fine-grained understanding of visually similar yet semantically distinct events.In addition,insufficient temporal modeling obscures causal relationships between events,making anomaly decisions reactive rather than reasoning-based.To overcome the limitations above,this paper proposes an adaptive knowledgebased guidance method that integrates external structured knowledge.The approach combines hierarchical category information with learnable prompt vectors.It then constructs continuously updated contextual references within the feature space,enabling fine-grained meaning-based guidance over video content.Building on this,the work introduces an event relation analysis module.This module explicitly models temporal dependencies and causal correlations between video snippets.It constructs an evolving logic chain of anomalous events,revealing the process by which isolated anomalous snippets develop into a complete event.Experiments on multiple benchmark datasets show that the proposed method achieves highly competitive performance,achieving an AUC of 88.19%on UCF-Crime and an AP of 86.49%on XD-Violence.More importantly,the method provides temporal and causal explanations derived from event relationships alongside its detection results.This capability significantly advances WSVAD from a simple binary classification to a new level of interpretable behavior analysis.