Embedded platforms are often used as a sensor data processing node to collect data and transmit the data to the remote server. Due to the poor performance and power limitation, data processing was often left to the remote server. With the improvement of the computation ability, it is becoming possible to do some partial data processing on the embedded platforms, which would reduce the power and time consumption on the data transmission. Moreover, processing the data locally on the embedded platforms could reduce the dependence on the network. The platform could even do some tasks offline. This project aims to explore effective data analysis methods, especially for anomaly detection, which could be implemented on the embedded platform to be analyzed and detected locally. In this project, we select four methods: Seasonal and Trend Decomposition Using Loess (STL), Autoregressive Integrated Moving Average Model (ARIMA), Vector Autoregression (VAR), Long ShortTerm Memory (LSTM), to implement on the embedded platform ESP32. To test which methods could better fit the platform, we evaluate and compare the result from two aspects: the time overhead and the accuracy. The results show that the STL has the highest detection accuracy, but its time overhead is significantly higher than all other methods. ARIMA has the smallest time overhead and higher accuracy than LSTM and VAR. For LSTM, the method performs better with univariable input than multivariable input. Finally, we discuss the factors that may influence the result and future works. / Inbäddade plattformar används ofta som en sensor databehandlingsnod för att samla in och sedan överföra data till fjärrservern. Databehandling lämnades ofta till fjärrservern på grund av den dåliga prestandan och effektbegränsningen. Med förbättrad beräkningsförmåga blir det framkomligt att göra en del databehandling på de inbäddade plattformarna, vilket skulle minska ström och tidsförbrukningen för dataöverföringen. För övrigt kan lokal behandling av data på de inbäddade plattformarna minska beroendet av nätverket. Plattformen kan till och med utföra vissa uppgifter I nedkopplat läge. Detta projekt avser att utforska effektiva dataanalysmetoder särskilt för avvikelsedetektering, som kan verkställas på den inbäddade plattformen för att analyseras och upptäckas lokalt. I det här projektet väljer vi fyra metoder för att införa på den inbäddade plattformen ESP32: Seasonal and Trend Decomposition Using Loess (STL), Autoregressive Integrated Moving Average Model (ARIMA), Vector Autoregression (VAR), Long Short-Term Memory (LSTM). För att testa vilka metoder som bättre passar plattformen utvärderar och jämför vi resultatet med hänsyn till två aspekter: tidsomkostnaderna och noggrannheten. Resultaten visar att STL har den högsta detektionsnoggrannheten, men dess tidsomkostning är betydligt högre än alla andra metoder. ARIMA har den minsta tidsomkostningen och högre noggrannhet än LSTM och VAR. För LSTM fungerar metoden bättre med univariable input än multivariable input. Slutligen diskuterar vi faktorerna som möjligtvis påverkar resultatet och framtida arbeten.

Ore is transported using belt conveyor systems. The transported ore has various anomalous objects that must be removed to prevent damage to the system. Currently anomalies are detected manually using humans. This leads to increased costs of wages and damage to the system overmissed anomalies. The thesis aims to solve this problem via the use of trained neural networks which can run on relatively cheap systems with a greater accuracy than humans. A set of neural networks were trained on both the BCS dataset consisting of data collected from the belt conveyor system and on the MVTec dataset. The latter dataset was used as a way of checking the correctness of the implementation of the models. As training neural networks usually requires large datasets, this thesis also focuses on the effect of the portion of labelled versus unlabelled data on the models. Labelling data can be time consuming and expensive so investigating if or how much data can be unlabelled without any or minimal loss to accuracy could lead to further cost reductions. The convolutional autoencoder (CAE) performed best on the classification based task on the BCS dataset where it managed to classify most of the dataset correctly, with an F1-score of 0.94 on data without anomalies and an F1-score of 0.86 on data with anomalies, as long as suitable thresholds were set. ResNet performed somewhat well with a 0.91 F1-score in detecting anomaly free data and a 0.50 F1-score in detecting anomaly containing data. The SimCLR and SimCLRv2 models were unable to learn from the data and defaulted to always assuming the data contained anomalies. The CAE model trained using the L1 loss function performed best with an IoU of 0.272 and performed worst with the SSIM based loss function with an IoU of 0.160. The effect of labelled versus unlabelled data using the MVTec dataset was tested using the SimCLR and SimCLRv2 models and the models performed best with the fully labelled dataset which was expected. The SimCLR model was able to identify all categories with an F1-score greater than 0.67 whereas the other splits performed worse overall with two or more categories completely misclassified. The SimCLRv2 was able to classify six categories with an F1-score greater than 0.0 which was significantly better than all other labelled and unlabelled splits.

Critical networks require defence in depth incorporating many different security technologies including intrusion detection. One important intrusion detection approach is called anomaly detection where normal (good) behaviour of users of the protected system is modelled, often using machine learning or data mining techniques. During detection new data is matched against the normality model, and deviations are marked as anomalies. Since no knowledge of attacks is needed to train the normality model, anomaly detection may detect previously unknown attacks. In this thesis we present ADWICE (Anomaly Detection With fast Incremental Clustering) and evaluate it in IP networks. ADWICE has the following properties: (i) Adaptation - Rather than making use of extensive periodic retraining sessions on stored off-line data to handle changes, ADWICE is fully incremental making very flexible on-line training of the model possible without destroying what is already learnt. When subsets of the model are not useful anymore, those clusters can be forgotten. (ii) Performance - ADWICE is linear in the number of input data thereby heavily reducing training time compared to alternative clustering algorithms. Training time as well as detection time is further reduced by the use of an integrated search-index. (iii) Scalability - Rather than keeping all data in memory, only compact cluster summaries are used. The linear time complexity also improves scalability of training. We have implemented ADWICE and integrated the algorithm in a software agent. The agent is a part of the Safeguard agent architecture, developed to perform network monitoring, intrusion detection and correlation as well as recovery. We have also applied ADWICE to publicly available network data to compare our approach to related works with similar approaches. The evaluation resulted in a high detection rate at reasonable false positives rate. / <p>Report code: LiU-Tek-Lic-2006:12.</p>

Anomaly detection is an important first step of quality control in manufacturing processes. In wooden planks, anomalies such as broken knots and resin pockets can lower the quality of the final product. With the help of machine vision, inspections can be made faster, at higher accuracy, and at a lower cost. Therefore, this Master's Thesis project aims to explore different machine vision-based machine learning methods for anomaly detection in images of wooden planks. Both unsupervised and supervised methods were used. The evaluated unsupervised methods were two variations of student-teacher frameworks, while the supervised methods were different semantic segmentation models. The evaluation results showed that the pre-trained DeepLabV3 semantic segmentation model performed the best, with a pixel-level IoU of 0.780, an object-level precision of 89.3% and object-level recall of 96.9%. Findings suggest that for this data set of images of wooden planks, the benefits of training on labeled data outweigh the time cost of annotation.

Anomaly detection plays a crucial role in various domains, such as transportation, cybersecurity, and industrial monitoring, where the timely identification of unusual patterns or outliers is of utmost importance. Traditional statistical techniques have limitations in handling complex and highdimensional data, which motivates the use of deep learning approaches. The project proposes designing and implementing deep neural networks, tailored explicitly for time series multivariate data from sensors incorporated in vehicles, to effectively capture intricate temporal dependencies and interactions among variables. As this project is conducted in collaboration with Scania, Sweden, the models are trained on datasets encompassing various vehicle sensor data. Different deep learning architectures, including Long Short-Term Memory (LSTM) networks and Convolutional Neural Networks (CNNs), are explored and compared to identify the most suitable model for anomaly detection tasks for the specified time series data and CNN found to perform well for the data used in the study. Furthermore, interpretability techniques are incorporated into the developed models to enhance their transparency and provide insights into the reasons behind detected anomalies. Interpretability is crucial in real-world applications to facilitate trust, understanding, and decision-making. Both model-agnostic and model-specific interpretability methods were employed to highlight the relevant features and contribute to the interpretability of the anomaly detection models. The performance of the proposed models is evaluated using test datasets with anomaly data, and comparisons are made against existing anomaly detection methods to demonstrate their effectiveness. Evaluation metrics such as precision, recall, false positive rate, F1 score, and composite F1 score are employed to assess the anomaly detection models' detection accuracy and robustness. For evaluating the interpretability method, Kolmogorov-Smirnov Test is used on counterfactual examples. The outcomes of this research project will contribute to developing advanced anomaly detection techniques that can effectively analyse time series multivariate data collected from sensors incorporated in vehicles. Incorporating interpretability techniques will provide valuable insights into the detected anomalies, enabling better decision-making and improved trust in the deployed models. These advancements can potentially enhance anomaly detection systems across various domains, leading to more reliable and secure operations.

No description available.

Aircraft-mounted cameras have potential to greatly increase the effectiveness of wilderness search and rescue efforts by collecting photographs or video of the search area. The more data that is collected, the more difficult it becomes to process it by visual inspection alone. This work presents a method for automatically detecting unusual objects in aerial video to assist people in locating signs of missing persons in wilderness areas. The detector presented here makes use of anomaly detection methods originally designed for hyperspectral imagery. Multiple anomaly detection methods are considered, implemented, and evaluated. These anomalies are then aggregated into spatiotemporal objects by using the video's inherent spatial and temporal redundancy. The results are therefore summarized into a list of unusual objects to enhance the search technician's video review interface. In the user study reported here, unusual objects found by the detector were overlaid on the video during review. This increased participants' ability to find relevant objects in a simulated search without significantly affecting the rate of false detection. Other effects and possible ways to improve the user interface are also discussed.

In today's world the amount of collected data increases every day, this is a trend which is likely to continue. At the same time the potential value of the data does also increase due to the constant development and improvement of hardware and software. However, in order to gain insights, make decisions or train accurate machine learning models we want to ensure that the data we collect is of good quality. There are many definitions of data quality, in this thesis we focus on the accuracy aspect. One method which can be used to ensure accurate data is to monitor for and alert on anomalies. In this thesis we therefore suggest a method which, based on historic values, is able to detect anomalies in time series as new values arrive. The method consists of two parts, forecasting the next value in the time series using Holt-Winters method and comparing the residual to an estimated Gaussian distribution. The suggested method is evaluated in two steps. First, we evaluate the forecast accuracy for Holt-Winters method using different input sizes. In the second step we evaluate the performance of the anomaly detector when using different methods to estimate the variance of the distribution of the residuals. The results indicate that the suggested method works well most of the time for detection of point anomalies in seasonal and trending time series data. The thesis also discusses some potential next steps which are likely to further improve the performance of this method. / I dagens värld ökar mängden insamlade data för varje dag som går, detta är en trend som sannolikt kommer att fortsätta. Samtidigt ökar även det potentiella värdet av denna data tack vare ständig utveckling och förbättring utav både hårdvara och mjukvara. För att utnyttja de stora mängder insamlade data till att skapa insikter, ta beslut eller träna noggranna maskininlärningsmodeller vill vi försäkra oss om att vår data är av god kvalité. Det finns många definitioner utav datakvalité, i denna rapport fokuserar vi på noggrannhetsaspekten. En metod som kan användas för att säkerställa att data är av god kvalité är att övervaka inkommande data och larma när anomalier påträffas. Vi föreslår därför i denna rapport en metod som, baserat på historiska data, kan detektera anomalier i tidsserier när nya värden anländer. Den föreslagna metoden består utav två delar, dels att förutsäga nästa värde i tidsserien genom Holt-Winters metod samt att jämföra residualen med en estimerad normalfördelning. Vi utvärderar den föreslagna metoden i två steg. Först utvärderas noggrannheten av de, utav Holt-Winters metod, förutsagda punkterna för olika storlekar på indata. I det andra steget utvärderas prestandan av anomalidetektorn när olika metoder för att estimera variansen av residualernas distribution används. Resultaten indikerar att den föreslagna metoden i de flesta fall fungerar bra för detektering utav punktanomalier i tidsserier med en trend- och säsongskomponent. I rapporten diskuteras även möjliga åtgärder vilka sannolikt skulle förbättra prestandan hos den föreslagna metoden.

This project aims to detect possible anomalies in the resource consumption of radio base stations within the 4G LTE Radio architecture. This has been done by analyzing the statistical data that each node generates every 15 minutes, in the form of "performance maintenance counters". In this thesis, we introduce methods that allow resources to be automatically monitored after software updates, in order to detect any anomalies in the consumption patterns of the different resources compared to the reference period before the update. Additionally, we also attempt to narrow down the origin of anomalies by pointing out parameters potentially linked to the issue. / Detta projekt syftar till att upptäcka möjliga anomalier i resursförbrukningen hos radiobasstationer inom 4G LTE Radio-arkitekturen. Detta har gjorts genom att analysera de statistiska data som varje nod genererar var 15:e minut, i form av PM-räknare (PM = Performance Maintenance). I denna avhandling introducerar vi metoder som låter resurser över-vakas automatiskt efter programuppdateringar, för att upptäcka eventuella avvikelser i resursförbrukningen jämfört med referensperioden före uppdateringen. Dessutom försöker vi också avgränsa ursprunget till anomalier genom att peka ut parametrar som är potentiellt kopplade till problemet.

Computer crime is a large problem (CSI, 2004; Kabay, 2001a; Kabay, 2001b). Security managers have a variety of tools at their disposal -- firewalls, Intrusion Detection Systems (IDSs), encryption, authentication, and other hardware and software solutions to combat computer crime. Many IDS variants exist which allow security managers and engineers to identify attack network packets primarily through the use of signature detection; i.e., the IDS recognizes attack packets due to their well-known "fingerprints" or signatures as those packets cross the network's gateway threshold. On the other hand, anomaly-based ID systems determine what is normal traffic within a network and reports abnormal traffic behavior. This paper will describe a methodology towards developing a more-robust Intrusion Detection System through the use of data-mining techniques and anomaly detection. These data-mining techniques will dynamically model what a normal network should look like and reduce the false positive and false negative alarm rates in the process. We will use classification-tree techniques to accurately predict probable attack sessions. Overall, our goal is to model network traffic into network sessions and identify those network sessions that have a high-probability of being an attack and can be labeled as a "suspect session." Subsequently, we will use these techniques inclusive of signature detection methods, as they will be used in concert with known signatures and patterns in order to present a better model for detection and protection of networks and systems.