No description available.

No description available.

This thesis aims to uncover anomalies in the data describing the performance behavior of a "robot controller" as measured by software metrics. The purpose of analyzing data is mainly to identify the changes that have resulted in different performance behaviors which we refer to as performance anomalies. To address this issue, two separate pre-processing approaches have been developed: one that adds the principal component to the data after cleaning steps and another that does not regard the principal component. Next, Isolation Forest is employed, which uses an ensemble of isolation trees for data points to segregate anomalies and generate scores that can be used to discover anomalies. Further, in order to detect anomalies, the highest distances matching cluster centroids are employed in the clustering procedure. These two data preparation methods, along with two anomaly detection algorithms, identified software builds that are very likely to be anomalies. According to an industrial evaluation conducted based on engineers’ domain knowledge, around 70% of the detected software builds as anomalous builds were successfully identified, indicating system variable deviations or software bugs.

Knowing when one does not know is crucial in decision making. By estimating uncertainties humans can recognize novelty both by intuition and reason, but most AI systems lack this self-reflective ability. In anomaly detection, a common approach is to train a model to learn the distinction between some notion of normal and some notion of anomalies. In contrast, we let the models build their own notion of normal by learning directly from the data in a self-supervised manner, and by introducing estimations of model uncertainty the models can recognize themselves when novel situations are encountered. In our work, the aim is to investigate the relationship between model uncertainty and anomalies in time series data. We develop a method based on a recurrent autoencoder approach, and we design an anomaly score function that aggregates model error with model uncertainty to indicate anomalies. Use the Monte Carlo Dropout as Bayesian approximation to derive model uncertainty. Asa proof of concept we evaluate our method qualitatively on real-world complex time series using stock market data. Results show that our method can identify extreme events in the stock market. We conclude that the relation between model uncertainty and anomalies can be utilized for anomaly detection in time series data.

This Master's Thesis focuses on the recent Cortical Learn-ing Algorithm (CLA), designed for temporal anomaly detection. It is here applied to the problem of anomaly detec-tion in user behavior of web services, which is getting moreand more important in a network security context. CLA is here compared to more traditional state-of-the-art algorithms of anomaly detection: Hidden Markov Models (HMMs) and t-stide (an N-gram-based anomaly detector), which are among the few algorithms compatible withthe online processing constraint of this problem. It is observed that on the synthetic dataset used forthis comparison, CLA performs signicantly better thanthe other two algorithms in terms of precision of the detection. The two other algorithms don't seem to be able tohandle this task at all. It appears that this anomaly de-tection problem (outlier detection in short sequences overa large alphabet) is considerably different from what hasbeen extensively studied up to now.

Mechanical devices in industriy are equipped with numerous sensors to capture thehealth state of the machines. The reliability of the machine’s health system depends on thequality of sensor data. In order to predict the health state of sensors, abnormal behaviourof sensors must be detected to avoid unnecessary cost.We proposed LSTM autoencoder in which the objective is to reconstruct input time seriesand predict the next time instance based on historical data, and we evaluate anomaliesin multivariate time series via reconstructed error. We also used exponential moving averageas a preprocessing step to smooth the trend of time series to remove high frequencynoise and low frequency deviation in multivariate time series data.Our experiment results, based on different datasets of multivariate time series of gasturbines, demonstrate that the proposed model works well for injected anomalies and realworld data to detect the anomaly. The accuracy of the model under 5 percent infectedanomalies is 98.45%.

Ground Moving Target Indicator (GMTI) uses the concept of airborne surveillance of moving ground objects to observe and take actions accordingly. This concept was established in the late 20th century and was put to test during the Gulf War to observe enemy movement on the other side of the mountain. During the war, due to limitations of technology, information such as enemy movement were usually observed through human readings. With the improvement of surveillance technology, tracking individual target became possible, which allows the extraction of useful features for advance usage. Such features, known as tracks, are the results of GMTI tracking. Although the quality of the tracker plays a crucial role in the system performance of this paper, the development of the tracker is not discussed in this paper. The developed system will use simulated ideal GMTI tracks as input dataset. This paper presents an end-to-end system that includes Anomaly GMTI (AGMTI) track simulation, Pattern of Life (PoL) extraction and Anomaly Detection System (ADS). All the subsystems (AGMTI, PoL and ADS) are independent of each other, so they can either be replaced or disabled to resemble different real-world scenarios. The results from AGMTI will provide inputs for the rest of the subsystems. The results from PoL extraction will be used to improve the performance of ADS. The proposed ADS is a semi-supervised learning detection system in which the system takes prior information to support and improve detection performance, but will still operate without prior information. The AGMTI tracks simulator will be simulated with an open-sourced software called Simulation of Urban Traffic (SUMO). The AGMTI tracks simulator subsystem will make use of SUMO's API to generate normal and anomaly GMTI tracks. The PoL extraction will be accomplished by using various clustering algorithms and statistical functions. The ADS will use combination of various anomaly detection algorithms for different anomaly events including statistical approach using Gaussian Mixture Model Expectation Maximization (GMM-EM), Hidden Markov Model (HMM), graphical approach using Weiler-Atherton Polygon Clipping (WAPC) and various clustering algorithms such as K-means clustering, Spectral clustering and DBSCAN. Finally, as extensions to the proposed system, this paper also presents Contextual Pattern of Life (CPoL) and Grouped Anomaly Detection. The CPoL is an extension to the PoL to enhance the quality and robustness of the extraction. The Grouped Anomaly is extension to both AGMTI track simulator and ADS to diversify the possible scenarios. The results from the ADS will be evaluated. Details of implementation will be provided so the system can be replicated. / Thesis / Master of Applied Science (MASc)

The manufacturing of electrical bushings for high voltages is complicated and highly demanding technology-wise. This process has more than 10 steps where a single mistake in the chain could cause a complete failure of the final product. A faulty bushing represents high costs to the company both economically and in terms of public image. Nowadays, fault detection is corrective-oriented, which means that there is low traceability on where the problem happens, and it is only detected once the final product is tested. This thesis aims to test a machine learning tool from Imagimob® to determine if is possible to detect faults during the manufacturing process using the existing captured data. To perform the test, a sample from 2019 was taken where the production of the bushings reached a 60% scrap rate. A deep-learning neural network with a 2D convolutional layer was implemented. The outcome of the system showed an efficiency of 80%. However, due to the complexity of the bushing manufacturing process, the few data samples, and the addition of different factors that can result in a faulty bushing, a range of probability is set depending on the number of anomalies detected. With such validation, the tool can label 18% of the bushings as surely faulty, and 27% as most likely faulty. The limitation of the tool is that the information must be analyzed after each step is done, and not continuously. Hence further research should be carried out on implementing a real-time tool. / Tillverkningen av elektriska genomföringar för högspänning är komplicerad och mycket krävande teknikmässigt. Denna process har mer än 10 steg där ett enda misstag i kedjan kan orsaka ett fullständigt misslyckande i slutprodukten. En felaktig genomföring innebär höga kostnader för företaget både ekonomiskt och motverkar en god image. Nuförtiden är feldetekteringen korrigerande-orienterad, det betyder att det är låg spårbarhet på var problemet uppstår och upptäcks först när slutprodukten testas. Syftet med detta examensarbete är att testa ett maskininlärningsverktyg från Imagimob® för att avgöra om det är möjligt att upptäcka fel under tillverkningsprocessen med hjälp av befintliga insamlade data. För att utföra testet togs ett prov från 2019 där produktionen av genomföringar nådde 60 % skrotmängd. Ett djupt lärande-neuralt nätverk med 2D-konvolutionelt lager implementerades. Det slutliga resultatet av systemet visade en effektivitet på 80 %. På grund av komplexiteten i tillverkningsprocessen för genomföringarna, de få datapunkterna och tillägget av olika faktorer som kan resultera i en felaktig genomföring, ställs ett sannolikhetsområde in beroende på antalet upptäckta avvikelser. Med en sådan validering kan verktyget markera 18 % av genomföringarna som säkert felaktiga och 27 % som troligen felaktiga. Begränsningen med verktyget är att informationen måste analyseras efter att varje steg är gjort, och inte kontinuerligt, därför bör ytterligare forskning göras för att implementera ett realtidsverktyg.

No / Traffic anomalies caused by Distributed Denial-of-Service (DDoS) attacks are major threats to both network service providers and legitimate customers. The DDoS attacks regularly consume and exhaust the resources of victims and hence result in abnormal bursty traffic through end-user systems. Additionally, malicious traffic aggregated into normal traffic often show dramatic changes in the traffic nature and statistical features. This study focuses on early detection of traffic anomalies caused by DDoS attacks in light of analyzing the network traffic behavior. Key statistical features including variance, autocorrelation, and self-similarity are employed to characterize the network traffic. Further, artificial neural network and support vector machine subject to the performance metrics are employed to predict and classify the abnormal traffic. The proposed diagnosis mechanism is validated through experiments where the datasets consist of two groups. The first group is the Massachusetts Institute of Technology Lincoln Laboratory dataset containing labeled DoS attack. The second group collected from DDoS attack simulation experiments covers three representative traffic shapes resulting from the dynamic attack rate configuration, namely, constant intensity, ramp-up behavior, and pulsing behavior. The experimental results demonstrate that the developed mechanism can effectively and precisely alert the abnormal traffic within short response period.

Yes / Time-series anomaly detection receives increasing research interest given the growing number of data-rich application domains. Recent additions to anomaly detection methods in research literature include deep neural networks (DNNs: e.g., RNN, CNN, and Autoencoder). The nature and performance of these algorithms in sequence analysis enable them to learn hierarchical discriminative features and time-series temporal nature. However, their performance is affected by usually assuming a Gaussian distribution on the prediction error, which is either ranked, or threshold to label data instances as anomalous or not. An exact parametric distribution is often not directly relevant in many applications though. This will potentially produce faulty decisions from false anomaly predictions due to high variations in data interpretation. The expectations are to produce outputs characterized by a level of confidence. Thus, implementations need the Prediction Interval (PI) that quantify the level of uncertainty associated with the DNN point forecasts, which helps in making better-informed decision and mitigates against false anomaly alerts. An effort has been made in reducing false anomaly alerts through the use of quantile regression for identification of anomalies, but it is limited to the use of quantile interval to identify uncertainties in the data. In this paper, an improve time-series anomaly detection method called deep quantile regression anomaly detection (DQR-AD) is proposed. The proposed method go further to used quantile interval (QI) as anomaly score and compare it with threshold to identify anomalous points in time-series data. The tests run of the proposed method on publicly available anomaly benchmark datasets demonstrate its effective performance over other methods that assumed Gaussian distribution on the prediction or reconstruction cost for detection of anomalies. This shows that our method is potentially less sensitive to data distribution than existing approaches. / Petroleum Technology Development Fund (PTDF) PhD Scholarship, Nigeria (Award Number: PTDF/ ED/PHD/IAT/884/16)