Additive Manufacturing (AM) is a fast-growing technology in manufacturing industries. Applications of AM are spread across a wide range of fields. The aerospace industry is one of the industries that use AM because of its ability to produce light-weighted components and design freedom. Since the aerospace industry is conservative, quality control and quality assurance are essential. The quality of the welding is one of the factors that determine the quality of the AM components, hence, detecting faults in the welding is crucial. In this thesis, an automated system for detecting the faults in the welding process is presented. For this, three methods are proposed to find the anomalies in the process. The process videos that contain weld melt-pool behaviour are used in the methods. The three methods are 1) Autoencoder method, 2) Variational Autoencoder method, and 3) Image Classification method. Methods 1 and 2 are implemented using Convolutional-Long Short Term Memory (LSTM) networks to capture anomalies that occur over a span of time. For this, instead of a single image, a sequence of images is used as input to track abnormal behaviour by identifying the dependencies among the images. The method training to detect anomalies is unsupervised. Method 3 is implemented using Convolutional Neural Networks, and it takes a single image as input and predicts the process image as stable or unstable. The method learning is supervised. The results show that among the three models, the Variational Autoencoder model performed best in our case for detecting the anomalies. In addition, it is observed that in methods 1 and 2, the sequence length and frames retrieved per second from process videos has effect on model performance. Furthermore, it is observed that considering the time dependencies in our case is very beneficial as the difference between the anomalous and the non anomalous process is very small

In traditional industrial manufacturing, due to the limitations of science and technology, manual inspection methods are still used to detect product surface defects. This method is slow and inefficient due to manual limitations and backward technology. The aim of this thesis is to research whether it is possible to automate this using modern computer hardware and image classification of defects using different deep learning methods. The report concludes, based on results from controlled experiments, that it is possible to achieve a dice coefficient of more than 81%.

Context. A large portion of all the transportation in the world consists of voyages over the sea. Systems such as Automatic Identification Systems (AIS) have been developed to aid in the surveillance of the maritime traffic, in order to help keeping the amount accidents and illegal activities down. In recent years a lot of time and effort has gone into automated surveillance of maritime traffic, with the purpose of finding and reporting behaviour deviating from what is considered normal. An issue with many of the present approaches is inaccuracy and the amount of false positives that follow from it. Objectives. This study continues the work presented by Woxberg and Grahn in 2015. In their work they used quadtrees to improve upon the existing tool STRAND, created by Osekowska et al. STRAND utilizes potential fields to build a model of normal behaviour from received AIS data, which can then be used to detect anomalies in the traffic. The goal of this study is to further improve the system by adding statistical analysis to reduce the number of false positives detected by Grahn and Woxberg's implementation. Method. The method for reducing false positives proposed in this thesis uses the charge in overlapping potential fields to approximate a normal distribution of the charge in the area. If a charge is too similar to that of the overlapping potential fields the detection is dismissed as a false positive. A series of experiments were ran to find out which of the methods proposed by the thesis are most suited for this application.   Results. The tested methods for estimating the normal distribution of a cell in the potential field, i.e. the unbiased formula for estimating the standard deviation and a version using Kalman filtering, both find as many of the confirmed anomalies as the base implementation, i.e. 9/12. Furthermore, both suggested methods reduce the amount of false positives by 11.5% in comparison to the base implementation, bringing the amount of false positives down to 17.7%. However, there are indications that the unbiased method has more promise. Conclusion. The two proposed methods both work as intended and both proposed methods perform equally. There are however indications that the unbiased method may be better despite the test results, but a new extended set of training data is needed to confirm or deny this. The two methods can only work if the examined overlapping potential fields are independent from each other, which means that the methods can not be applied to anomalies of the positional variety. Constructing a filter for these anomalies is left for future study.

This thesis is presented as an artifact of a project conducted at MalmöUniversity IoTaP LABS. The Internet of Things (IoT) is a growing field and its usehas been adopted in many aspects of our daily lives, which has led todigitalization and the creation of smart IoT ecosystems. However, with the rapidadoption of IoT, little or no focus has been put on the security implications,device proliferations and its advancements. This thesis takes a step forward toexplore the usefulness of implementing a security mechanism that canproactively be used to aid understanding attacker behaviour in an IoTenvironment. To achieve this, this thesis has outlined a number of objectivesthat ranges from how to create a deliberate vulnerability by using honeypots inorder to lure attacker’s in order to study their modus operandi. Furthermore,an Intrusion Attack Detection (Model) has been constructed that has aided withthis implementation. The IAD model, has been successfully implemented withthe help of interaction and dependence of key modules that have allowedhoneypots to be executed in a controlled IoT environment. Detailed descriptionsregarding the technologies that have been used in this thesis have also beenexplored to a greater extent. On the same note, the implemented system withthe help of an attack scenario allowed an attacker to access the system andcircumnavigate throughout the camouflaged network, thereafter, the attacker’sfootprints are mapped based on the mode of attack. Consequently, given thatthis implementation has been conducted in MAU environment, the results thathave been generated as a result of this implementations have been reportedcorrectly. Eventually, based on the results that have been generated by thesystem, it is worth to note that the research questions and the objective posedby the thesis have been met.

La détection d'anomalies est tout d'abord une étape utile de pré-traitement des données pour entraîner un algorithme d'apprentissage statistique. C'est aussi une composante importante d'une grande variété d'applications concrètes, allant de la finance, de l'assurance à la biologie computationnelle en passant par la santé, les télécommunications ou les sciences environnementales. La détection d'anomalies est aussi de plus en plus utile au monde contemporain, où il est nécessaire de surveiller et de diagnostiquer un nombre croissant de systèmes autonomes. La recherche en détection d'anomalies inclut la création d'algorithmes efficaces accompagnée d'une étude théorique, mais pose aussi la question de l'évaluation de tels algorithmes, particulièrement lorsque l'on ne dispose pas de données labellisées -- comme dans une multitude de contextes industriels. En d'autres termes, l'élaboration du modèle et son étude théorique, mais aussi la sélection du modèle. Dans cette thèse, nous abordons ces deux aspects. Tout d'abord, nous introduisons un critère alternatif au critère masse-volume existant, pour mesurer les performances d'une fonction de score. Puis nous nous intéressons aux régions extrêmes, qui sont d'un intérêt particulier en détection d'anomalies, pour diminuer le taux de fausse alarme. Enfin, nous proposons deux méthodes heuristiques, l'une pour évaluer les performances d'algorithmes de détection d'anomalies en grande dimension, l'autre pour étendre l'usage des forets aléatoires à la classification à une classe. / Anomaly detection is not only a useful preprocessing step for training machine learning algorithms. It is also a crucial component of many real-world applications, from various fields like finance, insurance, telecommunication, computational biology, health or environmental sciences. Anomaly detection is also more and more relevant in the modern world, as an increasing number of autonomous systems need to be monitored and diagnosed. Important research areas in anomaly detection include the design of efficient algorithms and their theoretical study but also the evaluation of such algorithms, in particular when no labeled data is available -- as in lots of industrial setups. In other words, model design and study, and model selection. In this thesis, we focus on both of these aspects. We first propose a criterion for measuring the performance of any anomaly detection algorithm. Then we focus on extreme regions, which are of particular interest in anomaly detection, to obtain lower false alarm rates. Eventually, two heuristic methods are proposed, the first one to evaluate anomaly detection algorithms in the case of high dimensional data, the other to extend the use of random forests to the one-class setting.

No description available.

As the Automotive industry is heavily regulated from a quality point of view, excellence in pro-duction is obligatory. Due to the fact that removing human error from humans is impossible, new solutions must be found. The transition to more data driven production strategies enables the implantation of automated vision systems for replacing humans in simple classification tasks. As research in the field of artificial intelligence advances, the hardware required to run the algorithms decreases. Concurrently small computing platforms break new performance records and the innovation space converges. This work harnesses state-of-the-art from both domains by implementing a plug-on vision system, driven by a resource-constrained edge device in a production line. The implemented CNN-model based on the MobileNetV2 architecture achieved 97.80, 99.93, and 95.67% in accuracy, precision, and recall respectively. The model was trained using only 100 physical samples, which were expanded by a ratio of 1:15 through innovative real world and digital augmentations. The core of the vision system was a commodity device, the Raspberry Pi 4. The solution fulfilled all the requirements while sparking new development ideas for future work.

The increasing volume of smart electricity meter readings presents a challenge forelectricity providing companies in accurately validating and correcting the associated data. This thesis attempts to find a possible solution through the application ofunsupervised machine learning for detection of anomalous readings. Through thisapplication there is a possibility of reducing the amount of manual labor that is required each month to find which meters are necessary to investigate. A solution tothis problem could prove beneficial for both the companies and their customers. Itcould increase abnormalities detected and resolve any issues before having a significant impact. Two possible algorithms to detect anomalies within these meters areinvestigated. These algorithms are the Isolation Forest and a Autoencoder, wherethe autoencoder showed results within the expectations. The results shows a greatreduction of the manual labor that is required up to 96%.

Improving the energy efficiency of buildings is important for many reasons. There is a large body of data detailing the hourly energy consumption of buildings. This work studies a large data set from the Swedish energy market. This thesis proposes a data analysis methodology for identifying abnormal consumption patterns using two steps of clustering. First, typical weekly energy usage profiles are extracted from each building by clustering week-long segments of the building’s lifetime consumption, and by extracting the medoids of the clusters. Second, all the typical weekly energyusage profiles are clustered using agglomerative hierarchical clustering. Large clusters are assumed to contain normal consumption pattens, and small clusters are assumed to have abnormal patterns. Buildings with a large presence in small clusters are said to be abnormal, and vice versa. The method employs Dynamic Time Warping distance for dissimilarity measure. Using a set of 160 buildings, manually classified by domain experts, this thesis shows that the mean abnormality-score is higher for abnormal buildings compared to normal buildings with p ≈ 0.0036.

Networks connected to the internet are under a constant threat of attacks. To protect against such threats, new techniques utilising already connected hardware have in this thesis been proven to be a viable solution. By equipping network switches with lightweight machine learning models, such as, Decision Tree and Random Forest, no additional devices are needed to be installed on the network.When an attack is detected, the device may notify or take direct actions on the network to protect vulnerable systems. By utilising container software on Westermo's devices, a model has been integrated, limiting its computational resources. Such a system, and its building blocks, are what this thesis has researched and implemented. The system has been validated using multiple different models using a range of parameters.These models have been trained offline on datasets with pre-recorded attacks. The recordings are converted into flows, decreasing dataset size and increasing information density. These flows contain features corresponding to information about the packets and statistics about the flows. During training, a subset of features was selected using a Genetic Algorithm, decreasing the time for processing each packet. After the models have been trained, they are converted to C code, which runs on a network switch. These models are verified online, using a simulated factory, launching different attacks on the network. Results show that the hardware is sufficient for smaller models and that the system is capable of detecting certain types of attacks.