Sudden phase anomalies (SPA) of low-frequency radio waves reflected from the D-region of the lower ionosphere exclusively occur during the daylight hours when rapid changes in the ionospheric reflection height take place. They lead to abrupt changes in the linear superposition of the ground wave and the sky wave and consequently in the total field strength of the received signal. Such sudden rapid reflection height changes are usually connected with shortperiod (minutes to hours) enhancements of electron density in the lower ionosphere following solar flares, which sometimes are associated with a dramatically increase of solar X-ray radiation. This additional wave radiation can penetrate into the lower ionosphere and intensify the D region ionisation. The mean level and the number of solar X-ray bursts varies with the 11-year sunspot cycle, so that statistically investigations of number and intensity of observed SPAs can give insight into solar-terrestrial connections concerning the upper atmosphere. At Collm Observatory, SPAs are recorded since several decades. These records are combined to an index characterising the monthly mean disturbance state of the ionosphere 1983-2002. / Plötzliche Phasenanomalien (engl. sudden phase anomalies, SPA) von Langwellen, die in den Tageslichtstunden von der ionosphärischen D- Region reflektiert werden, treten auf, wenn schnelle Änderungen in der Reflexionshöhe stattfinden. Sie führen zu einer abrupten Änderung der linearen Superposition von Raum- und Bodenwelle am Beobachtungspunkt und in der Folge im Feldstärkebetrag der empfangenen Signale. Solche plötzlichen schnellen Reflexionshöhenänderungen sind gewöhnlich mit einer kurzen (Minuten bis Stunden) Zunahme der Elektronendichte in der unteren Ionosphäre verbunden und nach Sonneneruptionseffekten zu beobachten, die mit einer erheblichen Erhöhung der emittierten kurzwelligen Röntgenstrahlung einhergehen. Das mittlere Strahlungsniveau und die Anzahl von Bursts variiert mit dem 11-jährigen Sonnenfleckenzyklus, so dass statistische Untersuchungen von Anzahl und Intensität der SPA- Effekte spezielle Hinweise auf solar-terrestrische, die obere Atmosphäre betreffende Verbindungen geben können. An der Außenstelle Observatorium Collm der Universität Leipzig werden SPAs seit mehreren Jahrzehnten registriert. Sie stellen eine Datenbasis für die Jahre 1983-2002 zur Untersuchung solar-terrestrischer Beziehungen dar.

>Magister Scientiae - MSc / Cybersecurity defense tools, techniques and methodologies are constantly faced with increasing challenges including the evolution of highly intelligent and powerful new-generation threats. The main challenges posed by these modern digital multi-vector attacks is their ability to adapt with machine learning. Research shows that many existing defense systems fail to provide adequate protection against these latest threats. Hence, there is an ever-growing need for self-learning technologies that can autonomously adjust according to the behaviour and patterns of the offensive actors and systems. The accuracy and effectiveness of existing methods are dependent on decision making and manual input by human experts. This dependence causes 1) administration overhead, 2) variable and potentially limited accuracy and 3) delayed response time.

L’objectif de cette thèse est de chercher, dans un écoulement turbulent réel, d'éventuelles traces des singularités que pourraient développer les solutions des équations d'Euler ou de Navier-Stokes incompressibles 3D. En effet, la question de leur régularité mathématique est toujours ouverte. Dans cette thèse, on postule l'existence de singularités dans les équations d'Euler ou de Navier-Stokes, et on cherche des traces de ces singularités dans des champs de vitesse 3D mesurés dans un écoulement turbulent tourbillonnaire modèle, l'écoulement de von Kármán. La répartition de ces possibles empreintes de singularités, la structure de l'écoulement en leur voisinage ainsi que leur évolution temporelle sont étudiées. Nous nous appuyons sur le travail des mathématiciens Duchon et Robert pour chercher des traces de singularités et cherchons des valeurs extrêmes du terme de Duchon-Robert calculé à toute petite échelle, c’est-à-dire dans la zone dissipative : c’est ce que l’on appelle « traces de singularités ». Nous calculons le terme de Duchon-Robert à partir de champs de vitesse obtenus expérimentalement au centre d’un écoulement de von Kármán turbulent. Les champs de vitesse sont mesurés par vélocimétrie par image de particules tomographique (TPIV), résolue en temps ou non. Dans un premier temps, nous analysons les statistiques du terme de Duchon-Robert échelle par échelle et les comparons à celles de la dissipation visqueuse et à celles du terme de transfert inter-échelles apparaissant dans les équations LES. Dans un deuxième temps, nous analysons la topologie du champ de vitesse autour des événements extrêmes du terme de Duchon-Robert d'abord à partir des invariants du gradient de la vitesse puis par observation directe des champs de vitesse. Dans un troisième temps, nous présentons les résultats préliminaires d’une étude eulérienne de l’évolution temporelle des événements extrêmes du terme de Duchon-Robert. / This thesis is devoted to the experimental search for prints of the singularities that might occur in the solutions of the 3D incompressible Euler or Navier-Stokes equations. Indeed, the existence of solutions to these partial differential equations has been proven but it is still unknown whether these solutions are regular, i.e. whether they blow up in finite time or not. In this thesis, we postulate the existence of such singularities and look for prints of them in 3D velocity fields acquired experimentally in a turbulent swirling flow. The distribution, 3D structure and time evolution of these prints are detailed. Our detection of prints of possible singularities is based on the work of the mathematicists Duchon and Robert. We look for extreme values of the Duchon-Robert term at small scales, i.e. in the dissipative range. That is what we call prints of singularities. We compute the Duchon-Robert term on velocity fields which are acquired experimentally at the center of a von Kármán turbulent swirling flow. The velocity field is measured by tomographic particle image velocimetry (TPIV), either time-resolved or not. In a first part we perform a scale-by-scale analysis of the statistics of the Duchon-Robert term and compare them to the statistics of the viscous dissipation and of the inter-scale energy transfer terms involved in the LES equations. In a second part, we analyze the topology of the velocity field around the extreme events of the Duchon-Robert term. We first use a method based on the invariants of the velocity gradient tensor (VGT) and then observe directly the velocity fields. A third part presents preliminary results of an Eulerian study of the time-evolution of the extreme events of the Duchon-Robert term.

Relative plate motion history since 30 Ma between the Pacific and the southern portion of the Nazca (Farallon) plates is examined. The history is constrained by available seafloor magnetic anomaly data and a two-minute grid of predicted bathymetry derived from satellite altimetry and shipboard sensors. These data are used to create a new plate motion reconstruction based on new magnetic anomaly identifications and finite poles of motion. The new identified magnetic isochrons and tectonic reconstruction provides greater resolution to the tectonic history between chrons 7y (24.73 Ma) and 3 (4.18 Ma) than previous interpretations. Shipboard magnetics and aeromagnetic data from over 250 expeditions were plotted and used to extrapolate magnetic anomalies picked from 2D magnetic modeling from selected cruises. Magnetic anomalies were further constrained by tectonic features evident in the predicted bathymetry. Previously published magnetic anomaly locations consistent with this work were used where interpretation could not be constrained by 2D modeling and map extrapolation. Point locations for anomalies were used as input for calculation of finite poles of motion for chrons 10y, 7y, 6c, 5d, 5b, 5aa, 5o, 4a and 3a. An iterative process of anomaly mapping, pole calculation and anomaly point rotations was used to refine the finite poles of motion. Eleven stage poles were calculated from the nine finite poles from this study and two published instantaneous Euler vectors. Tectonic reconstructions indicate a history dominated by two major southward ridge propagation events, the first starting by 28 Ma and completed by 18 Ma. The second event initiated in association with breakup of the Farallon plate around 24 Ma and ceased by about 11 Ma. Lithosphere was transferred from Nazca to Pacific during the first event and in the opposite sense during the second. Development of the Mendoza microplate east of the later propagator occurred at about 20 Ma and this dual spreading process appears to have lasted until about 15 Ma.

The problem of quality assurance/quality control (QA/QC) for real-time measurements of environmental and water quality variables has been a field explored by many in recent years. The use of in situ sensors has become a common practice for acquiring real-time measurements that provide the basis for important natural resources management decisions. However, these sensors are susceptible to failure due to such things as human factors, lack of necessary maintenance, flaws on the transmission line or any part of the sensor, and unexpected changes in the sensors' surrounding conditions. Two types of machine learning techniques were used in this study to assess the detection of anomalous data points on turbidity readings from the Paradise site on the Little Bear River, in northern Utah: Artificial Neural Networks (ANNs) and Relevance Vector Machines (RVMs). ANN and RVM techniques were used to develop regression models capable of predicting upcoming Paradise site turbidity measurements and estimating confidence intervals associated with those predictions, to be later used to determine if a real measurement is an anomaly. Three cases were identified as important to evaluate as possible inputs for the regression models created: (1) only the reported values from the sensor from previous time steps, (2) reported values from the sensor from previous time steps and values of other water types of sensors from the same site as the target sensor, and (3) adding as inputs the previous readings from sensors from upstream sites. The decision of which of the models performed the best was made based on each model's ability to detect anomalous data points that were identified in a QA/QC analysis that was manually performed by a human technician. False positive and false negative rates for a range of confidence intervals were used as the measure of performance of the models. The RVM models were able to detect more anomalous points within narrower confidence intervals than the ANN models. At the same time, it was shown that incorporating as inputs measurements from other sensors at the same site as well as measurements from upstream sites can improve the performance of the models.

Intrusion detection is the practice of examining information from computers and networks to identify cyberattacks. It is an important topic in practice, since the frequency and consequences of cyberattacks continues to increase and affect organizations. It is important for research, since many problems exist for intrusion detection systems. Intrusion detection systems monitor large volumes of data and frequently generate false positives. This results in additional effort for security analysts to review and interpret alerts. After long hours spent reviewing alerts, security analysts become fatigued and make bad decisions. There is currently no approach to intrusion detection that reduces the workload of human analysts by providing a probabilistic prediction that a computer is experiencing a cyberattack. This research addressed this problem by estimating the probability that a computer system was being attacked, rather than alerting on individual events. This research combined concepts from cyber situation awareness by applying clustering ensembles, probability analysis, and active learning. The unique contribution of this research is that it provides a higher level of meaning for intrusion alerts than traditional approaches. Three experiments were conducted in the course of this research to demonstrate the feasibility of these concepts. The first experiment evaluated cluster generation approaches that provided multiple perspectives of network events using unsupervised machine learning. The second experiment developed and evaluated a method for detecting anomalies from the clustering results. This experiment also determined the probability that a computer system was being attacked. Finally, the third experiment integrated active learning into the anomaly detection results and evaluated its effectiveness in improving the accuracy. This research demonstrated that clustering ensembles with probabilistic analysis were effective for identifying normal events. Abnormal events remained uncertain and were assigned a belief. By aggregating the belief to find the probability that a computer system was under attack, the resulting probability was highly accurate for the source IP addresses and reasonably accurate for the destination IP addresses. Active learning, which simulated feedback from a human analyst, eliminated the residual error for the destination IP addresses with a low number of events that required labeling.

In order to ensure the validity of sensor data, it must be thoroughly analyzed for various types of anomalies. Traditional machine learning methods of anomaly detections in sensor data are based on domain-specific feature engineering. A typical approach is to use domain knowledge to analyze sensor data and manually create statistics-based features, which are then used to train the machine learning models to detect and classify the anomalies. Although this methodology is used in practice, it has a significant drawback due to the fact that feature extraction is usually labor intensive and requires considerable effort from domain experts. An alternative approach is to use deep learning algorithms. Research has shown that modern deep neural networks are very effective in automated extraction of abstract features from raw data in classification tasks. Long short-term memory networks, or LSTMs in short, are a special kind of recurrent neural networks that are capable of learning long-term dependencies. These networks have proved to be especially effective in the classification of raw time-series data in various domains. This dissertation systematically investigates the effectiveness of the LSTM model for anomaly detection and classification in raw time-series sensor data. As a proof of concept, this work used time-series data of sensors that measure blood glucose levels. A large number of time-series sequences was created based on a genuine medical diabetes dataset. Anomalous series were constructed by six methods that interspersed patterns of common anomaly types in the data. An LSTM network model was trained with k-fold cross-validation on both anomalous and valid series to classify raw time-series sequences into one of seven classes: non-anomalous, and classes corresponding to each of the six anomaly types. As a control, the accuracy of detection and classification of the LSTM was compared to that of four traditional machine learning classifiers: support vector machines, Random Forests, naive Bayes, and shallow neural networks. The performance of all the classifiers was evaluated based on nine metrics: precision, recall, and the F1-score, each measured in micro, macro and weighted perspective. While the traditional models were trained on vectors of features, derived from the raw data, that were based on knowledge of common sources of anomaly, the LSTM was trained on raw time-series data. Experimental results indicate that the performance of the LSTM was comparable to the best traditional classifiers by achieving 99% accuracy in all 9 metrics. The model requires no labor-intensive feature engineering, and the fine-tuning of its architecture and hyper-parameters can be made in a fully automated way. This study, therefore, finds LSTM networks an effective solution to anomaly detection and classification in sensor data.

Symbolic dynamics is a current interest in the area of anomaly detection, especially in mechanical systems.  Symbolic dynamics reduces the overall dimensionality of system responses while maintaining a high level of robustness to noise.  Rolling element bearings are particularly common mechanical components where anomaly detection is of high importance.  Harsh operating conditions and manufacturing imperfections increase vibration innately reducing component life and increasing downtime and costly repairs.  This thesis presents a novel way to detect bearing vibrational anomalies through Symbolic Aggregate Approximation (SAX) in the two-dimensional time-frequency domain.  SAX reduces computational requirements by partitioning high-dimensional sensor data into discrete states.  This analysis specifically suits bearing vibration data in the time-frequency domain, as the distribution of data does not greatly change between normal and faulty conditions. Under ground truth synthetically-generated experiments, two-dimensional SAX in conjunction with Markov model feature extraction is successful in detecting anomalies (> 99%) using short time spans (< 0.1 seconds) of data in the time-frequency domain with low false alarms (< 8%).  Analysis of real-world datasets validates the performance over the commonly used one-dimensional symbolic analysis by detecting 100% of experimental anomalous vibration with 0 false alarms in all fault types using less than 1 second of data for the basis of 'normality'. Two-dimensional SAX also demonstrates the ability to detect anomalies in predicative monitoring environments earlier than previous methods, even in low Signal-to-Noise ratios. / Master of Science

京都大学 / 0048 / 新制・課程博士 / 博士(情報学) / 甲第19335号 / 情博第587号 / 新制||情||102(附属図書館) / 32337 / 京都大学大学院情報学研究科知能情報学専攻 / (主査)教授 山本 章博, 教授 鹿島 久嗣, 教授 五十嵐 淳 / 学位規則第4条第1項該当 / Doctor of Informatics / Kyoto University / DFAM

京都大学 / 0048 / 新制・課程博士 / 博士(理学) / 甲第20162号 / 理博第4247号 / 新制||理||1611(附属図書館) / 京都大学大学院理学研究科物理学・宇宙物理学専攻 / (主査)教授 川上 則雄, 教授 松田 祐司, 教授 前野 悦輝 / 学位規則第4条第1項該当 / Doctor of Science / Kyoto University / DFAM