Explore the vast range of titles available.

The capability to devise robust outlier and anomaly detection tools is an important research topic in machine learning and data mining. Recent techniques have been focusing on reinforcing detection with sophisticated data generation tools that successfully refine the learning process by generating variants of the data that expand the recognition capabilities of the outlier detector. In this paper, we propose ARN, a semi-supervised anomaly detection and generation method based on adversarial counterfactual reconstruction. ARN exploits a regularized autoencoder to optimize the reconstruction of variants of normal examples with minimal differences that are recognized as outliers. The combination of regularization and counterfactual reconstruction helps to stabilize the learning process, which results in both realistic outlier generation and substantially extended detection capability. In fact, the counterfactual generation enables a smart exploration of the search space by successfully relating small changes in all the actual samples from the true distribution to high anomaly scores. Experiments on several benchmark datasets show that our model improves the current state of the art by valuable margins because of its ability to model the true boundaries of the data manifold.

To enhance the generalization of networks and avoid redundant training efforts, cross-image hyperspectral anomaly detection (HAD) based on deep learning has been gradually studied in recent years. Cross-image HAD aims to perform anomaly detection on unknown hyperspectral images after a single training process on the network, thereby improving detection efficiency in practical applications. However, the existing approaches may require additional supervised information or stacking of networks to improve model performance, which may impose high demands on data or hardware in practical applications. In this paper, a simple and lightweight unsupervised cross-image HAD method called Variational Joint Discrimination Network (VJDNet) is proposed. We leverage the reconstruction and distribution representation ability of the variational autoencoder (VAE), learning the global and local discriminability of anomalies jointly. To integrate these representations from the VAE, a probability distribution joint discrimination (PDJD) module is proposed. Through the PDJD module, the VJDNet can directly output the anomaly score mask of pixels. To further facilitate the unsupervised paradigm, a sample pair generation module is proposed, which is able to generate anomaly samples and background representation samples tailored for the cross-image HAD task. The experimental results show that the proposed method is able to maintain the detection accuracy with only a small number of parameters.

To face the shortcomings of the auto-encoder (AE) algorithm in terms of weak dynamic object extraction and strong reconstruction ability in abnormal situations for video anomaly detection, an attention-based misaligned spatiotemporal AE (AMS-AE) model is proposed for video anomaly detection. The AMS-AE model uses a pseudo-abnormal generation module (PAGM) to dislocate the spatiotemporal information of the video and then uses an attention mechanism algorithm to selectively capture the foreground regions. Finally, it reconstructs the video frames through encoding and decoding. During the training process, normal data is used for training, while the abnormal frames generated by the PAGM are introduced as anomalies to limit the reconstruction ability of the auto-encoding algorithm on abnormal data, which facilitates better detection of anomalies during testing phase. The experimental results show that the AMS-AE algorithm achieves significantly better performance than some other algorithms on three public datasets (UCSD Ped2, CUHK Avenue, and Shanghai Tech), effectively improving the accuracy and robustness of video anomaly detection. The area under the ROC curve (AUC) values of 98.7%, 89.7%, and 74.0% were achieved on the above public datasets, respectively.

Urban communities rely on built utility infrastructures as critical lifelines that provide essential services such as water, gas, and power, to sustain modern socioeconomic systems. These infrastructures consist of underground and surface-level assets that are operated and geo-distributed over large regions where continuous monitoring for anomalies is required but challenging to implement. This article addresses the problem of deploying heterogeneous Internet of Things sensors in these networks to support future decision-support tasks, for example, anomaly detection, source identification, and mitigation. We use stormwater as a driving use case; these systems are responsible for drainage and flood control, but act as conduits that can carry contaminants to the receiving waters. Challenges toward effective monitoring include the transient and random nature of the pollution incidents, the scarcity of historical data, the complexity of the system, and technological limitations for real-time monitoring. We design a SemanTics-aware sEnsor Placement framework (STEP) to capture pollution incidents using structural, behavioral, and semantic aspects of the infrastructure. We leverage historical data to inform our system with new, credible instances of potential anomalies. Several key topological and empirical network properties are used in proposing candidate deployments that optimize the balance between multiple objectives. We also explore the quality of anomaly representation in the network through new perspectives, and provide techniques to enhance the realism of the anomalies considered in a network. We evaluate STEP on six real-world stormwater networks in Southern California, USA, which shows its efficacy in monitoring areas of interest over other baseline methods.

Anomaly detection involves identifying data that deviates from normal patterns. Two primary strategies are used: one-class classification and binary classification. In Industrial Control Systems (ICS), where anomalies can cause significant damage, timely and accurate detection is essential, often requiring analysis of time-series data. One-class classification is commonly used but tends to have a high false alarm rate. To address this, binary classification is explored, which can better differentiate between normal and anomalous data, though it struggles with class imbalance in ICS datasets. This paper proposes a mutation-based technique for generating ICS time-series anomalies. The method maps ICS time-series data into a latent space using a variational recurrent autoencoder, applies mutation operations, and reconstructs the time-series, introducing plausible anomalies that reflect multivariate correlations. Evaluations of ICS datasets show that these synthetic anomalies are visually and statistically credible. Training a binary classifier on data augmented with these anomalies effectively mitigates the class imbalance problem.

Cyber threats to industrial control systems (ICSs) have increased as information and communications technology (ICT) has been incorporated. In response to these cyber threats, we are implementing a range of security equipment and specialized training programs. Anomaly data stemming from cyber-attacks are crucial for effectively testing security equipment and conducting cyber training exercises. However, securing anomaly data in an ICS environment requires a lot of effort. For this reason, we propose a method for generating anomaly data that reflects cyber-attack characteristics. This method uses systematic sampling and linear regression models in an ICS environment to generate anomaly data reflecting cyber-attack characteristics based on benign data. The method uses statistical analysis to identify features indicative of cyber-attack characteristics and alters their values from benign data through systematic sampling. The transformed data are then used to train a linear regression model. The linear regression model can predict features because it has learned the linear relationships between data features. This experiment used ICS_PCAPS data generated based on Modbus, frequently used in ICS. In this experiment, more than 50,000 new anomaly data pieces were generated. As a result of using some of the new anomaly data generated as training data for the existing model, no significant performance degradation occurred. Additionally, comparing some of the new anomaly data with the original benign and attack data using kernel density estimation confirmed that the new anomaly data pattern was changing from benign data to attack data. In this way, anomaly data that partially reflect the pattern of the attack data were created. The proposed method generates anomaly data like cyber-attack data quickly and logically, free from the constraints of cost, time, and original cyber-attack data required in existing research.

We present the CHAOS-7 model of the time-dependent near-Earth geomagnetic field between 1999 and 2020 based on magnetic field observations collected by the low-Earth orbit satellites Swarm, CryoSat-2, CHAMP, SAC-C and Ørsted, and on annual differences of monthly means of ground observatory measurements. The CHAOS-7 model consists of a time-dependent internal field up to spherical harmonic degree 20, a static internal field which merges to the LCS-1 lithospheric field model above degree 25, a model of the magnetospheric field and its induced counterpart, estimates of Euler angles describing the alignment of satellite vector magnetometers, and magnetometer calibration parameters for CryoSat-2. Only data from dark regions satisfying strict geomagnetic quiet-time criteria (including conditions on IMF Bz and By at all latitudes) were used in the field estimation. Model parameters were estimated using an iteratively reweighted regularized least-squares procedure; regularization of the time-dependent internal field was relaxed at high spherical harmonic degree compared with previous versions of the CHAOS model. We use CHAOS-7 to investigate recent changes in the geomagnetic field, studying the evolution of the South Atlantic weak field anomaly and rapid field changes in the Pacific region since 2014. At Earth’s surface a secondary minimum of the South Atlantic Anomaly is now evident to the south west of Africa. Green’s functions relating the core–mantle boundary radial field to the surface intensity show this feature is connected with the movement and evolution of a reversed flux feature under South Africa. The continuing growth in size and weakening of the main anomaly is linked to the westward motion and gathering of reversed flux under South America. In the Pacific region at Earth’s surface between 2015 and 2018 a sign change has occurred in the second time derivative (acceleration) of the radial component of the field. This acceleration change took the form of a localized, east–west oriented, dipole. It was clearly recorded on ground, for example at the magnetic observatory at Honolulu, and was seen in Swarm observations over an extended region in the central and western Pacific. Downward continuing to the core–mantle boundary, we find this event originated in field acceleration changes at low latitudes beneath the central and western Pacific in 2017.

Over the past few years, we have witnessed the emergence of Internet of Things (IoT) and Industrial IoT networks that bring significant benefits to citizens, society, and industry. However, their heterogeneous and resource-constrained nature makes them vulnerable to a wide range of threats. Therefore, there is an urgent need for novel security mechanisms such as accurate and efficient anomaly-based intrusion detection systems (AIDSs) to be developed before these networks reach their full potential. Nevertheless, there is a lack of up-to-date, representative, and well-structured IoT/IIoT-specific datasets which are publicly available and constitute benchmark datasets for training and evaluating machine learning models used in AIDSs for IoT/IIoT networks. Contribution to filling this research gap is the main target of our recent research work and thus, we focus on the generation of new labelled IoT/IIoT-specific datasets by utilising the Cooja simulator. To the best of our knowledge, this is the first time that the Cooja simulator is used, in a systematic way, to generate comprehensive IoT/IIoT datasets. In this paper, we present the approach that we followed to generate an initial set of benign and malicious IoT/IIoT datasets. The generated IIoT-specific information was captured from the Contiki plugin “powertrace” and the Cooja tool “Radio messages”.

Attack detection problems in industrial control systems (ICSs) are commonly known as a network traffic monitoring scheme for detecting abnormal activities. However, a network-based intrusion detection system can be deceived by attackers that imitate the system’s normal activity. In this work, we proposed a novel solution to this problem based on measurement data in the supervisory control and data acquisition (SCADA) system. The proposed approach is called measurement intrusion detection system (MIDS), which enables the system to detect any abnormal activity in the system even if the attacker tries to conceal it in the system’s control layer. A supervised machine learning model is generated to classify normal and abnormal activities in an ICS to evaluate the MIDS performance. A hardware-in-the-loop (HIL) testbed is developed to simulate the power generation units and exploit the attack dataset. In the proposed approach, we applied several machine learning models on the dataset, which show remarkable performances in detecting the dataset’s anomalies, especially stealthy attacks. The results show that the random forest is performing better than other classifier algorithms in detecting anomalies based on measured data in the testbed.

Teleconnections from tropical Pacific sea surface temperature (SST) anomalies to the high-latitude Southern Hemisphere (SH) are examined using observations and reanalysis. Analysis of tropical Pacific SST anomalies is conducted separately for the central Pacific (CP) and eastern Pacific (EP) regions. During the austral cold season, extratropical SH atmospheric Rossby wave train patterns are observed in association with both EP and CP SST variability. The primary difference between the patterns is the westward displacement of the CP-related atmospheric anomalies, consistent with the westward elongation of CP-related convective SST required for upper-level divergence and Rossby wave generation. Consequently, CP-related patterns of SH SST, Antarctic sea ice, and temperature anomalies also exhibit a westward displacement, but otherwise, the cold season extratropical SH teleconnections are largely similar. During the warm season, however, extratropical SH teleconnections associated with tropical CP and EP SST anomalies differ substantially. EP SST variability is linked to largely zonally symmetric structures in the extratropical atmospheric circulation, which projects onto the southern annular mode (SAM), and is strongly related to the SH temperature and sea ice fields. In contrast, CP SST variability is only weakly related to the SH atmospheric circulation, temperature, or sea ice fields and no longer exhibits any clear association with the SAM. One hypothesized mechanism suggests that the relatively weak CP-related SST anomalies are not able to substantially impact the background flow of the subtropical jet and its subsequent interaction with equatorward-propagating waves associated with variability in the SAM. However, there is currently no widely established mechanism that links tropical Pacific SST anomalies to the SAM.