Technological advancements and widespread adaptation of new technology in industry have made industrial time series data more available than ever before. This trend is expected to continue, especially with the introduction of Industry 4.0, where the goal is to connect everything on the industry floor to the cloud and the Industrial Internet of Things. With this development grows the need for versatile methods for mining industrial time series data. Time series motif discovery is a sub-set of data mining and is about finding interesting patterns in time series data. The state of the art in time series motif discovery is the Matrix Profile proposed in 2016. However, there are few publications where the Matrix Profile has been applied to real-life industrial time series data despite its popularity. The goal of the thesis has been to create a tool that enables joint human-machine exploration of industrial time series data using the Matrix profile and present the challenges involved. The result is a human-machine exploration procedure called IUSE that has been applied to three data sets containing real-life industrial time series data. IUSE enables the user to extract semantic information, detect cycles, find deviating patterns and helps the user to get a deeper understanding of a time series. The description of IUSE comes alongside learned lessons, faced challenges and experience from applying the Matrix Profile to actual industrial time series data.

High speed stream anomaly detection is an important technology used in many industry applications such as monitoring system health, detecting financial fraud, monitoring customer's unusual behavior and so on. In those scenarios multivariate data arrives in high speed, and needs to be calculated in real-time. Since solutions for high speed multivariate stream anomaly detection are still under development, the objective of this thesis is introducing a framework for testing different anomaly detection algorithms.Multivariate anomaly detection, usually includes two major steps: point anomaly detection and stream anomaly detection. Point anomaly detection is used to transfer multivariate feature data into anomaly score according to the recent stream of data. The stream anomaly detectors are used to detect stream anomalies based on the recent anomaly scores generated from previous point anomaly detector. This thesis presents a flexible framework that allows the easy integration and evaluation of different  data sources, point and stream anomaly detection algorithms. To demonstrate the capabilities of the framework,  we consider different scenarios with generators of artificial data, real industry data sets and time series data, point anomaly detectors of PYISC, SVM and LOF, stream anomaly detectors of DDM, CUSUM and FCWM. The evaluation results show that for point anomaly detectors, PYISC and LOF perform well when the distributions of features are known, SVM performs well even when the distributions of features are not known. For the stream anomaly detectors, DDM has some possibilities to get false anomaly detection, CUSUM has some possibilities to get failed when the stream anomalies increase slowly, while FCWM performs best with very low possibilities to get failed. / Höghastighet ström anomali detektion är en viktig teknik som används i många industriella tillämpningar såsom övervakningssystem för hälsa, upptäckande av ekonomiska bedrägerier, övervakning av kundernas ovanliga beteende och så vidare. I dessa scenarier kommer multivariat data i hög hastighet, och måste beräknas i realtid. Eftersom lösningar för höghastighet multivariat ström anomali detektion är fortfarande under utveckling, är syftet med denna avhandling att införa en ramverk för att testa olika anomali algoritmer. Multivariat anomali detektion har oftast två viktiga steg: att upptäcka punkt-avvikelser och att upptäcka ström-avvikelser.  Punkt- anomali detektorer används för att överföra multivariat data i anomali poäng enligt den senaste tidens dataström. Ström anomali detektorer används för att detektera ström avvikelser baserade på den senaste tidens anomali poäng genererade från föregående punkt anomali detektoren. Denna avhandling presenterar ett flexibelt ramverk som möjlig gör enkel integration och utvärdering av olika datakällor, punkt och ström anomali detektorer. För att demonstrera ramverkets kapabiliteteter, betraktar vi olika scenarier med  datageneratorer av konstgjorda data, verkliga industri data och tidsseriedata; punkt anomali detektorer  PYISC, SVM och Löf,  och ström anomali detektorer DDM, CUSUM och FCWM. Utvärderingsresultaten visar att för punkt anomali detektor har PYISC och LOF bra prestanda när datafördelningen är kända,  men SVM fungerar bra även när fördelningarna  inte är kända. För ström anomali detektor har DDM vissa sannolikhet att få falskt upptäcka avvikelser, och CUSUM vissa sannolikhet att misslycka när avvikelser ökar långsamt. FCWM fungerar bäst med mycket låga sannolikhet för misslyckande.

The evolution of electrification and autonomous driving on automotive leads to the increasing complexity of the in-vehicle electrical network, which poses a new challenge for testers to do troubleshooting work in massive log files. This thesis project aims to develop a predictive technique for anomaly detection focusing on user function level failures using machine learning technologies.\\ Specifically, it investigates the performance of point anomaly detection models and temporal dependent anomaly detection models on the analysis of Controller Area Network (CAN) data obtained from software-in-loop simulation. For point anomaly detection, the models of Isolation forest, Multivariate normal distribution, and Local outlier factor are implemented respectively. For temporal dependent anomaly detection, the model of an encoder-decoder architecture neural network using Long Short-Temporal Memory (LSTM) units is implemented, so is a stacking hybrid detector in the combination of LSTM Encoder and Local outlier factor.\\ With a comparison of the comprehensive performance of the proposed models, the model of LSTM AutoEncoder is selected for detecting the anomalies on sequential data in CAN logs. The experiment results show promising detection performance of LSTM AutoEncoder on the studied functional failures and suggest that it is possible to be deployed in real-time automated anomaly detection on vehicle systems. / Utvecklingen av elektrifiering och autonom körning på fordon leder till den ökande komplexiteten i fordonets elektriska nätverk, vilket utgör en ny utmaning för testare att göra felsökningsarbete i massiva loggfiler. Detta avhandlings syftar till att utveckla en förutsägbar teknik för detektering av avvikelser med fokus på användarfunktionsnivåfel med maskininlärningstekniker.\\ Specifikt undersöker den prestandan hos punktavvikelsedetekteringsmodeller och tidsberoende anomalidetekteringsmodeller på analysen av data från Controller Area Network (CAN) erhållen från simulering av mjukvara in-loop. För detektion av punktavvikelser implementeras modellerna för Isolation forest, Multivariate normal distribution och Local outlier factor. För temporär beroende anomalidetektering implementeras modellen för ett kodnings-avkodningsarkitekturneuralt nätverk som använder Long Short-Temporal Memory (LSTM) -enheter, så är en stapling hybriddetektor i kombination med LSTM Encoder och Local outlier factor.\\ Med en jämförelse av den omfattande prestandan hos de föreslagna modellerna väljs modellen för LSTM AutoEncoder för att detektera avvikelser på sekventiell data i CAN-loggar. Experimentresultaten visar lovande detektionsprestanda för LSTM AutoEncoder på de studerade funktionella misslyckandena och föreslår att det är möjligt att distribueras i realtid automatiserad anomalidetektering på fordonssystem.

This work proposes a new approach to fast detection of abnormal behaviour of cooling, IT, and power distribution systems in micro data centers based on machine learning techniques. Conventional protection of micro data centers focuses on monitoring individual parameters such as temperature at different locations and when these parameters reach certain high values, then an alarm will be triggered. This research employs machine learning techniques to extract normal and abnormal behaviour of the cooling and IT systems. Developed data acquisition system together with unsupervised learning methods quickly learns the physical dynamics of normal operation and can detect deviations from such behaviours. This provides an efficient way for not only producing health index for the micro data center, but also a rich label logging system that will be used for the supervised learning methods. The effectiveness of the proposed detection technique is evaluated on an micro data center placed at Computing Infrastructure Research Center (CIRC) in McMaster Innovation Park (MIP), McMaster University. / Thesis / Master of Science (MSc)

With the growing installation of home photovoltaics, traditional energy trading is evolving from a unidirectional utility-to-consumer model into a more distributed peer-to-peer paradigm. Besides, with the development of building energy management platforms and demand response-enabled smart devices, energy consumption saved, known as negawatt-hours, has also emerged as another commodity that can be exchanged. Users may tune their heating, ventilation, and air conditioning (HVAC) system setpoints to adjust building hourly energy consumption to generate negawatt-hours. Both photovoltaic (PV) energy and negawatt-hours are two major resources of peer-to-peer electricity trading. Blockchain has been touted as an enabler for trustworthy and reliable peer-to-peer trading to facilitate the deployment of such distributed electricity trading through encrypted processes and records. Unfortunately, blockchain cannot fully detect anomalous participant behaviors or malicious inputs to the network. Consequentially, end-user anomaly detection is imperative in enhancing trust in peer-to-peer electricity trading. This dissertation introduces machine learning-based anomaly detection techniques in peer-to-peer PV energy and negawatt-hour trading. This can help predict the next hour's PV energy and negawatt-hours available and flag potential anomalies when submitted bids. As the traditional energy trading market is agnostic to tangible real-world resources, developing, evaluating, and integrating machine learning forecasting-based anomaly detection methods can give users knowledge of reasonable bid offer quantity. Suppose a user intentionally or unintentionally submits extremely high/low bids that do not match their solar panel capability or are not backed by substantial negawatt-hours and PV energy resources. Some anomalies occur because the participant's sensor is suffering from integrity errors. At the same time, some other abnormal offers are maliciously submitted intentionally to benefit attackers themselves from market disruption. In both cases, anomalies should be detected by the algorithm and rejected by the market. Artificial Neural Networks (ANN), Recurrent Neural Network (RNN) with Long Short-Term Memory (LSTM) and Gated Recurrent Units (GRU), and Convolutional Neural Network (CNN) are compared and studied in PV energy and negawatt-hour forecasting. The semi-supervised anomaly detection framework is explained, and its performance is demonstrated. The threshold values of anomaly detection are determined based on the model trained on historical data. Besides ambient weather information, HVAC setpoint and building occupancy are input parameters to predict building hourly energy consumption in negawatt-hour trading. The building model is trained and managed by negawatt-hour aggregators. CO2 monitoring devices are integrated into the cloud-based smart building platform BEMOSS™ to demonstrate occupancy levels, further improving building load forecasting accuracy in negawatt-hour trading. The relationship between building occupancy and CO2 measurement is analyzed. Finally, experiments based on the Hyperledger platform demonstrate blockchain-based peer-to-peer energy trading and how the platform detects anomalies. / Doctor of Philosophy / The modern power grid is transforming from unidirectional to transactive power systems. Distributed peer-to-peer (P2P) energy trading is becoming more and more popular. Rooftop PV energy and negawatt-hours as two main sources of electricity assets are playing important roles in peer-to-peer energy trading. It enables the building owner to join the electricity market as both energy consumer and producer, also named prosumer. While P2P energy trading participants are usually un-informed and do not know how much energy they can generate during the next hour. Thus, a system is needed to guide the participant to submit a reasonable amount of PV energy or negawatt-hours to be supplied. This dissertation develops a machine learning-based anomaly detection model for an energy trading platform to detect the reasonable PV energy and negawatt-hours available for the next hour's electricity trading market. The anomaly detection performance of this framework is analyzed. The building load forecasting model used in negawatt-hour trading also considers the effect of building occupancy level and HVAC setpoint adjustment. Moreover, the implication of CO2 measurement devices to monitor building occupancy levels is demonstrated. Finally, a simple Hyperledger-based electricity trading platform that enables participants to sell photovoltaic solar energy/ negawatt-hours to other participants is simulated to demonstrate the potential benefits of blockchain.

The introduction of communication technology into the electric power grid has made the grid more reliable. Power system operators gain visibility over the power system and are able to resolve operational issues remotely via Supervisory Control And Data Acquisition (SCADA) technology. This reduces outage periods. Nonetheless, the remote-control capability has rendered the power grid vulnerable to cyberattacks. In December 2015, over 200,000 people in Ukraine became victims of the first publicly reported cyberattack on the power grid. Consequently, cyber-physical security research for the power system as a critical infrastructure is in critical need. Research on cybersecurity for power grids has produced a diverse literature; the multi-faceted nature of the grid makes it vulnerable to different types of cyberattacks, such as direct power grid, supply chain and ransom attacks. The attacks may also target different levels of grid operation, such as the transmission system, distribution system, microgrids, and generation. As these levels are characterized by varying operational constraints, the literature may be categorized not only according to the type of attack it targets, but also according to the level of power system operation under consideration. It is noteworthy that cybersecurity research for the transmission system dominates the literature, although the distribution system is noted to have a larger attack surface. For the distribution system, a notable attack type is the so-called direct switching attack, in which an attacker aims to disrupt power supply by compromising switching devices that connect equipment such as generators, and power grid lines. To maximize the damage, this attack tends to be coordinated as the attacker optimally selects the nodes and switches to attack. This decision-making process is often a bi- or tri-level optimization problem which models the interaction between the attacker and the power system defender. It is necessary to detect attacks and establish coordination/correlation among them. Determining coordination is a necessary step to predict the targets of an attack before attack completion, and aids in the mitigation strategy that ensues. While the literature has addressed the direct switching attack on the distribution system in different ways, there are also shortcomings. These include: (i) techniques to establish coordination among attacks are centralized, making them prone to single-point failures; (ii) techniques to establish coordination among attacks leverage only power system models, ignoring the influence of communication network vulnerabilities and load criticality in the decisions of the attacker; (iii) attacker-defender optimization models assume specific knowledge of the attacker resources and constraints by the defender, a strong unrealistic assumption that reduces their usability; (iv) and, mitigation strategies tend to be static and one-sided, being implemented only at the physical level, or at the communication network level. In light of this, this dissertation culminates in major contributions concerning real-time decentralized correlation of detected direct switching attacks and hybrid mitigation for electric power distribution systems. Concerning this, four novel contributions are presented: (i) a framework for decentralized correlation of attacks and mitigation; (ii) an attacker-defender optimization model that accounts for power system laws, load criticality, and cyber vulnerabilities in the decision-making process of the attacker; (iii) a real-time learning-based mechanism for determining correlation among detected attacks and predicting attack targets, and which does not assume knowledge of the attacker's resources and constraints by the power system defender; (iv) a hybrid mitigation strategy optimized in real-time based on information learned from detected attacks, and which combines both physical level and communication network level mitigation. Since the execution of intrusion detection systems and mechanisms such as the ones proposed in this dissertation may deter attackers from directly attacking the power grid, attackers may perform a supply chain cyberattack to yield the same results. Although, supply chain cyberattacks have been acknowledged as potentially far-reaching, and compliance directives put forward for this, the detection of supply chain cyberattacks is in a nascent stage. Consequently, this dissertation also proposes a novel method for detecting supply chain cyberattacks. To the best of the knowledge of the author, this work is the first preliminary work on supply chain cyberattack detection. / Doctor of Philosophy / The electric power grid is the network that transports electricity from generation to consumers, such as homes and factories. The power grid today is highly remote-monitored and controlled. Should there be a fault on the grid, the human operator, often remotely located, may only need to resolve it by sending a control signal to telemetry points, called nodes, via a communication network. This significantly reduces outage periods and improves the reliability of the grid. Nonetheless, the high level connectivity also exposes the grid to cyberattacks. The cyber connectivity between the power grid and the human operator, like all communication networks, is vulnerable to cyberattacks that may allow attackers to gain control of the power grid. If and when successful, wide-spread and extended outages, equipment damage, etc. may ensue. Indeed, in December 2015, over 200,000 people in Ukraine became victims to the first publicly reported cyberattack on a power grid. As a critical infrastructure, cybersecurity for the power grid is, therefore, in critical need. Research on cybersecurity for power grids has produced a diverse literature; the multi-faceted nature of the grid makes it vulnerable to different types of cyberattacks, such as direct power grid, supply chain and ransom attacks. Notable is the so-called direct switching attack, in which an attacker aims to compromise the power grid communication network in order to toggle switches that connect equipment such as generators, and power grid lines. The aim is to disrupt electricity service. To maximize the damage, this attack tends to be coordinated; the attacker optimally selects several grid elements to attack. Thus, it is necessary to both detect attacks and establish coordination among them. Determining coordination is a necessary step to predict the targets of an attack before attack completion. This aids the power grid owner to intercept and mitigate attacks. While the literature has addressed the direct switching attack in different ways, there are also shortcomings. Three outstanding ones are: (i) techniques to determine coordination among attacks and predict attack targets are centralized, making them prone to single-point failures; (ii) techniques to establish coordination among attacks leverage only power system physical laws, ignoring the influence of communication network vulnerabilities in the decisions of the attacker; (iii) and, studies on the interaction between the attacker and the defender (i.e., power grid owner) assume specific knowledge of the attacker resources and constraints by the defender, a strong unrealistic assumption that reduces their usability. This research project addresses several of the shortcomings in the literature, particularly the aforementioned. The work focuses on the electric distribution system, which is the power grid that connects directly to consumers. Indeed, this choice is ideal, as the distribution system has a larger attack surface than other parts of the grid and is characterized by computing devices with more constrained computational capability. Thus, adaptability to simple computing devices is a priority. The contributions of this dissertation provide leverage to the power grid owner to intercept and mitigate attacks in a resilient manner. The original contributions of the work are: (i) a novel realistic model that shows the decision making process of the attacker and their interactions with the defender; (ii) a novel decentralized mechanism for predicting the targets of coordinated cyberattacks on the electric distribution grid in real-time and which is guided by the attack model, (iii) and a novel hybrid optimized mitigation strategy that provides security to the power grid at both the communication network level and the physical power grid level. Since the power grid is constructed with smart equipment from various vendors, attackers may launch effective attacks by compromising the devices deployed in the power grid through a compromised supply chain. By nature, such an attack is evasive to traditional intrusion detection systems and algorithms such as the aforementioned. Therefore, this work also provides a new method to defend the grid against supply chain attacks, resulting in a mechanism for its detection in a critical power system communication device.

Sensor network performance is governed by the physical placement of sensors and their geometric relationship to the events they measure. To illustrate this, the entirety of this thesis covers the following interconnected subjects: 1) graphical analysis of the variance of the estimation error caused by physical characteristics of an acoustic target source and its geometric location relative to sensor arrays, 2) event/anomaly detection method for time aggregated point sensor data using a parametric Poisson distribution data model, 3) a sensor reduction or placement technique using Bellman optimal estimates of target agent dynamics and probabilistic training data (Goode, Chin, & Roan, 2011), and 4) transforming event monitoring point sensor data into event detection and classification of the direction of travel using a contextual, joint probability, causal relationship, sliding window, and geospatial intelligence (GEOINT) method. / Master of Science

Master of Science / There has been an astronomical increase in data at the network edge due to the rapid development of 5G infrastructure and the proliferation of the Internet of Things (IoT). In order to improve the network controller's decision-making capabilities and improve the user experience, it is of paramount importance to properly analyze this data. However, transporting such a large amount of data from edge devices to the network controller requires large bandwidth and increased latency, presenting a significant challenge to resource-constrained wireless networks. By using information processing techniques, one could effectively address this problem by sending only pertinent and critical information to the network controller. Nevertheless, finding critical information from high-dimensional observation is not an easy task, especially when large amounts of background information are present. Our thesis proposes to extract critical but low-dimensional information from high-dimensional observations using an information-theoretic deep learning framework. We focus on two distinct problems where critical information extraction is imperative. In the first problem, we study the problem of feature extraction from video frames collected in a dynamic environment and showcase its effectiveness using a video game simulation experiment. In the second problem, we investigate the detection of anomaly signals in the spectrum by extracting and analyzing useful features from spectrograms. Using extensive simulation experiments based on a practical data set, we conclude that our proposed approach is highly effective in detecting anomaly signals in a wide range of signal-to-noise ratios.

This thesis delves into the use of Artificial Intelligence (AI) for quality control in manufacturing systems, with a particular focus on anomaly detection through the analysis of torque measurements in rotating mechanical systems. The research specifically examines the effectiveness of torque measurements in quality control of locks, challenging the traditional method that relies on human tactile sense for detecting mechanical anomalies. This conventional approach, while widely used, has been found to yield inconsistent results and poses physical strain on operators. A key aspect of this study involves conducting experiments on locks using torque measurements to identify mechanical anomalies. This method represents a shift from the subjective and physically demanding practice of manually testing each lock. The research aims to demonstrate that an automated, AI-driven approach can offer more consistent and reliable results, thereby improving overall product quality. The development of a machine learning model for this purpose starts with the collection of training data, a process that can be costly and disruptive to normal workflow. Therefore, this thesis also investigates strategies for predicting and minimizing the sample size used for training. Additionally, it addresses the critical need of trustworthiness in AI systems used for final quality control. The research explores how to utilize machine learning models that are not only effective in detecting anomalies but also offers a level of interpretability, avoiding the pitfalls of black box AI models. Overall, this thesis contributes to advancing automated quality control by exploring the state-of-the-art machine learning algorithms for mechanical fault detection, focusing on sample size prediction and minimization and also model interpretability. To the best of the author’s knowledge, it is the first study that evaluates an AI-driven solution for quality control of mechanical locks, marking an innovation in the field. / Denna avhandling fördjupar sig i användningen av Artificiell Intelligens (AI) för kvalitetskontroll i tillverkningssystem, med särskilt fokus på anomalidetektion genom analys av momentmätningar i roterande mekaniska system. Forskningen undersöker specifikt effektiviteten av momentmätningar för kvalitetskontroll av lås, vilket utmanar den traditionella metoden som förlitar sig på människans taktila sinne för att upptäcka mekaniska anomalier. Denna konventionella metod, som är brett använd, har visat sig ge inkonsekventa resultat och medför fysisk belastning för operatörerna. En nyckelaspekt av denna studie innebär att genomföra experiment på lås med hjälp av momentmätningar för att identifiera mekaniska anomalier. Denna metod representerar en övergång från den subjektiva och fysiskt krävande praxisen att manuellt testa varje lås. Forskningen syftar till att demonstrera att en automatiserad, AI-driven metod kan erbjuda mer konsekventa och tillförlitliga resultat, och därmed förbättra den övergripande produktkvaliteten. Utvecklingen av en maskininlärningsmodell för detta ändamål börjar med insamling av träningsdata, en process som kan vara kostsam och störande för det normala arbetsflödet. Därför undersöker denna avhandling också strategier för att förutsäga och minimera mängden av data som används för träning. Dessutom adresseras det kritiska behovet av tillförlitlighet i AI-system som används för slutlig kvalitetskontroll. Forskningen utforskar hur man kan använda maskininlärningsmodeller som inte bara är effektiva för att upptäcka anomalier, utan också erbjuder en nivå av tolkningsbarhet, för att undvika fallgroparna med svart låda AI-modeller. Sammantaget bidrar denna avhandling till att främja automatiserad kvalitetskontroll genom att utforska de senaste maskininlärningsalgoritmerna för detektion av mekaniska fel, med fokus på prediktion och minimering av mängden träningsdata samt tolkbarheten av modellens beslut. Denna avhandling utgör det första försöket att utvärdera en AI-driven strategi för kvalitetskontroll av mekaniska lås, vilket utgör en nyskapande innovation inom området.

Within industrial systems, dependability is critical to keep the system reliable and available. Faults leading to failures of the whole system must be mitigated by a laborious design, testing, and verification process. This thesis aims to build a Network Management Agent (NMA), capable of fault detection, localization, and recovery in an Ethernet environment. The chosen NMA environment was a distributed industrial system using a redundant controller pair, where the controllers must determine when the roles should switch in case of primary failure. In the industrial context, this role-switching must be bounded and robust enough to withstand mixed traffic classes competing for network resources. An NMA was built to monitor the network with the help of Media Redundancy Protocol (MRP), heartbeats, and industrial switch queue status queries. The NMA could distinguish between node and link failure by localizing the fault while adjusting the network's Quality of Service (QoS). The controllers could safely switch roles after an average difference of 29.7065 ms from the moment the primary failed, and the secondary took over. Link failure was detected in three possible locations within 31.297 ms and the location was found within 373.419 ms. To the authors' best knowledge, other solutions mainly target L3 networks or require specialized supporting technology, whereas MRP was found in the majority of the investigated industrial switches. The proposed solution requires any heartbeat-like function sent from the switch, which MRP offers, and can be generalized to any environment where distinguishing a link from a node failure is important. QoS anomaly detection however requires capable switches and configuration of rules to prioritize the traffic accordingly.