Anomaly detection is a relevant problem in the field of Mechanical Engineering, because the analysis of mechanical systems often relies on identifying deviations from what is considered "normal". The mechanical sciences are represented by a heterogeneous collection of data types: some systems may be highly dimensional, may contain exclusively spatial or temporal data, may be spatiotemporally linked, or may be non-deterministic and best described probabilistically. Given the broad range of data types in this field, it is not possible to propose a single processing method that will be appropriate, or even usable, for all data types. This has led to human observation remaining a common, albeit costly and inefficient, approach to detecting anomalous signals or patterns in mechanical data. The advantages of automated anomaly detection in mechanical systems include reduced monitoring costs, increased reliability of fault detection, and improved safety for users and operators. This dissertation proposes a hierarchical framework for anomaly detection through machine learning, and applies it to three distinct and heterogeneous data types: state-based data, parameter-driven data, and spatiotemporal sensor network data. In time-series data, anomaly detection results were robust in synthetic data generated using multiple simulation algorithms, as well as experimental data from rolling element bearings, with highly accurate detection rates (>99% detection, <1% false alarm). Significant developments were shown in parameter-driven data by reducing the sample sizes necessary for analysis, as well as reducing the time required for computation. The event-space model extends previous work into a geospatial sensor network and demonstrates applications of this type of event modeling at various timescales, and compares the model to results obtained using other approaches. Each data type is processed in a unique way relative to the others, but all are fitted to the same hierarchical structure for system modeling. This hierarchical model is the key development proposed by this dissertation, and makes both novel and significant contributions to the fields of mechanical analysis and data processing. This work demonstrates the effectiveness of the developed approaches, details how they differ from other relevant industry standard methods, and concludes with a proposal for additional research into other data types. / Ph. D.

京都大学 / 0048 / 新制・課程博士 / 博士(理学) / 甲第18084号 / 理博第3962号 / 新制||理||1571(附属図書館) / 30942 / 京都大学大学院理学研究科地球惑星科学専攻 / (主査)准教授 齊藤 昭則, 教授 余田 成男, 准教授 藤 浩明 / 学位規則第4条第1項該当 / Doctor of Science / Kyoto University / DGAM

京都大学 / 0048 / 新制・課程博士 / 博士(理学) / 甲第18794号 / 理博第4052号 / 新制||理||1583(附属図書館) / 31745 / 京都大学大学院理学研究科物理学・宇宙物理学専攻 / (主査)教授 川合 光, 准教授 福間 將文, 教授 田中 貴浩 / 学位規則第4条第1項該当 / Doctor of Science / Kyoto University / DFAM

No description available.

Background: With the advent of the information age, there are many large numbers of services rising which run on several clusters of computers.  Maintaining such large complex systems is a very difficult task. Developers use one tool which is common for almost all software systems, they are the console logs. To troubleshoot problems, developers refer to these logs to solve the issue. Identifying anomalies in the logs would lead us to the cause of the problem, thereby automating the analysis of logs. This study focuses on anomaly detection in logs. Objectives: The main goal of the thesis is to identify different algorithms for anomaly detection in logs, implement the algorithms and compare them by doing an experiment. Methods: A literature review had been conducted for identifying the most suitable algorithms for anomaly detection in logs. An experiment was conducted to compare the algorithms identified in the literature review. The experiment was performed on a dataset of logs generated by Hadoop Data File System (HDFS) servers which consisted of more than 11 million lines of logs. The algorithms that have been compared are K-means, DBSCAN, Isolation Forest, and Local Outlier Factor algorithms which are all unsupervised learning algorithms. Results: The performance of all these algorithms has been compared using metrics precision, recall, accuracy, F1 score, and run time. Though DBSCAN was the fastest, it resulted in poor recall, similarly Isolation Forest also resulted in poor recall. Local Outlier Factor was the fastest to predict. K-means had the highest precision and Local Outlier Factor had the highest recall, accuracy, and F1 score. Conclusion: After comparing the metrics of different algorithms, we conclude that Local Outlier Factor performed better than the other algorithms with respect to most of the metrics measured.

In this thesis, different Machine learning (ML) algorithms were used in the detection of anomalies using a dataset from a Gas pipeline SCADA system which was generated by Mississippi State University’s SCADA laboratory. This work was divided into two folds: Binary Classification and Categorized classification. In the binary classification, two attack types namely: Command injection and Response injection attacks were considered. Eight Machine Learning Classifiers were used and the results were compared. The Light GBM and Decision tree classifiers performed better than the other algorithms. In the categorical classification task, Seven (7) attack types in the dataset were analyzed using six different ML classifiers. The light gradient-boosting machine (LGBM) outperformed all the other classifiers in the detection of all the attack types. One other aspect of the categorized classification was the use of an autoencoder in improving the performance of all the classifiers used. The last part of this thesis was using SHAP plots to explain the features that accounted for each attack type in the dataset.

In this project work the basis for an anomaly detection system in ARM processors was researched on. Specifically, the focus was set to determine the performance monitoring units (PMU) in the processor which allow the reliable detection of anomalies. This was achieved by injecting targeted faults on the assembly level into the binary file to represent attacks on a physical level in a consistent way. A set of three PMUs was determined to reach a detection rate of 56.67% to 66.67% (depending on the test scenario) in the selected scenarios. However, the expected detection rate is higher for real-world attacks, due to the broad nature of the executed tests. In addition, it was observed that the readout frequency of these PMUs is critical, and in general, it is advisable to expose the values after each function call, or in the case of security-sensitive sections, multiple times within functions.

Background. Attempted intrusions at companies, either from an insider threat orotherwise, is increasing in frequency. Most commonly used is static analysis and filters to stop specific attacks. Utilising machine learning in order to detect behaviouralanomalies in the access flow of an isolated system can aid in detecting, and stopping, attacks faster than previous methods. Objectives. In this thesis, four algorithms were selected to be compared againsteach other using three different metrics. These metrics were chosen for their importance in an isolated domain. All algorithms will be trained on the same dataset, from which anomalies are created that are used to test each model. Methods. A dataset created for anomaly detection is preprocessed to fit the scenario that was explored. After which the dataset was split per user and only the user with the most samples was used for training the models. In order to test and evaluate the models, anomalies were forged from a profile created out of the metadata belonging to the chosen user. These anomalies, alongside a part of the benign samples were used to evaluate the F1 score of each model, which was compared. The better performing model according to the F1 score was then subjected to hyperparameter tuning to improve the performance further. Afterwards, the speed of which the model was loaded, and a single sample was predicted and the memory consumption of each action was measured. Results. The results showed that two algorithms were relatively close, all depending on the strictness of memory consumption. Local Outlier Factor, which used four times the memory (44 MB) of the other models, proved to be the better option when looking at F1 score, at 90.91% after having undergone hyperparameter tuning. However, Elliptic Envelope was a close second at 86.61% without undergoing hyperparameter tuning, while consuming less memory (11 MB) than the others. The speed of loading the models were 26.68 ms and 2.01 ms, with predicting one sample 1.87 ms and 0.38 ms respectively for the two models. The initial loading time is less important since it is only done once. Conclusions. Using this dataset, which albeit is not optimal, it showed that Local Outlier Factor was the best performing model, at a slightly higher memory con-sumption, while remaining accurate and relatively fast. However, it was also shown that depending on how strict the memory consumption is, Elliptic Envelope can be applicable as well considering its lower memory consumption. / Bakgrund. Försök till intrång i företag, antingen från insiderhot eller på annat håll ökar i frekvens. Vanligtvis används statisk analys, eller olika filter för att motverka dessa attacker. Genom att använda maskininlärning för att upptäcka beteendeavikelser i ett loggflöde inuti ett isolerat system kan hjälpa till att upptäcka, och stoppa, attacker snabbare än tidigare metoder. Syfte. I det här arbetet har fyra algoritmer valts att jämföras med varandra genom att titta på tre olika mätvärden. Dessa mätvärden har valts på grund av dess betydelse i system placerade i en isolerad domän. Alla algoritmer tränades på samma dataset, och testas på avvikelser som har skapats från att tillverka en profil utifrån datasetet. Metod. Ett dataset som skapades för att upptäcka avvikelser i en åtkomstlogg har behandlats så att den ska passa scenariot som ska utforskas. Sedan så delades datasetet upp per användare, och enbart den användare med flest loggar har använts för att träna modellerna.För att testa modellerna, så har en profil byggts upp ifrån metadatan för att sedan generera anomala tillfällen för den valda användaren. Dessa avvikelser, tillsammans med en del utav de normala fallen har använts för att beräkna modellernas F1 värde. Sedan har tiden som krävts för att ladda modellen till minne från disk, tiden det tog för en gissning utav modellen, samt det datorminne som krävs för detta sparats. Dessa tre mätvärden har sedan satts emot varandra i jämförelsen. Den modell som presterade bäst i F1 värde genomgick hyperparameterjustering för att förbättra detta värde. Resultat. Resultatet visade att två algoritmer är någorlunda nära i hur de presterade. Skillnaden är att ena algoritmen, Local Outlier Factor, har ett lite högre F1 värde på 90.91% efter hyperparameterjustering, men kräver fyra gånger så mycket minne (44 MB). Dess tid att ladda ifrån disk var 26.68 ms, medans en gissning utav den tog 1.87 ms. Till skillnad från Elliptic Envelope som enbart krävde 11 MB för att ladda till minne, med ett F1 värde på 86.61% utan hyperparameterjustering. Det tog även bara 2.01 ms och 0.38 ms för att ladda modellen, respektive att gissa en kategori. Slutsatser. Med detta dataset, som inte är det mest optimala, så visade det sig att Local Outlier Factor var den modell som presterade bäst, relativt snabb med dess gissningar och bra träffsäkerhet med ett högt F1 värde. Däremot, så visade det sig att beroende på hur strikt kravet på låg minnesanvändning är, så kan även Elliptic Envelope vara lämplig. Då den kräver fyra gånger så lite minne som Local Outlier Factor.

>Magister Scientiae - MSc / We are fast moving into an era where data will be the primary driving factor for discovering new unknown astronomical objects and also improving our understanding of the current rare astronomical objects. Wide field survey telescopes such as the Square Kilometer Array (SKA) and Vera C. Rubin observatory will be producing enormous amounts of data over short timescales. The Rubin observatory is expected to record ∼ 15 terabytes of data every night during its ten-year Legacy Survey of Space and Time (LSST), while the SKA will collect ∼100 petabytes of data per day. Fast, automated, and datadriven techniques, such as machine learning, are required to search for anomalies in these enormous datasets, as traditional techniques such as manual inspection will take months to fully exploit such datasets.

No description available.