Mitigates anomaly score imbalance in long-tailed distributions.
problem Class imbalance in normal data leads to skewed anomaly detection performance.
method Proposes an importance-weighted loss function to balance anomaly scores.
result Improves anomaly detection performance by 0.043 on real-world datasets.
A robust loss for anomaly mitigation and unsupervised contamination classification
problem Detecting and mitigating contamination in supervised and unsupervised settings
method Neural Bayesian Anomaly Mitigation (NBAM)
result Recovering the structure of contamination and identifying label-flip pairs
Nowadays, advanced intrusion detection systems (IDSs) rely on a combination of anomaly detection and signature-based methods. An IDS gathers observations, analyzes behavioral patterns, and reports suspicious events for further investigation. A notorious issue anomaly detection systems (ADSs) and IDSs face is the possib…
Study detects and mitigates stealthy DDoS attacks in IoT networks.
problem Stealthy DDoS attacks in IoT networks.
method Anomaly-based IDS for timely detection and mitigation.
result Demonstrated capability of detecting and mitigating small attack size per source.
As spacecraft send back increasing amounts of telemetry data, improved anomaly detection systems are needed to lessen the monitoring burden placed on operations engineers and reduce operational risk. Current spacecraft monitoring systems only target a subset of anomaly types and often require costly expert knowledge to…
BFCR detects anomalies in 1D data efficiently.
problem Anomaly detection in 1D data.
method Braced Fourier Continuation and Regression (BFCR) for efficient anomaly detection.
result BFCR trend lines effectively detect anomalies in 1D data.
To ensure undisrupted business, large Internet companies need to closely monitor various KPIs (e.g., Page Views, number of online users, and number of orders) of its Web applications, to accurately detect anomalies and trigger timely troubleshooting/mitigation. However, anomaly detection for these seasonal KPIs with va…
We tackle anomaly detection in sparse time series data.
problem Sparse time series with low signal-to-noise ratios and non-uniform performance.
method We introduce a novel generative procedure for benchmark datasets and demonstrate how anomaly score smoothing improves performance.
result Anomaly score smoothing consistently improves performance in low-count time series anomaly detection.
A new method for anomaly detection using random subspaces and Gaussian mixture models.
problem Anomaly detection in high-dimensional data.
method Statistical estimation of probability density using random subspaces combined with geometric averaging.
result The method achieves competitive AUC scores and is interpretable.
It is important to detect anomalous inputs when deploying machine learning systems. The use of larger and more complex inputs in deep learning magnifies the difficulty of distinguishing between anomalous and in-distribution examples. At the same time, diverse image and text data are available in enormous quantities. We…
C-PP-COAD detects anomalies with limited real data, reducing dependency on real calibration data.
problem Limited real calibration data for online anomaly detection.
method Context-aware prediction-powered conformal online anomaly detection (C-PP-COAD).
result Significantly reduces dependency on real calibration data without compromising FDR control.
New method uses SHapley Additive Explanations to identify anomaly detectors with complementary behaviors.
problem Challenges in unsupervised anomaly detection due to diverse data distributions and lack of labels.
method Characterize anomaly detectors using SHapley Additive Explanations to measure feature importance and similarity.
result Detectors with similar explanations produce correlated anomaly scores, while those with divergent explanations are complementary.
This paper considers the real-time detection of anomalies in high-dimensional systems. The goal is to detect anomalies quickly and accurately so that the appropriate countermeasures could be taken in time, before the system possibly gets harmed. We propose a sequential and multivariate anomaly detection method that sca…
New approach detects cyber-attacks in real-time.
problem Real-time detection of cyber-attacks for effective mitigation.
method Aggregates unsupervised anomaly detection algorithms and incorporates delayed feedback.
result Improves anomaly detection performance through theoretical guarantees.
A new method for anomaly detection adapts to local non-stationarity in low-data regimes.
problem Adapting conformal anomaly detection to handle distribution shifts in real-world data.
method Proposes a continuous inference relaxation using continuous weighted kernel density estimation to decouple local adaptation from tail resolution.
result Restores detection capabilities and statistical power in low-data regimes while maintaining valid error control.
HyPV-LEAD detects cryptocurrency anomalies proactively, improving financial security.
problem Cryptocurrency anomalies like mixing, fraud, and pump-and-dump operations are hard to detect due to class imbalance and temporal volatility.
method HyPV-LEAD integrates lead time into anomaly detection through window-horizon modeling, Peak-Valley sampling, and hyperbolic embedding.
result HyPV-LEAD achieves a PR-AUC of 0.9624 on Bitcoin transaction data, significantly outperforming state-of-the-art methods.
Paper proposes a hierarchical approach for early anomaly detection in time series data for critical health events.
problem Early detection of critical health events in intensive care units.
method A layered learning architecture that breaks the problem into pre-conditional and event layers.
result The proposed method outperforms state-of-the-art approaches for critical health episode prediction.
One-class support vector machine (OC-SVM) for a long time has been one of the most effective anomaly detection methods and extensively adopted in both research as well as industrial applications. The biggest issue for OC-SVM is yet the capability to operate with large and high-dimensional datasets due to optimization c…
Analysis of an organization's computer network activity is a key component of early detection and mitigation of insider threat, a growing concern for many organizations. Raw system logs are a prototypical example of streaming data that can quickly scale beyond the cognitive power of a human analyst. As a prospective fi…
Study on detecting backdoor attacks using adversarial detection methods.
problem Mitigating backdoor attacks in deep neural networks.
method Comprehensive studies on adversarial and backdoor examples, revising adversarial defense methods.
result Adversarial defense methods can be effective in detecting backdoor attacks.
This paper critiques flawed MVTS anomaly detection evaluation methods and proposes a simple baseline.
problem Flawed evaluation methods in MVTS anomaly detection research.
method Robust evaluation protocols, including PCA-based baseline.
result Simple PCA-based baseline outperforms many DL approaches.
Proposes a method to prevent overfitting in deep DRE models.
problem Overfitting in deep DRE models using empirical Bregman divergence.
method Introduces a non-negative correction for empirical Bregman divergence.
result The proposed method mitigates train-loss hacking and improves performance.
Advanced driver assistance systems (ADAS) can be significantly improved with effective driver action prediction (DAP). Predicting driver actions early and accurately can help mitigate the effects of potentially unsafe driving behaviors and avoid possible accidents. In this paper, we formulate driver action prediction a…
RDLI integrates domain logic and context grounding to detect crypto anomalies under scarce labels.
problem Extreme label scarcity and evasion strategies in crypto networks.
method Relational Domain Logic Integration (RDLI) with Retrieval Grounded Context (RGC).
result RDLI outperforms GNN baselines by 28.9% in F1 score under 0.01% label scarcity.
Reward hacking exploits misspecified rewards, affecting agent capabilities and true performance.
problem Reward hacking in RL models exploiting reward misspecifications.
method Constructed four RL environments with misspecified rewards; analyzed agent capabilities and behavior.
result More capable agents exploit reward misspecifications, achieving higher proxy reward but lower true reward.
Simpler autoencoder with regularization outperforms complex alternatives.
problem Autoencoders can generalize to anomalous data, leading to low reconstruction errors.
method Targeted collapse regularization to improve autoencoder performance.
result The method matches and often outperforms more complex anomaly detection techniques.
RESHAPE explains financial statement anomalies by aggregating explanations from AENNs.
problem Detecting and explaining accounting anomalies in financial audits is challenging.
method Proposes RESHAPE to explain model output on an aggregated attribute-level.
result RESHAPE provides more comprehensible explanations compared to existing methods.
RGI improves robustness of GAN-inversion for image restoration and anomaly detection.
problem Robustness of GAN-inversion to unknown gross corruptions.
method Proposes RGI and R-RGI methods with provable robustness guarantees.
result Restored images and corrupted region masks converge to ground truth under mild assumptions.
ReVol normalizes stock price features to mitigate distribution shifts, improving prediction accuracy.
problem Distribution shifts in stock price data hinder accurate prediction.
method ReVol uses normalization, attention-based estimation, and geometric Brownian motion.
result ReVol achieves an average improvement of more than 0.03 in IC and over 0.7 in SR.
Graph neural network improves SOH estimation of lithium-ion batteries.
problem Accurate SOH estimation requires alignment of statistical distributions between training and testing datasets.
method Graph convolutional networks (GCNs) with anomaly detection for selecting discharge voltage segments.
result Achieves precise SOH estimation with a root mean squared error of less than 1%.
VSCOUT detects anomalies in high-dimensional data using a hybrid VAE approach.
problem Challenges in classical SPC for high-dimensional, non-Gaussian data.
method Hybrid VAE architecture with ARD prior, ensemble filtering, and changepoint detection.
result VSCOUT achieves superior sensitivity to special-cause structure and controlled false alarms.
In an era of ubiquitous large-scale streaming data, the availability of data far exceeds the capacity of expert human analysts. In many settings, such data is either discarded or stored unprocessed in datacenters. This paper proposes a method of online data thinning, in which large-scale streaming datasets are winnowed…
Paper proposes an efficient method for calibrating spatio-temporal forecasts.
problem Real-world spatio-temporal forecasting challenges like signal anomalies and distributional shifts.
method Learning with Calibration (ST-TTC) for real-time bias correction.
result ST-TTC improves spatio-temporal forecasting accuracy with reduced computational cost.
Improves anomaly detection with contaminated unlabeled data.
problem Weakness in existing semi-supervised anomaly detection methods when unlabeled data contain anomalies.
method Integrates positive-unlabeled learning with deep anomaly detection models.
result Achieves better detection performance on various datasets.
Deep RL detects anomalies from few labeled examples and large unlabeled data.
problem Anomaly detection with limited labeled data and large unlabeled data.
method Deep reinforcement learning to optimize detection of labeled and unlabeled anomalies.
result Significantly outperforms state-of-the-art methods on 48 real-world datasets.
We propose a supervised anomaly detection method for data with inexact anomaly labels, where each label, which is assigned to a set of instances, indicates that at least one instance in the set is anomalous. Although many anomaly detection methods have been proposed, they cannot handle inexact anomaly labels. To measur…
Recent semi-supervised anomaly detection methods that are trained using small labeled anomaly examples and large unlabeled data (mostly normal data) have shown largely improved performance over unsupervised methods. However, these methods often focus on fitting abnormalities illustrated by the given anomaly examples on…
A new method assigns anomaly scores to features for better interpretation.
problem Interpreting anomaly scores from feature attributions.
method Proposes a characteristic function to attribute anomaly scores using Shapley value.
result Demonstrates the potential utility of the proposed attribution methods.
Although deep learning has been applied to successfully address many data mining problems, relatively limited work has been done on deep learning for anomaly detection. Existing deep anomaly detection methods, which focus on learning new feature representations to enable downstream anomaly detection methods, perform in…
Ensemble learning improves anomaly detection for milder symptoms.
problem Difficulty in detecting incipient anomalies due to similarity to normal conditions.
method Utilize uncertainty information from ensemble learning to identify misclassified incipient anomalies.
result Ensemble learning methods show improved performance on incipient anomaly detection.
New anomaly estimator reduces bias in MLE for normally distributed data.
problem Bias in Maximum Likelihood Estimation of structured anomalies.
method Derive a new anomaly estimator using a mixture model.
result New estimator is asymptotically unbiased regardless of anomaly family size.
TPA-AD detects axle-box bearing anomalies using pseudo anomalies near normal boundaries.
problem Detecting axle-box bearing anomalies with only normal training data.
method Two-stage approach: pseudo anomalies, contrastive learning, KNN.
result Improves anomaly detection separability and sensitivity to degradation.
Paper proposes RAN for better anomaly detection in time series data.
problem Anomaly detection algorithms often fail to accurately detect anomalies due to incomplete reconstruction of anomaly data.
method RAN uses adversarial learning and latent vector-constrained Autoencoder to ensure consistent reconstruction of anomaly data.
result RAN outperforms other algorithms in detecting meaningful anomalies with higher AUC-ROC scores.
A new method combines generative and feature-based approaches for unsupervised anomaly detection.
problem Identifying subtle anomalies in test samples compared to a normative distribution.
method A generative cold-diffusion pipeline trained to restore synthetically-corrupted images, combined with a novel synthetic anomaly generation procedure and ensembling restorations.
result Surpasses prior state-of-the-art for unsupervised anomaly detection in three Brain MRI datasets.
Paper tackles anomaly detection and RCA in dynamical systems using ICODE Networks.
problem Anomalies in dynamical systems impact performance and reliability.
method Proposes ICODE Networks for anomaly detection, RCA, and type classification.
result Demonstrates the ability to accurately detect anomalies, classify types, and pinpoint origins.
Study identifies high-density anomalies in normal data regions.
problem Detecting anomalies in normal data regions.
method Introduces non-parametric algorithmic frameworks for unsupervised detection.
result IPP framework yields the best detection results.
Improves relevancy of black-box anomaly detectors with user feedback.
problem Users often ignore many detected anomalies, requiring a method to identify and prioritize relevant ones.
method Uses user feedback to adjust anomaly selection process based on identified anomaly types.
result Significant improvements in precision and recall over various anomaly detectors.
Paper introduces an unsupervised tensor-based anomaly detection method for spatiotemporal data.
problem Challenges in detecting anomalies in spatiotemporal data, especially in urban traffic monitoring and medical imaging.
method Formulates anomaly detection as a regularized robust low-rank + sparse tensor decomposition, incorporating spatiotemporal smoothness and local dependencies.
result Demonstrates improved anomaly detection performance on both synthetic and real data.