Within companies, the ongoing digitization makes protection of data from unauthorized access and manipulation increasingly relevant. Here, artificial intelligence offers means to automatically detect such anomalous events. However, as the capabilities of these automated anomaly detection systems grow, so does their complexity, making it challenging to understand their decisions. Subsequently, many methods to explain these decisions have been proposed in recent research. The most popular techniques in this area are feature relevance explainers that explain a decision made by an artificial intelligence system by distributing relevance scores across the inputs given to the system, thus highlighting which given information had the most impact on the decision. These explainers, although present in anomaly detection, are not systematically and quantitatively evaluated. This is especially problematic, as explainers are inherently approximations that simplify the underlying artificial intelligence and thus may not always provide high-quality explanations. This thesis makes a contribution towards the systematic evaluation of feature relevance explainers in anomaly detection on tabular data. We first review the existing literature for available feature relevance explainers and suitable evaluation schemes. We find that multiple feature relevance explainers with different internal functioning are employed in anomaly detection, but that many existing evaluation schemes are not applicable to this domain. As a result, we construct a novel evaluation setup based on ground truth explanations. Since these ground truth explanations are not commonly available for anomaly detection data, we also provide methods to obtain ground truth explanations across different scenarios of data availability, allowing us to generate multiple labeled data sets with ground truth explanations. Multiple experiments across the aggregated data and explainers reveal that explanation quality varies strongly and that explainers can achieve both very high-quality and near-random explanations. Furthermore, high explanation quality does not transfer across different data and anomaly detection models, resulting in no best feature relevance explainer that can be applied without performance evaluations. As evaluation appears necessary to ensure high-quality explanations, we propose a framework that enables the optimization of explainers on unlabeled data through expert simulations. Further, to aid explainers in consistently achieving high-quality explanations in applications where expert simulations are not available, we provide two schemes for setting explainer hyperparameters specifically suitable for anomaly detection. / In Unternehmen wird durch die voranschreitende Digitalisierung der Schutz von Daten vor unberechtigtem Zugriff und Manipulation immer relevanter. Hier bietet Künstliche Intelligenz eine automatische Erkennung solcher anomaler Ereignisse. Mit der zunehmenden Leistungsfähigkeit dieser automatisierten Systeme zur Erkennung von Anomalien wächst jedoch auch deren Komplexität, so dass es schwierig ist, ihre Entscheidungen nachzuvollziehen. In der jüngsten Forschung wurden daher zahlreiche Methoden zur Erklärung solcher Entscheidungen vorgeschlagen. Die populärsten Techniken in diesem Bereich sind Merkmalsrelevanz-Erklärer, die eine von einer Künstlichen Intelligenz getroffene Entscheidung erklären, indem sie Relevanzwerte über die dem System gegebenen Eingaben verteilen und so hervorheben, welche Informationen den größten Einfluss auf die Entscheidung hatten. Diese Erklärer sind zwar in der Anomalieerkennung vorhanden, werden aber nicht systematisch und quantitativ ausgewertet. Dies ist besonders problematisch, da Erklärer inhärent die zugrundeliegende Künstliche Intelligenz vereinfachen, und daher nicht automatisch hochwertige Erklärungen liefern. Diese Arbeit leistet einen Beitrag zur systematischen Evaluierung von Merkmalsrelevanz-Erklärern im Bereich der Anomalieerkennung. Zunächst wird ein Überblick über die bestehende Literatur zu verfügbaren Merkmalsrelevanz-Erklärern und geeigneten Evaluationsschemata gegeben. Wir stellen fest, dass mehrere Merkmalsrelevanz-Erklärer mit unterschiedlicher interner Funktionsweise in der Anomalieerkennung eingesetzt werden, viele der bestehenden Evaluationsschemata dort aber nicht anwendbar sind. Deshalb konstruieren wir ein Evaluierungssystem auf Basis von Ground-Truth-Erklärungen. Da solche Ground-Truth-Erklärungen für Anomalie-Erkennungsdaten allgemein nicht verfügbar sind, liefern wir auch Methoden, um GroundTruth-Erklärungen bei unterschiedlicher Datenverfügbarkeit zu erhalten, was uns ermöglicht, gelabelte Datensätze mit Ground-Truth-Erklärungen zu generieren. Mehrere Experimente mit den aggregierten Daten und Erklärern zeigen, dass die Qualität der Erklärungen stark variiert und dass Erklärer sowohl hochwertige als auch nahezu zufällige Erklärungen liefern können. Darüber hinaus lässt sich eine hohe Erklärungsqualität nicht auf verschiedene Daten und Anomalieerkennungsmodelle übertragen, was dazu führt, dass kein hochperformante Erklärer existiert, der ohne Leistungsevaluierung eingesetzt werden kann. Da Evaluierungen notwendig erscheinen, um qualitativ hochwertige Erklärungen zu gewährleisten, schlagen wir ein Framework vor, das die Optimierung von Erklärern auf ungelabelten Daten durch Expertensimulationen ermöglicht. Um Erklärer dabei zu unterstützen, konsistent hochwertige Erklärungen in Anwendungen zu erzielen, in denen keine Expertensimulation verfügbar ist, schlagen wir zwei Verfahren zur Einstellung von Erklärer-Hyperparametern in der Anomalieerkennung vor.

Introduction. Mobile health (mHealth) integrates mobile devices into healthcare, enabling remote monitoring, data collection, and personalized interventions. Machine Learning (ML), a subfield of Artificial Intelligence (AI), can use mHealth data to confirm or extend domain knowledge by finding associations within the data, i.e., with the goal of improving healthcare decisions. In this work, two data collection techniques were used for mHealth data fed into ML systems: Mobile Crowdsensing (MCS), which is a collaborative data gathering approach, and Ecological Momentary Assessments (EMA), which capture real-time individual experiences within the individual’s common environments using questionnaires and sensors. We collected EMA and MCS data on tinnitus and COVID-19. About 15 % of the world’s population suffers from tinnitus. Materials & Methods. This thesis investigates the challenges of ML systems when using MCS and EMA data. It asks: How can ML confirm or broad domain knowledge? Domain knowledge refers to expertise and understanding in a specific field, gained through experience and education. Are ML systems always superior to simple heuristics and if yes, how can one reach explainable AI (XAI) in the presence of mHealth data? An XAI method enables a human to understand why a model makes certain predictions. Finally, which guidelines can be beneficial for the use of ML within the mHealth domain? In tinnitus research, ML discerns gender, temperature, and season-related variations among patients. In the realm of COVID-19, we collaboratively designed a COVID-19 check app for public education, incorporating EMA data to offer informative feedback on COVID-19-related matters. This thesis uses seven EMA datasets with more than 250,000 assessments. Our analyses revealed a set of challenges: App user over-representation, time gaps, identity ambiguity, and operating system specific rounding errors, among others. Our systematic review of 450 medical studies assessed prior utilization of XAI methods. Results. ML models predict gender and tinnitus perception, validating gender-linked tinnitus disparities. Using season and temperature to predict tinnitus shows the association of these variables with tinnitus. Multiple assessments of one app user can constitute a group. Neglecting these groups in data sets leads to model overfitting. In select instances, heuristics outperform ML models, highlighting the need for domain expert consultation to unveil hidden groups or find simple heuristics. Conclusion. This thesis suggests guidelines for mHealth related data analyses and improves estimates for ML performance. Close communication with medical domain experts to identify latent user subsets and incremental benefits of ML is essential. / Einleitung. Unter Mobile Health (mHealth) versteht man die Nutzung mobiler Geräte wie Handys zur Unterstützung der Gesundheitsversorgung. So können Ärzt:innen z. B. Gesundheitsinformationen sammeln, die Gesundheit aus der Ferne überwachen, sowie personalisierte Behandlungen anbieten. Man kann maschinelles Lernen (ML) als System nutzen, um aus diesen Gesundheitsinformationen zu lernen. Das ML-System versucht, Muster in den mHealth Daten zu finden, um Ärzt:innen zu helfen, bessere Entschei- dungen zu treffen. Zur Datensammlung wurden zwei Methoden verwendet: Einerseits trugen zahlreiche Personen zur Sammlung von umfassenden Informationen mit mo- bilen Geräten bei (sog. Mobile Crowdsensing), zum anderen wurde den Mitwirkenden digitale Fragebögen gesendet und Sensoren wie GPS eingesetzt, um Informationen in einer alltäglichen Umgebung zu erfassen (sog. Ecologcial Momentary Assessments). Diese Arbeit verwendet Daten aus zwei medizinischen Bereichen: Tinnitus und COVID-19. Schätzungen zufolge leidet etwa 15 % der Menschheit an Tinnitus. Materialien & Methoden. Die Arbeit untersucht, wie ML-Systeme mit mHealth Daten umgehen: Wie können diese Systeme robuster werden oder neue Dinge lernen? Funktion- ieren die neuen ML-Systeme immer besser als einfache Daumenregeln, und wenn ja, wie können wir sie dazu bringen, zu erklären, warum sie bestimmte Entscheidungen treffen? Welche speziellen Regeln sollte man außerdem befolgen, wenn man ML-Systeme mit mHealth Daten trainiert? Während der COVID-19-Pandemie entwickelten wir eine App, die den Menschen helfen sollte, sich über das Virus zu informieren. Diese App nutzte Daten der Krankheitssymptome der App Nutzer:innen, um Handlungsempfehlungen für das weitere Vorgehen zu geben. Ergebnisse. ML-Systeme wurden trainiert, um Tinnitus vorherzusagen und wie er mit geschlechtsspezifischen Unterschieden zusammenhängen könnte. Die Verwendung von Faktoren wie Jahreszeit und Temperatur kann helfen, Tinnitus und seine Beziehung zu diesen Faktoren zu verstehen. Wenn wir beim Training nicht berücksichtigen, dass ein App User mehrere Datensätze ausfüllen kann, führt dies zu einer Überanpassung und damit Verschlechterung des ML-Systems. Interessanterweise führen manchmal einfache Regeln zu robusteren und besseren Modellen als komplexe ML-Systeme. Das zeigt, dass es wichtig ist, Experten auf dem Gebiet einzubeziehen, um Überanpassung zu vermeiden oder einfache Regeln zur Vorhersage zu finden. Fazit. Durch die Betrachtung verschiedener Langzeitdaten konnten wir neue Empfehlun- gen zur Analyse von mHealth Daten und der Entwicklung von ML-Systemen ableiten. Dabei ist es wichtig, medizinischen Experten mit einzubeziehen, um Überanpassung zu vermeiden und ML-Systeme schrittweise zu verbessern.

Die Bachelorarbeit untersucht, wie der Einsatz von Künstlicher Intelligenz die Effizienz und Genauigkeit der Betrugserkennung in der Wirtschaftsprüfung verbessert und welche wirtschaftlichen Vorteile daraus resultieren. Drei zentrale Hypothesen wurden analysiert. Die erste Hypothese betrachtet die Effizienzsteigerung durch KI. KI kann große Datenmengen schneller und präziser als traditionelle Ansätze verarbeiten. Durch den Einsatz von Machine Learning, Natural Language Processing und dem Red-Flag-Ansatz werden verdächtige Aktivitäten automatisch erkannt und gezielt geprüft. Dies beschleunigt Prüfungsprozesse und steigert deren Kosteneffizienz. Die zweite Hypothese beleuchtet die Genauigkeit der Betrugserkennung. Der Einsatz von Explainable Artificial Intelligence ermöglicht eine höhere Urteilssicherheit, während Informed Machine Learning Expertenwissen in die Algorithmen integriert. KI-Systeme bieten durch ihre stetige Weiterentwicklung langfristig ein hohes Potenzial zur Qualitätssteigerung. Die dritte Hypothese thematisiert die Entwicklung neuer Dienstleistungen. Obwohl keine vollständig neuen Geschäftsfelder identifiziert wurden, bieten KI-basierte Frühwarnsysteme und Open-Source-Ansätze Potenziale, insbesondere für mittelständische Unternehmen. Die Ergebnisse zeigen, dass KI die Effizienz und Genauigkeit der Betrugserkennung signifikant verbessert und die Relevanz von KI in der Wirtschaftsprüfung unterstreicht. Einschränkungen der Arbeit bestehen in der fehlenden empirischen Validierung und der Konzentration auf „schwache KI“. Künftige Forschung sollte praktische Tests und neue Geschäftsfelder in den Fokus nehmen.:Abbildungs- und Tabellenverzeichnis Abkürzungsverzeichnis 1. Einleitung 1.1 Problemstellung 1.2 Relevanz des Themas 1.3 Zielsetzung 1.4 Aufbau der Arbeit 2. Wirtschaftliches Prüfungswesen 2.1 Umsetzung einer Jahresabschlussprüfung 2.1.1 Risikoorientierter Prüfungsansatz 2.1.2 Prozess der Prüfung 2.2 Fraud 2.2.1 Interne und externe Fraud-Bekämpfung 2.2.1.1 Compliance: Interne Fraud-Bekämpfung 2.2.1.2 Forensic Services: Externe Fraud-Bekämpfung 2.2.2 Verhinderung von Fraud 3. Künstliche Intelligenz 3.1 Grundlagen der Künstlichen Intelligenz 3.2 Einsatzfelder von Künstlicher Intelligenz 3.2.1 Entscheider 3.2.2 Natural Language Processing (Sprachverarbeitung) 3.2.3 Expert Systems (Expertensysteme) 3.3 Künstliche Intelligenz in der Wirtschaftsprüfung/forensischer Prüfung 4. Methodik 4.1 Ableitung der Suchbegriffe 4.2 Auswahlkriterien für die Literatur 4.3 Bewertung der Literatur 4.4 Kritische Analyse der Literaturauswertung 5. Ergebnisse 5.1 Effizienzsteigerung durch KI in der Betrugserkennung 5.2 Genauigkeitsverbesserung durch KI-Methoden 5.3 Wirtschaftliche Nutzenpotenziale für Wirtschaftsprüfungsgesellschaften 6. Diskussion 6.1 Einordnung in bestehende Forschung 6.2 Kritische Würdigung der Ergebnisse 7. Fazit 7.1 Erreichung der Zielsetzung 7.2 Zusammenfassung des Hauptteils 7.3 Einordnung in den Forschungsstand und Praxisanwendung 7.4 Ausblick auf zukünftige Forschung Literaturverzeichnis Anhang Eidesstattliche Erklärung

Cyber-Physical Systems (CPSs) are the core of modern critical infrastructure (e.g. power-grids) and securing them is of paramount importance. Anomaly detection in data is crucial for CPS security. While Artificial Neural Networks (ANNs) are strong candidates for the task, they are seldom deployed in safety-critical domains due to the perception that ANNs are black-boxes. Therefore, to leverage ANNs in CPSs, cracking open the black box through explanation is essential. The main objective of this dissertation is developing explainable ANN-based Anomaly Detection Systems for Cyber-Physical Systems (CP-ADS). The main objective was broken down into three sub-objectives: 1) Identifying key-requirements that an explainable CP-ADS should satisfy, 2) Developing supervised ANN-based explainable CP-ADSs, 3) Developing unsupervised ANN-based explainable CP-ADSs. In achieving those objectives, this dissertation provides the following contributions: 1) a set of key-requirements that an explainable CP-ADS should satisfy, 2) a methodology for deriving summaries of the knowledge of a trained supervised CP-ADS, 3) a methodology for validating derived summaries, 4) an unsupervised neural network methodology for learning cyber-physical (CP) behavior, 5) a methodology for visually and linguistically explaining the learned CP behavior. All the methods were implemented on real-world and benchmark datasets. The set of key-requirements presented in the first contribution was used to evaluate the performance of the presented methods. The successes and limitations of the presented methods were identified. Furthermore, steps that can be taken to overcome the limitations were proposed. Therefore, this dissertation takes several necessary steps toward developing explainable ANN-based CP-ADS and serves as a framework that can be expanded to develop trustworthy ANN-based CP-ADSs.

This research paper identifies the disciplinary differences of stakeholders and its effects on working cross-functional in the context of machine learning. This study specifically focused on 1) how stakeholders with disciplinary differences interpret a search system, and 2) how the multi-disciplines should be managed in an organization. This was studied through 12 interviews with stakeholders from design disciplines, product management, data science and machine learning engineering, followed by a focus group with a participant from each of the different disciplines. The findings were analyzed through a thematic analysis and institutional logics and concluded that the different logics had a high impact on the stakeholders’ understanding of the search system. The research also concluded that bridging the gap between the multi-disciplinary stakeholders are of high importance in context of machine learning.

No description available.

Deep Neural Networks (DNNs) are known as black box algorithmsthat lack transparency and interpretability for humans. eXplainableArtificial Intelligence (XAI) is introduced to tackle this problem. MostXAI methods are utilized post-training, providing explanations of themodel to clarify its predictions and inner workings for human understanding. However, there is a shortage of methods that utilize XAIduring training to not only observe the model’s behavior but alsoexploit this information for the benefit of the model.In our approach, we propose a novel method that leverages XAIduring the training process itself. Incorporating feedback from XAIcan give us insights into important features of input data that impact model decisions. This work explores focusing more on specificfeatures during training, which could potentially improve model performance introspectively throughout the training phase. We analyzethe stability of feature explanations during training and find thatthe model’s attention to specific features is consistent in the MNISTdataset. However, unimportant features lack stability. The OCTMNIST dataset, on the other hand, has stable explanations for important features but less consistent explanations for less significant features. Based on this observation, two types of masks, namely fixedand dynamic, are applied to the model’s structure using XAI’s feedback with minimal human intervention. These masks identify themore important features from the less important ones and set the pixels associated with less significant features to zero. The fixed mask isgenerated based on XAI feedback after the model is fully trained, andthen it is applied to the output of the first convolutional layer of a newmodel (with the same architecture), which is trained from scratch. Onthe other hand, the dynamic mask is generated based on XAI feedback during training, and it is applied to the model while the modelis still training. As a result, these masks are changing during different epochs. Examining these two methods on both deep and shallowmodels, we find that both masking methods, particularly the fixedone, reduce the focus of all models on the least important parts of theinput data. This results in improved accuracy and loss in all models.As a result, this approach enhances the model’s interpretability andperformance by incorporating XAI into the training process.

Artificial Intelligence (AI) has found increasing application in various domains, revolutionizing problem-solving and data analysis. However, in decision-sensitive areas like Intrusion Detection Systems (IDS), trust and reliability are vital, posing challenges for traditional black box AI systems. These black box IDS, while accurate, lack transparency, making it difficult to understand the reasons behind their decisions. This dissertation explores the concept of eXplainable Intrusion Detection Systems (X-IDS), addressing the issue of trust in X-IDS. It explores the limitations of common black box IDS and the complexities of explainability methods, leading to the fundamental question of trusting explanations generated by black box explainer modules. To address these challenges, this dissertation presents the concept of white box explanations, which are innately explainable. While white box algorithms are typically simpler and more interpretable, they often sacrifice accuracy. However, this work utilized white box Competitive Learning (CL), which can achieve competitive accuracy in comparison to black box IDS. We introduce Rule Extraction (RE) as another white box technique that can be applied to explain black box IDS. It involves training decision trees on the inputs, weights, and outputs of black box models, resulting in human-readable rulesets that serve as global model explanations. These white box techniques offer the benefits of accuracy and trustworthiness, which are challenging to achieve simultaneously. This work aims to address gaps in the existing literature, including the need for highly accurate white box IDS, a methodology for understanding explanations, small testing datasets, and comparisons between white box and black box models. To achieve these goals, the study employs CL and eclectic RE algorithms. CL models offer innate explainability and high accuracy in IDS applications, while eclectic RE enhances trustworthiness. The contributions of this dissertation include a novel X-IDS architecture featuring Self-Organizing Map (SOM) models that adhere to DARPA’s guidelines for explainable systems, an extended X-IDS architecture incorporating three CL-based algorithms, and a hybrid X-IDS architecture combining a Deep Neural Network (DNN) predictor with a white box eclectic RE explainer. These architectures create more explainable, trustworthy, and accurate X-IDS systems, paving the way for enhanced AI solutions in decision-sensitive domains.

Survival analysis is an essential statistics and machine learning field in various critical applications like medical research and predictive maintenance. In these domains understanding models' predictions is paramount. While machine learning techniques are increasingly applied to enhance the predictive performance of survival models, they simultaneously sacrifice transparency and explainability.  Survival models, in contrast to regular machine learning models, predict functions rather than point estimates like regression and classification models. This creates a challenge regarding explaining such models using the known off-the-shelf machine learning explanation techniques, like Shapley Values, Counterfactual examples, and others.    Censoring is also a major issue in survival analysis where the target time variable is not fully observed for all subjects. Moreover, in predictive maintenance settings, recorded events do not always map to actual failures, where some components could be replaced because it is considered faulty or about to fail in the future based on an expert's opinion. Censoring and noisy labels create problems in terms of modeling and evaluation that require to be addressed during the development and evaluation of the survival models. Considering the challenges in survival modeling and the differences from regular machine learning models, this thesis aims to bridge this gap by facilitating the use of machine learning explanation methods to produce plausible and actionable explanations for survival models. It also aims to enhance survival modeling and evaluation revealing a better insight into the differences among the compared survival models. In this thesis, we propose two methods for explaining survival models which rely on discovering survival patterns in the model's predictions that group the studied subjects into significantly different survival groups. Each pattern reflects a specific survival behavior common to all the subjects in their respective group. We utilize these patterns to explain the predictions of the studied model in two ways. In the first, we employ a classification proxy model that can capture the relationship between the descriptive features of subjects and the learned survival patterns. Explaining such a proxy model using Shapley Values provides insights into the feature attribution of belonging to a specific survival pattern. In the second method, we addressed the "what if?" question by generating plausible and actionable counterfactual examples that would change the predicted pattern of the studied subject. Such counterfactual examples provide insights into actionable changes required to enhance the survivability of subjects. We also propose a variational-inference-based generative model for estimating the time-to-event distribution. The model relies on a regression-based loss function with the ability to handle censored cases. It also relies on sampling for estimating the conditional probability of event times. Moreover, we propose a decomposition of the C-index into a weighted harmonic average of two quantities, the concordance among the observed events and the concordance between observed and censored cases. These two quantities, weighted by a factor representing the balance between the two, can reveal differences between survival models previously unseen using only the total Concordance index. This can give insight into the performances of different models and their relation to the characteristics of the studied data. Finally, as part of enhancing survival modeling, we propose an algorithm that can correct erroneous event labels in predictive maintenance time-to-event data. we adopt an expectation-maximization-like approach utilizing a genetic algorithm to find better labels that would maximize the survival model's performance. Over iteration, the algorithm builds confidence about events' assignments which improves the search in the following iterations until convergence. We performed experiments on real and synthetic data showing that our proposed methods enhance the performance in survival modeling and can reveal the underlying factors contributing to the explainability of survival models' behavior and performance.

Market manipulation has increased in line with the number of active players in the financialmarkets. The most common methods for monitoring financial markets are rule-based systems,which are limited to previous knowledge of market manipulation. This work was carried out incollaboration with the company Scila, which provides surveillance solutions for the financialmarkets.In this thesis, we will try to implement a complementary method to Scila's pre-existing rule-based systems to objectively detect outliers in all available data and present the result onsuspect transactions and customer behavior to an operator. Thus, the method needs to detectoutliers and show the operator why a particular market participant is considered an outlier. Theoutlier detection method needs to implement interpretability. This led us to the formulation of ourresearch question as: How can an outlier detection method be implemented as a tool for amarket surveillance operator to identify potential market manipulation outside Scila's rule-basedsystems?Two models, an outlier detection model Isolation Forest, and a feature importance model (MI-Local-DIFFI and its subset Path Length Indicator) were chosen to fulfill the purpose of the study.The study used three datasets, two synthetic datasets, one scattered and one clustered, andone dataset from Scila.The results show that Isolation Forest has an excellent ability to find outliers in the various datadistributions we investigated. We used a feature importance model to make Isolation Forest’sscoring of outliers interpretable. Our intention was that the feature importance model wouldspecify how important different features were in the process of an observation being defined asan outlier. Our results have a relatively high degree of interpretability for the scattered datasetbut worse for the clustered dataset. The Path Length Indicator achieved better performancethan MI-Local-DIFFI for both datasets. We noticed that the chosen feature importance model islimited by the process of how Isolation Forest isolates an outlier.