Anomaly detection plays a crucial role in various domains, such as transportation, cybersecurity, and industrial monitoring, where the timely identification of unusual patterns or outliers is of utmost importance. Traditional statistical techniques have limitations in handling complex and highdimensional data, which motivates the use of deep learning approaches. The project proposes designing and implementing deep neural networks, tailored explicitly for time series multivariate data from sensors incorporated in vehicles, to effectively capture intricate temporal dependencies and interactions among variables. As this project is conducted in collaboration with Scania, Sweden, the models are trained on datasets encompassing various vehicle sensor data. Different deep learning architectures, including Long Short-Term Memory (LSTM) networks and Convolutional Neural Networks (CNNs), are explored and compared to identify the most suitable model for anomaly detection tasks for the specified time series data and CNN found to perform well for the data used in the study. Furthermore, interpretability techniques are incorporated into the developed models to enhance their transparency and provide insights into the reasons behind detected anomalies. Interpretability is crucial in real-world applications to facilitate trust, understanding, and decision-making. Both model-agnostic and model-specific interpretability methods were employed to highlight the relevant features and contribute to the interpretability of the anomaly detection models. The performance of the proposed models is evaluated using test datasets with anomaly data, and comparisons are made against existing anomaly detection methods to demonstrate their effectiveness. Evaluation metrics such as precision, recall, false positive rate, F1 score, and composite F1 score are employed to assess the anomaly detection models' detection accuracy and robustness. For evaluating the interpretability method, Kolmogorov-Smirnov Test is used on counterfactual examples. The outcomes of this research project will contribute to developing advanced anomaly detection techniques that can effectively analyse time series multivariate data collected from sensors incorporated in vehicles. Incorporating interpretability techniques will provide valuable insights into the detected anomalies, enabling better decision-making and improved trust in the deployed models. These advancements can potentially enhance anomaly detection systems across various domains, leading to more reliable and secure operations.

No description available.

Aircraft-mounted cameras have potential to greatly increase the effectiveness of wilderness search and rescue efforts by collecting photographs or video of the search area. The more data that is collected, the more difficult it becomes to process it by visual inspection alone. This work presents a method for automatically detecting unusual objects in aerial video to assist people in locating signs of missing persons in wilderness areas. The detector presented here makes use of anomaly detection methods originally designed for hyperspectral imagery. Multiple anomaly detection methods are considered, implemented, and evaluated. These anomalies are then aggregated into spatiotemporal objects by using the video's inherent spatial and temporal redundancy. The results are therefore summarized into a list of unusual objects to enhance the search technician's video review interface. In the user study reported here, unusual objects found by the detector were overlaid on the video during review. This increased participants' ability to find relevant objects in a simulated search without significantly affecting the rate of false detection. Other effects and possible ways to improve the user interface are also discussed.

The method of combining multiple geophysical, geological, or geochemical datasets can reveal patterns of otherwise hidden features in the Earth’s crust. This may aid in geological mapping, locating economic mineral deposits and for general anomaly/feature detection. In this study a multidimensional geophysical approach implementing five geophysical datasets is applied using Self-Organizing Maps (SOM), where the main objective is to locate and understand a previously unknown hypothesized fault in Norrbotten, Sweden. The fault is estimated to extend from the Finnish border in the north, across northern Sweden in the N-S direction at a hypothesized length of > 250 km. Self-Organizing Maps is an unsupervised neural network - originally developed by Finnish physicist Teuvo Kohonen - capable of combining any number of datasets and thereby visualize them on a simple two-dimensional map. The datasets used in the analysis were three magnetic derivatives for the x, y and z components, as well as gamma-ray intensity measurements of the 238U, 40K and 232Th radioisotopes. All these variables have been shown to be effective tools for bedrock mapping and geological feature detection and were hence chosen based on these properties. The results revealed the efficiency of the SOM analysis to represent multivariate data on a 2D plane and proved to be a generally good visualization tool for multiple geophysical datasets. There seems to be a relatively sharp difference in geophysical properties between the eastern and western blocks divided by the hypothesized fault, which may indicate the presence of this crustal scale structure. Despite the evidence found in this study, more investigations are needed to verify the existence and nature of the fault, and the results shown here may motivate further projects by providing indications and suggestive evidence for its presence.

In today's world the amount of collected data increases every day, this is a trend which is likely to continue. At the same time the potential value of the data does also increase due to the constant development and improvement of hardware and software. However, in order to gain insights, make decisions or train accurate machine learning models we want to ensure that the data we collect is of good quality. There are many definitions of data quality, in this thesis we focus on the accuracy aspect. One method which can be used to ensure accurate data is to monitor for and alert on anomalies. In this thesis we therefore suggest a method which, based on historic values, is able to detect anomalies in time series as new values arrive. The method consists of two parts, forecasting the next value in the time series using Holt-Winters method and comparing the residual to an estimated Gaussian distribution. The suggested method is evaluated in two steps. First, we evaluate the forecast accuracy for Holt-Winters method using different input sizes. In the second step we evaluate the performance of the anomaly detector when using different methods to estimate the variance of the distribution of the residuals. The results indicate that the suggested method works well most of the time for detection of point anomalies in seasonal and trending time series data. The thesis also discusses some potential next steps which are likely to further improve the performance of this method. / I dagens värld ökar mängden insamlade data för varje dag som går, detta är en trend som sannolikt kommer att fortsätta. Samtidigt ökar även det potentiella värdet av denna data tack vare ständig utveckling och förbättring utav både hårdvara och mjukvara. För att utnyttja de stora mängder insamlade data till att skapa insikter, ta beslut eller träna noggranna maskininlärningsmodeller vill vi försäkra oss om att vår data är av god kvalité. Det finns många definitioner utav datakvalité, i denna rapport fokuserar vi på noggrannhetsaspekten. En metod som kan användas för att säkerställa att data är av god kvalité är att övervaka inkommande data och larma när anomalier påträffas. Vi föreslår därför i denna rapport en metod som, baserat på historiska data, kan detektera anomalier i tidsserier när nya värden anländer. Den föreslagna metoden består utav två delar, dels att förutsäga nästa värde i tidsserien genom Holt-Winters metod samt att jämföra residualen med en estimerad normalfördelning. Vi utvärderar den föreslagna metoden i två steg. Först utvärderas noggrannheten av de, utav Holt-Winters metod, förutsagda punkterna för olika storlekar på indata. I det andra steget utvärderas prestandan av anomalidetektorn när olika metoder för att estimera variansen av residualernas distribution används. Resultaten indikerar att den föreslagna metoden i de flesta fall fungerar bra för detektering utav punktanomalier i tidsserier med en trend- och säsongskomponent. I rapporten diskuteras även möjliga åtgärder vilka sannolikt skulle förbättra prestandan hos den föreslagna metoden.

This project aims to detect possible anomalies in the resource consumption of radio base stations within the 4G LTE Radio architecture. This has been done by analyzing the statistical data that each node generates every 15 minutes, in the form of "performance maintenance counters". In this thesis, we introduce methods that allow resources to be automatically monitored after software updates, in order to detect any anomalies in the consumption patterns of the different resources compared to the reference period before the update. Additionally, we also attempt to narrow down the origin of anomalies by pointing out parameters potentially linked to the issue. / Detta projekt syftar till att upptäcka möjliga anomalier i resursförbrukningen hos radiobasstationer inom 4G LTE Radio-arkitekturen. Detta har gjorts genom att analysera de statistiska data som varje nod genererar var 15:e minut, i form av PM-räknare (PM = Performance Maintenance). I denna avhandling introducerar vi metoder som låter resurser över-vakas automatiskt efter programuppdateringar, för att upptäcka eventuella avvikelser i resursförbrukningen jämfört med referensperioden före uppdateringen. Dessutom försöker vi också avgränsa ursprunget till anomalier genom att peka ut parametrar som är potentiellt kopplade till problemet.

This dissertation presents our work on network intrusion detection and intrusion sim- ulation. The work in intrusion detection consists of two different network anomaly-based approaches. The work in intrusion simulation introduces a model using explicit traffic gen- eration for the packet level traffic simulation. The process of anomaly detection is to first build profiles for the normal network activity and then mark any events or activities that deviate from the normal profiles as suspicious. Based on the different schemes of creating the normal activity profiles, we introduce two approaches for intrusion detection. The first one is a frequency-based approach which creates a normal frequency profile based on the periodical patterns existed in the time-series formed by the traffic. It aims at those attacks that are conducted by running pre-written scripts, which automate the process of attempting connections to various ports or sending packets with fabricated payloads, etc. The second approach builds the normal profile based on variations of connection-based behavior of each single computer. The deviations resulted from each individual computer are carried out by a weight assignment scheme and further used to build a weighted link graph representing the overall traffic abnormalities. The functionality of this system is of a distributed personal IDS system that also provides a centralized traffic analysis by graphical visualization. It provides a finer control over the internal network by focusing on connection-based behavior of each single computer. For network intrusion simulation, we explore an alternative method for network traffic simulation using explicit traffic generation. In particular, we build a model to replay the standard DARPA traffic data or the traffic data captured from a real environment. The replayed traffic data is mixed with the attacks, such as DOS and Probe attack, which can create apparent abnormal traffic flow patterns. With the explicit traffic generation, every packet that has ever been sent by the victim and attacker is formed in the simulation model and travels around strictly following the criteria of time and path that extracted from the real scenario. Thus, the model provides a promising aid in the study of intrusion detection techniques.

Computer crime is a large problem (CSI, 2004; Kabay, 2001a; Kabay, 2001b). Security managers have a variety of tools at their disposal -- firewalls, Intrusion Detection Systems (IDSs), encryption, authentication, and other hardware and software solutions to combat computer crime. Many IDS variants exist which allow security managers and engineers to identify attack network packets primarily through the use of signature detection; i.e., the IDS recognizes attack packets due to their well-known "fingerprints" or signatures as those packets cross the network's gateway threshold. On the other hand, anomaly-based ID systems determine what is normal traffic within a network and reports abnormal traffic behavior. This paper will describe a methodology towards developing a more-robust Intrusion Detection System through the use of data-mining techniques and anomaly detection. These data-mining techniques will dynamically model what a normal network should look like and reduce the false positive and false negative alarm rates in the process. We will use classification-tree techniques to accurately predict probable attack sessions. Overall, our goal is to model network traffic into network sessions and identify those network sessions that have a high-probability of being an attack and can be labeled as a "suspect session." Subsequently, we will use these techniques inclusive of signature detection methods, as they will be used in concert with known signatures and patterns in order to present a better model for detection and protection of networks and systems.

Acts of insurgency have become an increasing threat resulting in extensive measures being taken by the law enforcement authorities to mitigate their devastating effects on human life and infrastructure. This thesis introduces a magnetometry-based information, and signal processing methodology for detecting concealed ferrous objects in vehicle body panels. From extensive literature research, it was observed that while magnetic sensors have been used in a variety of related applications, but they have not been extensively applied to the on-road detection of firearms and explosives concealed in vehicles. This study utilized an extensive experimental protocol for preliminary concept validation. The main idea behind the approach was that almost all concealed weapons and explosives are made up of a considerable amount of ferrous material, and hence produce a local distortion in the Earth’s magnetic field. This distortion can then be identified by utilizing sensitive magnetic sensors. To detect concealed ferrous objects, magnetic signatures of a vehicle door panel were obtained by using a scanning assembly design in this thesis project, and compared to a base magnetic signature of the same vehicle door panel. The base magnetic signature is the magnetic field data of the same vehicle where no foreign ferrous objects were present. To analyze the data, a signal processing methodology was designed. To achieve the objective of accurately detecting concealed ferrous objects, simple measures such as magnetic field strength and its energy density were computed. These simple measures were then used in conjunction with more sophisticated statistical methods such as, normalized cross-correlation and Mahalanobis distance. Although all these methodologies were able to detect a magnetic footprint anomaly in the presence of a concealed object, the Mahalanobis distance approach, in particular provided the most conclusive results in all the test cases considered.

Water jetting as a means for removing anomalous materials from cast-in-drilled-hole (CIDH) piles was examined. The primary objective of this research was to establish empirical relationships between different jetting parameters and the removal of commonly occurring anomalous zone materials, including low-strength concrete, slurry mixed concrete, grout, and clay soil. Also investigated was the current standard-of-practice used by water jetting contractors within California. The testing specimens consisted of typical anomalous material with unconfined compressive strengths between 5 and 6,000 psi. The experimental work consisted of water blasting submerged specimens using rotary jets, nozzles, and pumping equipment typically used in construction practice. Two testing protocols were developed. The first testing protocol called for the nozzle to be held stationary and the second allowed the nozzle to be cycled up and down across the anomaly. During testing, material removal rates were measured as a function of jet pressure and standoff distance. Water blasted specimens were cut apart after testing to confirm erosion measurements and to permit inspection of the water blasted surfaces. Based on the results, erosion rates and the effectiveness of water jetting are primarily influenced by unconfined compressive strength, when using standard test equipment and jetting pressures. Further, aggregate size and material type in the anomalous material does not appear to influence both total erosion and erosion rate.