Semi-supervised anomaly detection is the setting, where in addition to a set of nominal samples, predominantly normal, a small set of labeled anomalies is available at training. In contrast to supervised defect classification, these methods do not learn the anomaly class directly and should have better generalization capability as new kinds of anomalies are introduced at test time. This is applied in an industrial defect detection context in the logs of photomask writers. Four methods are compared: two semi-supervised one-class anomaly detection methods: Deep Semi-Supervised Anomaly Detection (DeepSAD), hypersphere classifier (HSC) and two baselines, a reconstructive GAN method based on the Dual Autoencoder GAN (DAGAN) and a non-learned distance method based on the Kullback-Leibler divergence. Results show that semi-supervision increases performance, as measured by ROC AUC and PRO AUC, of DeepSAD and HSC, but at the tested supervision levels, do not surpass the performance of DAGAN. Furthermore, it is found that autoencoder pretraining increases performance of HSC similarly to as it does for DeepSAD, even though only the latter is recommended in literature. Lastly, soft labels are utilized for HSC, but results show that this has no or negative effect on the performance. / Inom semiövervakad anomalidetektion finns det förutom en mängd nominella datapunkter (huvudsakligen normala), även en liten mängd märkta anomalier tillgängliga vid träning. I motsats till övervakad defektklassifikation lär sig dessa metoder inte att känna igen anomaliklassen direkt och bör ha större generaliseringsförmåga när nya sorters anomalier introduceras vid testning. Detta appliceras inom industriell defektdetektion i loggarna för fotomaskritare. Fyra metoder jämförs: Djup Semiövervakad Anomalidetektion (DeepSAD), hypersfärklassificerare (HSC) och två basnivåer, en rekonstruktiv GAN-metod baserad på Dual Autoencoder GAN (DAGAN) och en ickke-lärd avståndsmetod baserad på Kullback-Leibler-divergens. Resultaten visar att semiöervakning förbättrar prestationen, mätt med hjälp av ROC AUC och PRO AUC, för DeepSAD och HSC. Däremot överträffar det inte, för de testade övervakningsnivåerna, prestationen för DAGAN. Vidare kan det ses att autokodningsförträning förbättrar prestationen för HSC på ett liknande sätt som det gör för DeepSAD, trots att bara det senare rekommenderas i litteraturen. Slutligen används mjuka märkningar för HSC, men resultaten visar att detta har liten eller till och med negativ påverkan på resultatet.

A robot is proficient if its performance for its task(s) satisfies a specific standard. While the design of autonomous robots often emphasizes such proficiency, another important attribute of autonomous robot systems is their ability to evaluate their own proficiency. A robot should be able to conduct proficiency self-assessment (PSA), i.e. assess how well it can perform a task before, during, and after it has attempted the task. We propose the assumption-alignment tracking (AAT) method, which provides time-indexed assessments of the veracity of robot generators' assumptions, for designing autonomous robots that can effectively evaluate their own performance. AAT can be considered as a general framework for using robot sensory data to extract useful features, which are then used to build data-driven PSA models. We develop various AAT-based data-driven approaches to PSA from different perspectives. First, we use AAT for estimating robot performance. AAT features encode how the robot's current running condition varies from the normal condition, which correlates with the deviation level between the robot's current performance and normal performance. We use the k-nearest neighbor algorithm to model that correlation. Second, AAT features are used for anomaly detection. We treat anomaly detection as a one-class classification problem where only data from the robot operating in normal conditions are used in training, decreasing the burden on acquiring data in various abnormal conditions. The cluster boundary of data points from normal conditions, which serves as the decision boundary between normal and abnormal conditions, can be identified by mainstream one-class classification algorithms. Third, we improve PSA models that predict robot success/failure by introducing meta-PSA models that assess the correctness of PSA models. The probability that a PSA model's prediction is correct is conditioned on four features: 1) the mean distance from a test sample to its nearest neighbors in the training set; 2) the predicted probability of success made by the PSA model; 3) the ratio between the robot's current performance and its performance standard; and 4) the percentage of the task the robot has already completed. Meta-PSA models trained on the four features using a Random Forest algorithm improve PSA models with respect to both discriminability and calibration. Finally, we explore how AAT can be used to generate a new type of explanation of robot behavior/policy from the perspective of a robot's proficiency. AAT provides three pieces of information for explanation generation: (1) veracity assessment of the assumptions on which the robot's generators rely; (2) proficiency assessment measured by the probability that the robot will successfully accomplish its task; and (3) counterfactual proficiency assessment computed with the veracity of some assumptions varied hypothetically. The information provided by AAT fits the situation awareness-based framework for explainable artificial intelligence. The efficacy of AAT is comprehensively evaluated using robot systems with a variety of robot types, generators, hardware, and tasks, including a simulated robot navigating in a maze-based (discrete time) Markov chain environment, a simulated robot navigating in a continuous environment, and both a simulated and a real-world robot arranging blocks of different shapes and colors in a specific order on a table.

The process of flying fighter jets naturally comes with tough environments and manoeu-vres where temperatures, pressures and forces all have a large impact on the aircraft. Part degeneration and general wear and tear greatly affects functionalities of the aircraft, and it is of importance to carefully monitor the well being of an aircraft in order to avoid catastrophic accidents. Therefore, this project aims to investigate various ways to improve anomaly detection of selected signals in the Gripen E fuel system. The methodology in this project was to compare collected flight data with generated data of a simulation model. The method was conducted for three selected signals with different properties, namely the transfer pump outlet pressure and flow, as well as the fuel mass in tank 2. A neural network was trained to generate predictions of the residual between measured and simulated flight data, together with a RandomForestRegressor to create a confidence interval of said signal. This made it possible to detect signal abnormalities when the gathered flight data heavily deviated from the generated machine learning algorithm predictions, thus alarming for anomalies. Investigated methods to improve anomaly detection includes feature selection, adding ar-tificial signals to facilitate machine learning algorithm training and filtering. A large part was also to see how an improved simulation model, and thus more accurate simulation data would affect the anomaly detection. A lot of effort was put into improving the simulation model, and investigating this area. In addition to this, the data balancing and features to balance the data on was revised. A significant challenge to tackle in this project was to map the modelling difficulties due to differences in signal properties. A by-productof improving the anomaly detection was that a general method was obtained to create a anomaly detection model of an arbitrarily chosen signal in the fuel system, regardless of the signal properties. Results show that the anomaly detection model was improved, with the main improvement area shown to be the choice of features. Improving the simulation model did not improve the anomaly detection in the transfer pump outlet pressure and flow, but it did however slightly facilitate anomaly detection of the fuel mass in tank 2 signal. It is also concluded that the signal properties can greatly affect the anomaly detection models, as accumulated effects in a signal can complicate anomaly detection. Remaining improvement areas such as filtering and addition of artificial signals can be helpful but needs to be looked into for each signal. It was also concluded that a stochastic behaviour was seen in the data balancing process, that could skew results if not handled properly. Over all the three selected signals, only one flight was misclassified as an anomaly, which can be seen as great results.

Atherosclerotic plaque is currently the leading cause of coronary artery disease (CAD). With the help of CT images, we can identify the size and type of plaque, which can help doctors make a correct diagnosis. To do this, we need to segment coronary plaques from CT images. However, plaque segmentation is still challenging because it takes a lot of energy and time of the radiologists. With the development of technology, some segmentation algorithms based on deep learning are applied in this field. These deep learning algorithms tend to be fully automated and have high segmentation accuracy, showing great potential. In this paper, we try to use deep learning method to segment plaques from 3D cardiac CT images. This work is implemented in two steps. The first part is to extract coronary artery from the CT image with the help of UNet. In the second part, a fully convolutional network is used to segment the plaques from the artery. In each part, the algorithm undergoes 5-fold cross validation. In the first part, we achieve a dice coefficient of 0.8954. In the second part, we achieve the AUC score of 0.9202 which is higher than auto-encoder method and is very close to state-of-the-art method. / Aterosklerotisk plack är för närvarande den främsta orsaken till kranskärlssjukdom (CAD). Med hjälp av CT-bilder kan vi identifiera storlek och typ av plack, vilket kan hjälpa läkare att ställa en korrekt diagnos. För att göra detta måste vi segmentera koronarplack från CT-bilder. Emellertid är placksegmentering fortfarande utmanande eftersom det tar mycket energi och tid av radiologerna. Med utvecklingen av teknik tillämpas vissa segmenteringsalgoritmer baserade på djupinlärning inom detta område. Dessa djupinlärningsalgoritmer tenderar att vara helt automatiserade och har hög segmenteringsnoggrannhet, vilket visar stor potential. I detta dokument försöker vi använda djupinlärningsmetoden för att segmentera plack från 3D-hjärt-CT-bilder. Detta arbete genomförs i två steg. Den första delen är att extrahera kranskärlen från CT-bilden med hjälp av UNet. I den andra delen används ett helt konvolutionerande nätverk för att segmentera placken från artären. I varje del genomgår algoritmen 5-faldig korsvalidering. I den första delen uppnår vi en tärningskoefficient på 0,8954. I den andra delen uppnår vi AUC-poängen 0,9202, vilket är högre än den automatiska kodarmetoden och är mycket nära den senaste metoden.

This thesis focuses on software fault detection in the telecom industry, which is crucial for companies like Ericsson to ensure stable and reliable software. Given the importance of software performance to companies that rely on it, automatically detecting faulty behavior in test or operational environments is challenging. Several approaches have been proposed to address this problem. This thesis explores reconstruction-based and forecasting-based anomaly detection using diffusion models to address software failure detection. To this end, the usage of the Structured State Space Sequence Diffusion Model was explored, which can handle temporal dependencies of varying lengths. The numerical time series data results were promising, demonstrating the model’s effectiveness in capturing and reconstructing the underlying patterns, particularly with continuous features. The contributions of this thesis are threefold: (i) A proposal of a framework for utilizing diffusion models for Time Series anomaly detection, (ii) a proposal of a particular Diffusion model Architecture that is capable of outperforming existing Ericsson Solutions on an anomaly detection dataset, (iii) presentation of experiments and results which add extra insight into the model’s capabilities, exposing some of its limitations and suggesting future research avenues to enhance its capabilities further. / Uppsatsen fokuserar på detektering av programvarufel inom telekomindustrin, vilket är essentiellt för företag som Ericsson för att säkerställa stabil och pålitlig programvara. Med hänsyn till vikten av programvarans prestanda för företag som är beroende av den är automatisk detektering av felaktigt beteende i test- eller operativa miljöer en utmanande uppgift. Flera metoder har föreslagits för att lösa problemet. Uppsatsen utforskar generativ-baserad och prediktiv-baserad anomalidetektering med hjälp av diffusionsmodeller för att hantera detektering av programvarufel. Den valda nätverksarkitekturen för att återskapa tidsseriedata var modellen ”Structured State Space Sequence Diffusion”. Resultaten för numeriska tidsseriedata var lovande och visade på modellens effektivitet i att fånga och återskapa de underliggande mönstren. Dock observerades det att modellen stötte på svårigheter vid hantering av kategoriska tidsseriekolumner. Begränsningarna i att fånga kategoriska tidsseriefunktioner pekar på ett område där modellens förmågor kan förbättras. Framtida forskning kan fokusera på att förbättra modellens förmåga att hantera kategoriska data på ett effektivt sätt.

Anomaly detection consists in automatically detecting the most unusual elements in a data set. Anomaly detection applications emerge in domains such as computer security, system monitoring, fault detection, and wireless sensor networks. The strategic importance of detecting anomalies in these domains makes anomaly detection a critical data analysis task. Moreover, the contextual nature of anomalies, among other issues, makes anomaly detection a particularly challenging problem. Anomaly detection has received significant research attention in the last two decades. Much effort has been invested in the development of novel algorithms for anomaly detection. However, several open challenges still exist in the field.This thesis presents our contributions toward solving these challenges. These contributions include: a methodological survey of the recent literature, a novel benchmarking framework for anomaly detection algorithms, an approach for scaling anomaly detection techniques to massive data sets, and a novel anomaly detection algorithm inspired by the law of universal gravitation. Our methodological survey highlights open challenges in the field, and it provides some motivation for our other contributions. Our benchmarking framework, named BAD, tackles the problem of reliably assess the accuracy of unsupervised anomaly detection algorithms. BAD leverages parallel and distributed computing to enable massive comparison studies and hyperparameter tuning tasks. The challenge of scaling unsupervised anomaly detection techniques to massive data sets is well-known in the literature. In this context, our contributions are twofold: we investigate the trade-offs between a single-threaded implementation and a distributed approach considering price-performance metrics, and we propose a scalable approach for anomaly detection algorithms to arbitrary data volumes. Our results show that, when high scalability is required, our approach can handle arbitrarily large data sets without significantly compromising detection accuracy. We conclude our contributions by proposing a novel algorithm for anomaly detection, named Gravity. Gravity identifies anomalies by considering the attraction forces among massive data elements. Our evaluation shows that Gravity is competitive with other popular anomaly detection techniques on several benchmark data sets. Additionally, the properties of Gravity makes it preferable in cases where hyperparameter tuning is challenging or unfeasible.

Time series anomaly detection receives increasing research interest given the growing number of data-rich application domains. Recent additions to anomaly detection methods in research literature include deep learning algorithms. The nature and performance of these algorithms in sequence analysis enable them to learn hierarchical discriminating features and time-series temporal nature. However, their performance is affected by the speed at which the time series arrives, the use of a fixed threshold, and the assumption of Gaussian distribution on the prediction error to identify anomalous values. An exact parametric distribution is often not directly relevant in many applications and it’s often difficult to select an appropriate threshold that will differentiate anomalies with noise. Thus, implementations need the Prediction Interval (PI) that quantifies the level of uncertainty associated with the Deep Neural Network (DNN) point forecasts, which helps in making a better-informed decision and mitigates against false anomaly alerts. To achieve this, a new anomaly detection method is proposed that computes the uncertainty in estimates using quantile regression and used the quantile interval to identify anomalies. Similarly, to handle the speed at which the data arrives, an online anomaly detection method is proposed where a model is trained incrementally to adapt to the concept drift that improves prediction. This is implemented using a window-based strategy, in which a time series is broken into sliding windows of sub-sequences as input to the model. To adapt to concept drift, the model is updated when changes occur in the new arrival instances. This is achieved by using anomaly likelihood which is computed using the Q-function to define the abnormal degree of the current data point based on the previous data points. Specifically, when concept drift occurs, the proposed method will mark the current data point as anomalous. However, when the abnormal behavior continues for a longer period of time, the abnormal degree of the current data point will be low compared to the previous data points using the likelihood. As such, the current data point is added to the previous data to retrain the model which will allow the model to learn the new characteristics of the data and hence adapt to the concept changes thereby redefining the abnormal behavior. The proposed method also incorporates feature extraction to capture structural patterns in the time series. This is especially significant for multivariate time-series data, for which there is a need to capture the complex temporal dependencies that may exist between the variables. In summary, this thesis contributes to the theory, design, and development of algorithms and models for the detection of anomalies in both static and evolving time series data. Several experiments were conducted, and the results obtained indicate the significance of this research on offline and online anomaly detection in both static and evolving time-series data. In chapter 3, the newly proposed method (Deep Quantile Regression Anomaly Detection Method) is evaluated and compared with six other prediction-based anomaly detection methods that assume a normal distribution of prediction or reconstruction error for the identification of anomalies. Results in the first part of the experiment indicate that DQR-AD obtained relatively better precision than all other methods which demonstrates the capability of the method in detecting a higher number of anomalous points with low false positive rates. Also, the results show that DQR-AD is approximately 2 – 3 times better than the DeepAnT which performs better than all the remaining methods on all domains in the NAB dataset. In the second part of the experiment, sMAP dataset is used with 4-dimensional features to demonstrate the method on multivariate time-series data. Experimental result shows DQR-AD have 10% better performance than AE on three datasets (SMAP1, SMAP3, and SMAP5) and equal performance on the remaining two datasets. In chapter 5, two levels of experiments were conducted basis of false-positive rate and concept drift adaptation. In the first level of the experiment, the result shows that online DQR-AD is 18% better than both DQR-AD and VAE-LSTM on five NAB datasets. Similarly, results in the second level of the experiment show that the online DQR-AD method has better performance than five counterpart methods with a relatively 10% margin on six out of the seven NAB datasets. This result demonstrates how concept drift adaptation strategies adopted in the proposed online DQR-AD improve the performance of anomaly detection in time series. / Petroleum Technology Development Fund (PTDF)

International Revenue Sharing Fraud (IRSF) is one of the most persistent types of fraud within the telecommunications industry. According to the 2017 Communications Fraud Control Association (CFCA) fraud loss survey, IRSF costs 6 billion dollars a year. Therefore, the detection of such frauds is of vital importance to avoid further loss. Though many efforts have been made, very few utilize the temporal patterns of phone call traffic. This project, supported with Sinch’s real production data, aims to exploit both spatial and temporal patterns learned by Graph Attention Neural network (GAT) with Gated Recurrent Unit (GRU) to find suspicious timestamps in the historical traffic. Moreover, combining with the time-independent Isolation forest model, our model should give better results for the phone call records. This report first explains the mechanism of IRSF in detail and introduces the models that are applied in this project, including GAT, GRU, and Isolation forest. Finally, it presents how our experiments have been conducted and the results with extensive analysis. Moreover, we have achieved 42.4% precision and 96.1% recall on the test data provided by Sinch, showing significant advantages over both previous work and baselines. / International Revenue Sharing Fraud (IRSF) är en av de mest ihållande typerna av bedrägerier inom telekommunikationsindustrin. Enligt 2017 Communications Fraud Control Association (CFCA) bedrägeriförlustundersökning kostar IRSF 6 miljarder dollar per år. Därför är upptäckten av sådana bedrägerier av avgörande betydelse för att undvika ytterligare förluster. Även om många ansträngningar har gjorts är det väldigt få som använder telefonsamtalstrafikens tidsmässiga mönster. Detta projekt, med stöd av Sinchs verkliga produktionsdata, syftar till att utnyttja både rumsliga och tidsmässiga mönster som lärts in av Graph Attention Neural Network (GAT) med Gated Recurrent Unit (GRU) för att hitta misstänkt tid i den historiska trafiken. Dessutom, i kombination med den tidsoberoende skogsmodellen Isolation, borde vår modell ge bättre resultat för telefonsamtalsposterna. Denna rapport förklarar först mekanismen för IRSF i detalj och introducerar modellerna som används i detta projekt, inklusive GAT, GRU och Isolation forest. Slutligen presenteras hur våra experiment har genomförts och resultaten med omfattande analys. Dessutom har vi uppnått 42.4% precision och 96.1% återkallelse på testdata från Sinch, vilket visar betydande fördelar jämfört med både tidigare arbete och baslinjer.

In the last two decades, computing and storage technologies have experienced enormous advances. Leveraging these recent advances, AI is making the leap from traditional classification use cases to automation of complex systems through advanced machine learning and reasoning algorithms. While the literature on AI algorithms and applications of these algorithms in automation is mature, there is a lack of research on trustworthy AI, i.e. how different industries can trust the developed AI modules. AI algorithms are data-driven, i.e. they learn based on the received data, and also act based on the received status data. Then, an initial step in addressing trustworthy AI is investigating plausibility of the data that is fed to the system. In this work, we study the state-of-the-art data plausibility check approaches. Then, we propose a novel approach that leverages machine learning for an automated data plausibility check. This novel approach is context-aware, i.e. it leverages potential contextual data related to the dataset under investigation for a plausibility check. Performance evaluation results confirm the outstanding performance of the proposed approach in data plausibility check. / Under de senaste två decennierna har beräkning- och lagringsteknologier upplevt enorma framsteg. Genom att utnyttja dessa senaste framsteg gör AI språnget från traditionella klassificeringsanvändningsfall till automatisering av komplexa system genom avancerade maskininlärnings- och resonerings algoritmer. Medan litteraturen om AI-algoritmer och tillämpningar av dessa algoritmer inom automatisering är mogen, saknas forskning om pålitlig AI, dvs. hur olika branscher kan lita på de utvecklade AI-modulerna. AI-algoritmer är datadrivna, dvs. de lär sig baserat på mottagen data, och agerar också baserat på mottagen statusdata. Sedan är det av yttersta vikt att kontrollera riktigheten av de data som matas till systemet. I det här arbetet studerar vi de senaste metoderna för rimlighetskontroll av data. Sedan föreslår vi ett nytt tillvägagångssätt som utnyttjar maskininlärning för en automatisk datasäkerhetskontroll. Detta nya tillvägagångssätt är kontextmedvetet, dvs det utnyttjar potentiell kontextuell information relaterad till datainnehåll som undersöks för en rimlighetskontroll. Resultatutvärderingsresultat bekräftar den enastående prestandan för det föreslagna tillvägagångssättet i rimlighetskontroll av data.

An issue authorities and banks face is fraud related to payments and transactions where huge monetary losses occur to a party or where money laundering schemes are carried out. Previous work in the field of machine learning for fraud detection has addressed the issue as a supervised learning problem. In this thesis, we propose a model which can be used in a fraud detection system with transactions and payments that are unlabeled. The proposed modelis a Long Short-term Memory in an auto-encoder decoder network (LSTMAED)which is trained and tested on transformed data. The data is transformed by reducing it to Principal Components and clustering it with K-means. The model is trained to reconstruct the sequence with high accuracy. Our results indicate that the LSTM-AED performs better than a random sequence generating process in learning and reconstructing a sequence of payments. We also found that huge a loss of information occurs in the pre-processing stages. / Obehöriga transaktioner och bedrägerier i betalningar kan leda till stora ekonomiska förluster för banker och myndigheter. Inom maskininlärning har detta problem tidigare hanterats med hjälp av klassifierare via supervised learning. I detta examensarbete föreslår vi en modell som kan användas i ett system för att upptäcka bedrägerier. Modellen appliceras på omärkt data med många olika variabler. Modellen som används är en Long Short-term memory i en auto-encoder decoder nätverk. Datan transformeras med PCA och klustras med K-means. Modellen tränas till att rekonstruera en sekvens av betalningar med hög noggrannhet. Vår resultat visar att LSTM-AED presterar bättre än en modell som endast gissar nästa punkt i sekvensen. Resultatet visar också att mycket information i datan går förlorad när den förbehandlas och transformeras.