Abnormal behaviour may indicate important objects and events in a wide variety of domains. One such domain is intelligence and surveillance, where there is a clear trend towards more and more advanced sensor systems producing huge amounts of trajectory data from moving objects, such as people, vehicles, vessels and aircraft. In the maritime domain, for example, abnormal vessel behaviour, such as unexpected stops, deviations from standard routes, speeding, traffic direction violations etc., may indicate threats and dangers related to smuggling, sea drunkenness, collisions, grounding, hijacking, piracy etc. Timely detection of these relatively infrequent events, which is critical for enabling proactive measures, requires constant analysis of all trajectories; this is typically a great challenge to human analysts due to information overload, fatigue and inattention. In the Baltic Sea, for example, there are typically 3000–4000 commercial vessels present that are monitored by only a few human analysts. Thus, there is a need for automated detection of abnormal trajectory patterns. In this thesis, we investigate algorithms appropriate for automated detection of anomalous trajectories in surveillance applications. We identify and discuss some key theoretical properties of such algorithms, which have not been fully addressed in previous work: sequential anomaly detection in incomplete trajectories, continuous learning based on new data requiring no or limited human feedback, a minimum of parameters and a low and well-calibrated false alarm rate. A number of algorithms based on statistical methods and nearest neighbour methods are proposed that address some or all of these key properties. In particular, a novel algorithm known as the Similarity-based Nearest Neighbour Conformal Anomaly Detector (SNN-CAD) is proposed. This algorithm is based on the theory of Conformal prediction and is unique in the sense that it addresses all of the key properties above. The proposed algorithms are evaluated on real world trajectory data sets, including vessel traffic data, which have been complemented with simulated anomalous data. The experiments demonstrate the type of anomalous behaviour that can be detected at a low overall alarm rate. Quantitative results for learning and classification performance of the algorithms are compared. In particular, results from reproduced experiments on public data sets show that SNN-CAD, combined with Hausdorff distance  for measuring dissimilarity between trajectories, achieves excellent classification performance without any parameter tuning. It is concluded that SNN-CAD, due to its general and parameter-light design, is applicable in virtually any anomaly detection application. Directions for future work include investigating sensitivity to noisy data, and investigating long-term learning strategies, which address issues related to changing behaviour patterns and increasing size and complexity of training data.

Anomaly detection is a general theory of detecting unusual patterns or events in data. This master thesis investigates the subject of anomaly detection in two different applications. The first application is product inspection using a camera and the second application is surveillance using a 2D laser scanner. The first part of the thesis presents a system for automatic visual defect inspection. The system is based on aligning the images of the product to a common template and doing pixel-wise comparisons. The system is trained using only images of products that are defined as normal, i.e. non-defective products. The visual properties of the inspected products are modelled using three different methods. The performance of the system and the different methods have been evaluated on four different datasets. The second part of the thesis presents a surveillance system based on a single laser range scanner. The system is able to detect certain anomalous events based on the time, position and velocities of individual objects in the scene. The practical usefulness of the system is made plausible by a qualitative evaluation using unlabelled data.

Nous étudions les conséquences cosmologiques des anomalies de Weyl qui émergent de la renormalisation des opérateurs composés des champs, y compris la métrique. Ces anomalies sont codifiées dans les habillements gravitationnels des opérateurs dans une action effective quantique non-locale. Nous obtenons les équations d'évolution qui découlent de cette action et nous en cherchons des solutions cosmologiques. Par simplicité on se limite à la gravité d'Einstein-Hilbert avec une constante cosmologique. Nous initions par considérer la gravité en deux dimensions, où la théorie de Liouville nous permet de calculer l'habillement gravitationnel de la constant cosmologique. Avec une formulation invariante de Weyl, nous déterminons l'action effective et le tenseur de moment correspondant, qui deviennent non-locaux. Les anomalies de Weyl modifient le tenseur entier, pas seulement sa trace, et nous trouvons une énergie du vide qui décline avec le temps et un ralentissement de l'expansion de de Sitter à une de quasi-de Sitter. En quatre dimensions, motivés par nos résultats en deux dimensions, nous paramétrisons l'action effective avec des habillements gravitationnels générales. Dans le cas des dimensions anormales constantes, le tenseur de moment conduit encore à une énergie du vide qui décline et une expansion de quasi-de Sitter de roulement lent. Les dimensions anormales sont calculables à priori dans une certaine théorie microscopique avec des méthodes semi-classiques. Même si les dimensions anormales sont petites en théorie des perturbations, leur contribution intégrée le long des plusieurs e-folds pourrait mener à des effets significatifs pendant la cosmologie primordiale. / In this thesis we study the cosmological consequences of Weyl anomalies arising from the renormalization of composite operators of the fundamental fields, including the metric. These anomalies are encoded in the gravitational dressings of the operators in a non-local quantum effective action. We derive the evolution equations that follow from this action and look for cosmological solutions. For simplicity, we focus on Einstein-Hilbert gravity with a cosmological constant. We first consider two-dimensional gravity, where Liouville theory allows us to compute the gravitational dressing of the cosmological constant operator. Using a Weyl-invariant formulation, we determine the gauge-invariant but non-local effective action, and compute the corresponding non-local momentum tensor. The Weyl anomalies modify the full quantum momentum tensor, not only its trace, and hence lead to interesting effects in the cosmological dynamics. In particular, we find a decaying vacuum energy and a slow-down of the de Sitter expansion. In four dimensions, motivated by our results in two dimensions, we parametrize the effective action with scale-dependent gravitational dressings, and compute the general evolution equations. In the approximation of constant anomalous dimensions, the momentum tensor leads to a decaying vacuum energy and a slow-roll quasi-de Sitter expansion, just as in two dimensions. The anomalous dimensions are in principle computable in a given microscopic theory using semiclassical methods. Even though the anomalous dimensions are small in perturbation theory, their integrated effect over several e-folds could add up to something significant during primordial cosmology.

Human operators of modern surveillance systems are confronted with an increasing amount of trajectory data from moving objects, such as people, vehicles, vessels, and aircraft. A large majority of these trajectories reflect routine traffic and are uninteresting. Nevertheless, some objects are engaged in dangerous, illegal or otherwise interesting activities, which may manifest themselves as unusual and abnormal trajectories. These anomalous trajectories can be difficult to detect by human operators due to cognitive limitations. In this thesis, we study algorithms for the automated detection of anomalous trajectories in surveillance applications. The main results and contributions of the thesis are two-fold. Firstly, we propose and discuss a novel approach for anomaly detection, called conformal anomaly detection, which is based on conformal prediction (Vovk et al.). In particular, we propose two general algorithms for anomaly detection: the conformal anomaly detector (CAD) and the computationally more efficient inductive conformal anomaly detector (ICAD). A key property of conformal anomaly detection, in contrast to previous methods, is that it provides a well-founded approach for the tuning of the anomaly threshold that can be directly related to the expected or desired alarm rate. Secondly, we propose and analyse two parameter-light algorithms for unsupervised online learning and sequential detection of anomalous trajectories based on CAD and ICAD: the sequential Hausdorff nearest neighbours conformal anomaly detector (SHNN-CAD) and the sequential sub-trajectory local outlier inductive conformal anomaly detector (SSTLO-ICAD), which is more sensitive to local anomalous sub-trajectories. We implement the proposed algorithms and investigate their classification performance on a number of real and synthetic datasets from the video and maritime surveillance domains. The results show that SHNN-CAD achieves competitive classification performance with minimum parameter tuning on video trajectories. Moreover, we demonstrate that SSTLO-ICAD is able to accurately discriminate realistic anomalous vessel trajectories from normal background traffic.

The goal of this thesis is to explore some variations of neural networks. The thesis is mainly split into two parts: a variation of the shaping functions in neural networks and a variation of learning rules in neural networks. In the first part, we mainly investigate polynomial perceptrons - a perceptron with a polynomial shaping function instead of a linear one. We prove the polynomial perceptron convergence theorem and illustrate the notion by showing that a higher order perceptron can learn the XOR function through empirical experiments with implementation. In the second part, we propose three models (SMLP, SA, SA2) for stream learning and anomaly detection in streams. The main technique allowing these models to perform at a level comparable to the state-of-the-art algorithms in stream learning is the learning rule used. We employ mini-batch gradient descent algorithm and stochastic gradient descent algorithm to speed up the models. In addition, the use of parallel processing with multi-threads makes the proposed methods highly efficient in dealing with streaming data. Our analysis shows that all models have linear runtime and constant memory requirement. We also demonstrate empirically that the proposed methods feature high detection rate, low false alarm rate, and fast response. The paper on the first two models (SMLP, SA) is published in the 29th Canadian AI Conference and won the best paper award. The invited journal paper on the third model (SA2) for Computational Intelligence is under peer review.

We consider the problem of extracting a specific feature from a noisy signal generated by a multi-channels Remote Field Eddy Current Sensor. The sensor is installed on a mobile robot whose mission is the detection of anomalous regions in metal pipelines. Given the presence of noise that characterizes the data series, anomaly signals could be masked by noise and therefore difficult to identify in some instances. In order to enhance signal peaks that potentially identify anomalies we consider an entropy filter built on a-posteriori probability density functions associated with data series. Thresholds based on the Neyman-Pearson criterion for hypothesis testing are derived. The algorithmic tool is applied to the analysis of data from a portion of pipeline with a set of anomalies introduced at predetermined locations. Critical areas identifying anomalies capture the set of damaged locations, demonstrating the effectiveness of the filter in detection with Remote Field Eddy Current Sensor.

This paper discusses the use of diagnostics based on machine learning (ML) within a flight test context. The paper begins by discussing some of the problems associated with instrumenting a test aircraft and how they could be ameliorated using ML-based diagnostics. We then describe a number of types of supervised ML algorithms which can be used in this context. In addition, key practical aspects of applying these algorithms, such as feature engineering and parameter selection, are also discussed. The paper then outlines a real-world application developed by Curtiss-Wright, called Machine Learning for Advanced System Diagnostics (MLASD). This description includes key challenges that were encountered during the development process and how suitable input features were identified. Real-world results are also presented. Finally, we suggest some further applications of ML techniques, in addition to describing other areas of development.

This thesis investigates the anomalous underperformance of distressed stocks in the US computer and electronics industry. It shows that such anomaly can be explained by a parallel analysis of risk based rational pricing and profitability (earnings) levels to returns relationship propositions. For the 1990 to 2006 period, distressed stocks have on average underperformed their non-distressed counterparts. However, once the conditional relationship with profitability is taken into account, the distress risk is rewarded by a continuous positive return hence priced appropriately. In the computer and electronics industry growth stocks (low B/M) outperform on average value stocks (high B/M). The size factor has not been confirmed to be significant in explaining stock returns for this specific industry over the 1990 to 2006 period. The study also reveals that B/M and size factors do not proxy for distress risk. The B/M factor follows an inverted u-shape along the distress risk deciles axis. As result, stocks in low and high distress portfolios share similarly low B/M values. Cash flow based bankruptcy predictors estimated on a quarterly basis from a Cox proportional hazard model, that are used as proxy for a continuous distress risk factor in asset pricing tests, are able to predict bankruptcies at higher accuracy rates than the Z-Score as alternative measure.

Orientador: Jacques Wainer / Tese (doutorado) - Universidade Estadual de Campinas, Instituto de Computação / Made available in DSpace on 2018-08-18T13:39:01Z (GMT). No. of bitstreams: 1 Bezerra_FabiodeLima_D.pdf: 910682 bytes, checksum: 03039d80da140539552895720627ea23 (MD5) Previous issue date: 2011 / Resumo: Atualmente há uma variedade de sistemas que apóiam processos de negócio (ex. WfMS, CRM, ERP, SCM, etc). Muitos desses sistemas possuem uma forte característica de coordenação das atividades dos processos de negócios, garantindo que essas atividades sejam executadas como especificadas no modelo de processo. Entretanto, há domínios com maior necessidade de flexibilidade na execução desses processos, por exemplo, em atendimento hospitalar, cuja conduta pode variar para cada paciente. Essa característica desses domínios demanda o desenvolvimento de sistemas orientados a processos fracamente definidos, ou com execução mais flexível. Nesses domínios, a execução de algumas atividades comuns pode ser violada, ou a execução de uma atividade "incomum" pode ser necessária, ou seja, tais processos são suscetíveis a execuções excepcionais ou mesmo fraudulentas. Assim, o provimento de flexibilidade não pode ser considerado sem melhorar as questões relacionadas a segurança, pois flexibilidade e segurança são requisitos claramente conflitantes. Portanto, é necessário desenvolver mecanismos ou métodos que permitam a conjugação desses dois requisitos em um mesmo sistema, promovendo um balanço entre flexibilidade e segurança. Esta tese tem por objetivo projetar, implementar e avaliar métodos de detecção de anomalias em logs de sistemas de apoio a processos de negócios, ou seja, o desenvolvimento de métodos utilizados para descobrir quais instâncias de processos podem ser uma excução anômala. Desta forma, através da integração de um método de detecção de anomalias com um sistema de apoio à processos de negócio, tais sistemas poderão oferecer um ambiente de execução flexível, mas capaz de identificar execuções anômalas que podem indicar desde uma execução excepcional, até uma tentativa de fraude. Assim, o estudo de métodos de detecção de eventos anômalos vem preencher um espaço pouco explorado pela comunidade de process mining, que tem demonstrado maior interesse em entender o comportamento comum em processos de negócios. Entretanto, apesar desta tese não discutir o significado das instâncias anômalas, os métodos de detecção apresentados aqui são importantes porque permitem selecionar essas instâncias / Abstract: Nowadays, many business processes are supported by information systems (e.g. WfMS, CRM, ERP, SCM, etc.). Many of these systems have a strong characteristic of coordination of activities defined in the business processes, mainly for ensuring that these activities are performed as specified in the process model. However, there are domains that demand more flexible systems, for example, hospital and health domains, whose behavior can vary for each patient. Such domains of applications require an information system in which the business processes are weakly defined, supporting more flexible and dynamic executions. For example, the execution of some common activities may be violated, or some unusual activity may be enforced for execution. Therefore, in domains of applications in which the systems support a high level of flexibility the business processes are susceptible to exceptional or even fraudulent executions. Thus, the provision of flexibility can not be considered without improving the security issues, since there is clearly a trade-off between flexibility and security requirements. Therefore, it is necessary to develop a mechanism to allow the combination of these two requirements in a system, that is, a mechanism that promotes a balance between flexibility and security. This thesis aims to design, implement and evaluate methods for detecting anomalies in logs of process-aware information systems, that is, the development of methods to find out which process instances may be an anomalous execution. Thus, when incorporating a method for detecting anomalies in such systems, it would be possible to offer a flexible and safer execution environment, since the system is also able to identify anomalous executions, which could be a simple exception or a harmful fraud attempt. Thus, the study of methods for detecting anomalous events will fill an area largely unexplored by the community of process mining, which has been mainly interested in understanding the common behavior in business processes. Furthermore, although this thesis does not discuss the meaning of an anomalous instance, the methods and algorithms presented here are important because they allow us to identify those instances / Doutorado / Ciência da Computação / Doutor em Ciência da Computação

Thesis advisor: Robert Taggart / My dissertation is comprised of three chapters. The first chapter is motivated by many lowfrequency sources of systemic risk in the economy. We propose a two-stage learning procedure to construct a high-frequency (i.e., daily) systemic risk factor from a cross-section of low-frequency (i.e., monthly) risk sources. In the first stage, we use a Kalman-Filter approach to synthesize the information about systemic risk contained in 19 different proxies for systemic risk. The low frequency (i.e., monthly) Bayesian factor can predict the cross-section of stock returns out of sample. In particular, a strategy that goes long the quintile portfolio with the highest exposure to the Bayesian factor and short the quintile portfolio with the lowest exposure to the Bayesian factor yields a Fama–French–Carhart alpha of 1.7% per month (20.4% annualized). The second stage is to convert this low frequency Bayesian factor into a high-frequency factor. We use textual analysis Word2Vec that reads the headlines and abstracts of all daily articles from the business section of the New York Times from 1980 to 2016 to collect distributional information on a per word basis and store it in high-dimensional vectors. These vectors are then used in a LASSO model to predict the Bayesian factor. The result is a series of coefficients that can then be used to produce a high-frequency estimate of the Bayesian factor of systemic risk. This high-frequency indicator is validated in several ways including by showing how well it captures the 2008 crisis. We also find that the high frequency factor is priced in the cross-section of stock returns and able to predict large swings in the VIX using a quantile regression approach, which sheds some light on the puzzling relation between the macro-economy and stock market volatility. The second chapter of my dissertation provides a basic quantitative description of a compendium of macro economic variables based on their ability to predict bond returns and stock returns . We use three methods( asymptotic PCA, LASSO and Support Vector Machine) to construct factors out of 133 monthly time series of economic activity spanning a period from 1996:1 to 2015:12 and classify these factors into two groups: bond demand factors and bond supply factors. In PCA regression, we find both demand factors and supply factors are unspanned by bond yields and have stronger predictability power for future bond excess returns than CP factors. This predictability finding is confirmed and enhanced by machine learning technique LASSO and Support Vector Machine. More interestingly, LASSO can be used to identify 15 most important economic variables and give direct economic explanations of predictors for bond returns. Regarding to stock predictability, we find both demand and supply PC factors are priced by the cross-section of stock returns. In particular, portfolios with highest exposure to aggregate supply factor outperform portfolios with lowest exposure to aggregate supply factor 1.8% per month while portfolios with lowest exposure to aggregate demand factor outperform portfolios with highest exposure to aggregate demand factor 2.1% per month. The finding is consistent with ”fly to safety” explanation. Furthermore, variance decomposition from VAR shows that demand factors are much more important than supply factors in explaining asset returns. Finally, we incorporate demand factors and supply factors into macrofinance affine term structure (MTSMs) to estimate market price of risk of factors and find that demand factors affect level risk and supply factors affect slope risk. Moreover, MTSMs enable us to decompose bond yields into expectation component and yield risk premium component and we find MTSMs without macro factors under-estimate yield risk premium. The third chapter,coauthored with Dmitriy Muravyev and Aurelio Vasquez, is motived from the fact that a typical stock has hundreds of listed options. We use principal component analysis (PCA) to preserve their rich information content while reducing dimensionality. Applying PCA to implied volatility surfaces across all US stocks, we find that the first five components capture most of the variation. The aggregate PC factor that combines only the first three components predicts future stock returns up to six months with a monthly alpha of about 1%; results are similar out-of-sample. In joint regressions, the aggregate PC factor drives out all of the popular option-based predictors of stock returns. Perhaps, the aggregate factor better aggregates option price information. However, shorting costs in the underlying drive out the aggregate factor’s predictive ability. This result is consistent with the hypothesis that option prices predict future stock returns primarily because they reflect short sale constraints. / Thesis (PhD) — Boston College, 2018. / Submitted to: Boston College. Carroll School of Management. / Discipline: Finance.