In recent years,anomaly detection has attracted much attention in industrial production.As traditional anomaly detection methods usually rely on direct comparison of samples,they often ignore the intrinsic relationshi...In recent years,anomaly detection has attracted much attention in industrial production.As traditional anomaly detection methods usually rely on direct comparison of samples,they often ignore the intrinsic relationship between samples,resulting in poor accuracy in recognizing anomalous samples.To address this problem,a knowledge distillation anomaly detection method based on feature reconstruction was proposed in this study.Knowledge distillation was performed after inverting the structure of the teacher-student network to avoid the teacher-student network sharing the same inputs and similar structure.Representability was improved by using feature splicing to unify features at different levels,and the merged features were processed and reconstructed using an improved Transformer.The experimental results show that the proposed method achieves better performance on the MVTec dataset,verifying its effectiveness and feasibility in anomaly detection tasks.This study provides a new idea to improve the accuracy and efficiency of anomaly detection.展开更多
For anomaly detection,anomalies existing in the background will affect the detection performance.Accordingly,a background refinement method based on the local density is proposed to remove the anomalies from thebackgr...For anomaly detection,anomalies existing in the background will affect the detection performance.Accordingly,a background refinement method based on the local density is proposed to remove the anomalies from thebackground.In this work,the local density is measured by its spectral neighbors through a certain radius which is obtained by calculating the mean median of the distance matrix.Further,a two-step segmentation strategy is designed.The first segmentation step divides the original background into two subsets,a large subset composed by background pixels and a small subset containing both background pixels and anomalies.The second segmentation step employing Otsu method with an aim to obtain a discrimination threshold is conducted on the small subset.Then the pixels whose local densities are lower than the threshold are removed.Finally,to validate the effectiveness of the proposed method,it combines Reed-Xiaoli detector and collaborative-representation-based detector to detect anomalies.Experiments are conducted on two real hyperspectral datasets.Results show that the proposed method achieves better detection performance.展开更多
Research on the range anomaly suppression algorithm in laser radar （ladar） range images is significant in the application and development of ladar. But most of existing algorithms cannot protect the edge and linear ...Research on the range anomaly suppression algorithm in laser radar （ladar） range images is significant in the application and development of ladar. But most of existing algorithms cannot protect the edge and linear target well while suppressing the range anomaly. Aiming at this problem, the differences among the edge, linear target, and range anomaly are analyzed and a novel algo- rithm based on neighborhood pixels detection is proposed. Firstly, the range differences between current pixel and its neighborhood pixels are calculated. Then, the number of neighborhood pixels is detected by the range difference threshold. Finally, whether the current pixel is a range anomaly is distinguished by the neighbor- hood pixel number threshold. Experimental results show that the new algorithm not only has a better range anomaly suppression performance and higher efficiency, but also protects the edge and linear target preferably compared with other algorithms.展开更多
Solar arrays are important and indispensable parts of spacecraft and provide energy support for spacecraft to operate in orbit and complete on-orbit missions.When a spacecraft is in orbit,because the solar array is ex...Solar arrays are important and indispensable parts of spacecraft and provide energy support for spacecraft to operate in orbit and complete on-orbit missions.When a spacecraft is in orbit,because the solar array is exposed to the harsh space environment,with increasing working time,the performance of its internal electronic components gradually degrade until abnormal damage occurs.This damage makes solar array power generation unable to fully meet the energy demand of a spacecraft.Therefore,timely and accurate detection of solar array anomalies is of great significance for the on-orbit operation and maintenance management of spacecraft.In this paper,we propose an anomaly detection method for spacecraft solar arrays based on the integrated least squares support vector machine(ILS-SVM)model:it selects correlated telemetry data from spacecraft solar arrays to form a training set and extracts n groups of training subsets from this set,then gets n corresponding least squares support vector machine(LS-SVM)submodels by training on these training subsets,respectively;after that,the ILS-SVM model is obtained by integrating these submodels through a weighting operation to increase the prediction accuracy and so on;finally,based on the obtained ILS-SVM model,a parameterfree and unsupervised anomaly determination method is proposed to detect the health status of solar arrays.We use the telemetry data set from a satellite in orbit to carry out experimental verification and find that the proposed method can diagnose solar array anomalies in time and can capture the signs before a solar array anomaly occurs,which reflects the applicability of the method.展开更多
A novel method for detecting anomalous program behavior is presented, which is applicable to hostbased intrusion detection systems that monitor system call activities. The method constructs a homogeneous Markov chain ...A novel method for detecting anomalous program behavior is presented, which is applicable to hostbased intrusion detection systems that monitor system call activities. The method constructs a homogeneous Markov chain model to characterize the normal behavior of a privileged program, and associates the states of the Markov chain with the unique system calls in the training data. At the detection stage, the probabilities that the Markov chain model supports the system call sequences generated by the program are computed. A low probability indicates an anomalous sequence that may result from intrusive activities. Then a decision rule based on the number of anomalous sequences in a locality frame is adopted to classify the program＇s behavior. The method gives attention to both computational efficiency and detection accuracy, and is especially suitable for on-line detection. It has been applied to practical host-based intrusion detection systems.展开更多
Airborne electromagnetic transient method enjoys the advantages of high-efficiency and the high resolution of electromagnetic anomalies,especially suitable for mining detection around goaf areas and deep exploration o...Airborne electromagnetic transient method enjoys the advantages of high-efficiency and the high resolution of electromagnetic anomalies,especially suitable for mining detection around goaf areas and deep exploration of minerals.In this paper,we calculated the full-wave airborne transient electromagnetic data,according to the result of numerical research,the advantage of switch-off time response in electromagnetic detection was proofed via experiments.Firstly,based on the full-wave airborne transient electromagnetic system developed by Jilin University(JLU-ATEMI),we proposed a method to compute the full-waveform electromagnetic(EM)data of 3D model using the FDTD approach and convolution algorithm,and verify the calculation by the response of homogenous half-space.Then,through comparison of switch-off-time response and off-time response,we studied the effect of ramp time on anomaly detection.Finally,we arranged two experimental electromagnetic detection,the results indicated that the switch-off-time response can reveal the shallow target more effectively,and the full-waveform airborne electromagnetic system is an effective technique for shallow target detection.展开更多
It is difficult to detect the anomalies whose matching relationship among some data attributes is very different from others’ in a dataset. Aiming at this problem, an approach based on wavelet analysis for detecting ...It is difficult to detect the anomalies whose matching relationship among some data attributes is very different from others’ in a dataset. Aiming at this problem, an approach based on wavelet analysis for detecting and amending anomalous samples was proposed. Taking full advantage of wavelet analysis’ properties of multi-resolution and local analysis, this approach is able to detect and amend anomalous samples effectively. To realize the rapid numeric computation of wavelet translation for a discrete sequence, a modified algorithm based on Newton-Cores formula was also proposed. The experimental result shows that the approach is feasible with good result and good practicality.展开更多
The anomaly detection of electromagnetic environment situation(EMES) has essential reference value for electromagnetic equipment behavior cognition and battlefield threat assessment.In this paper,we proposed a deep le...The anomaly detection of electromagnetic environment situation(EMES) has essential reference value for electromagnetic equipment behavior cognition and battlefield threat assessment.In this paper,we proposed a deep learning-based method for detecting anomalies in EMES to address the problem of relatively low efficiency of electromagnetic environment situation anomaly detection(EMES-AD).Firstly,the convolutional kernel extracts the static features of different regions of the EMES.Secondly,the dynamic features of the region are obtained by using a recurrent neural network(LSTM).Thirdly,the Spatio-temporal features of the region are recovered by using a de-convolutional network and then fused to predict the EMES.The structural similarity algorithm(SSIM) is used to determine whether it is anomalous.We developed the detection framework,de-signed the network parameters,simulated the data sets containing different anomalous types of EMES,and carried out the detection experiments.The experimental results show that the proposed method is effective.展开更多
图像异常检测旨在识别并定位图像中的异常区域,针对现有算法中不同层次特征信息利用不充分的问题,提出了基于多层次特征融合网络的图像异常检测算法。通过使用融合了异常先验知识的伪异常数据生成算法,对训练集进行了异常数据扩充,将异...图像异常检测旨在识别并定位图像中的异常区域,针对现有算法中不同层次特征信息利用不充分的问题,提出了基于多层次特征融合网络的图像异常检测算法。通过使用融合了异常先验知识的伪异常数据生成算法,对训练集进行了异常数据扩充,将异常检测任务转化为监督学习任务;构建了多层次特征融合网络,将神经网络中不同层次特征进行融合,丰富了特征中的低层纹理信息和高层语义信息,使得用于异常检测的特征更具区分性;训练时,设计了分数约束损失和一致性约束损失,并结合特征约束损失对整个网络模型进行训练。实验结果表明,MVTec数据集上图像级检测接收机工作特性曲线下面积(area under the receiver operating characteristic, AUROC)平均值为98.7%,像素级定位AUROC平均值为97.9%,每区域重叠率平均值为94.2%,均高于现有的异常检测算法。展开更多
为有效解决多维时间序列(multivariate time series, MTS)无监督异常检测模型中自编码器模块容易拟合异常样本、正常MTS样本对应的隐空间特征可能被重构为异常MTS的问题,设计一种具有三重生成对抗的MTS异常检测模型。以LSTM自编码器为...为有效解决多维时间序列(multivariate time series, MTS)无监督异常检测模型中自编码器模块容易拟合异常样本、正常MTS样本对应的隐空间特征可能被重构为异常MTS的问题,设计一种具有三重生成对抗的MTS异常检测模型。以LSTM自编码器为生成器,基于重构误差生成伪标签,由判别器区分经伪标签过滤后的重构MTS和原始MTS;采用两次对抗训练将LSTM自编码器的隐空间约束为均匀分布,减少LSTM自编码器隐空间特征重构出异常MTS的可能性。多个公开MTS数据集上的实验结果表明,T-GAN能在带有污染数据的训练集上更好学习正常MTS分布,取得较高的异常检测效果。展开更多
近年来,黑客攻击、网络钓鱼、勒索病毒等事件频发,使得区块链交易异常检测成为当前研究的热点之一。XGBoost作为一种基于梯度提升框架的机器学习算法,可灵活地处理数据特征,不仅关注模型的预测误差,还考虑了每个样本的相对重要性。在前...近年来,黑客攻击、网络钓鱼、勒索病毒等事件频发,使得区块链交易异常检测成为当前研究的热点之一。XGBoost作为一种基于梯度提升框架的机器学习算法,可灵活地处理数据特征,不仅关注模型的预测误差,还考虑了每个样本的相对重要性。在前人区块链交易异常检测研究的基础上,将XGBoost与随机森林算法相结合,提出了基于XGBoost和随机森林的区块链异常交易检测模型(Blockchain Anomalous Transaction Detection Based on XGBoost and Random Forests,BATD_XRF)。模型分为数据特征处理、特征选择、分类检测3个模块,选取Elliptic Data Set、Bitcoin Alpha Dataset和Bitcoin OTC Trust Network Dataset数据集,使用主成分分析方法对数据进行二分类。特征选择过程中通过Gini Mean Decrease计算平均递减量,进一步确定特征的相对重要性。分类检测过程中提出网络搜索参数调优算法,并进行10倍交叉验证。最终通过与其他模型的对比实验,证明了所提模型在区块链交易异常检测中的准确性更高,训练时间更短。展开更多
为解决传统检测方法在处理复杂、动态以及数据长度实时变化的飞行轨迹数据时特征提取不准确、检测效率较低的问题,提出一种结合长短时记忆(Long Short-Term Memory, LSTM)网络和支持向量数据描述(Support Vector Data Description, SVDD...为解决传统检测方法在处理复杂、动态以及数据长度实时变化的飞行轨迹数据时特征提取不准确、检测效率较低的问题,提出一种结合长短时记忆(Long Short-Term Memory, LSTM)网络和支持向量数据描述(Support Vector Data Description, SVDD)的无监督异常检测方法。利用LSTM网络提取可变长度飞行轨迹的关键特征,并将其转化为固定长度的序列表示;通过SVDD算法构建多维超球分类器,对正常飞行轨迹进行建模,从而识别潜在异常轨迹。为进一步提升模型性能,引入基于梯度的优化算法(Gradient-Based training algorithm, GB),实现LSTM与SVDD参数的联合训练,大幅度提高检测精度和计算效率。仿真实验结果表明,新提出的基于梯度优化的长短时记忆网络和支持向量数据描述模型(Long Short-Term Memory network and Support Vector Data Description model based on Gradient-Based training algorithm optimization, LSTM-GBSVDD)的飞行轨迹异常检测方法在处理复杂、多变的飞行轨迹异常检测任务中表现出较好的有效性和优越性,有较强的应用前景。展开更多
文摘In recent years,anomaly detection has attracted much attention in industrial production.As traditional anomaly detection methods usually rely on direct comparison of samples,they often ignore the intrinsic relationship between samples,resulting in poor accuracy in recognizing anomalous samples.To address this problem,a knowledge distillation anomaly detection method based on feature reconstruction was proposed in this study.Knowledge distillation was performed after inverting the structure of the teacher-student network to avoid the teacher-student network sharing the same inputs and similar structure.Representability was improved by using feature splicing to unify features at different levels,and the merged features were processed and reconstructed using an improved Transformer.The experimental results show that the proposed method achieves better performance on the MVTec dataset,verifying its effectiveness and feasibility in anomaly detection tasks.This study provides a new idea to improve the accuracy and efficiency of anomaly detection.
基金Projects(61405041,61571145)supported by the National Natural Science Foundation of ChinaProject(ZD201216)supported by the Key Program of Heilongjiang Natural Science Foundation,China+1 种基金Project(RC2013XK009003)supported by Program Excellent Academic Leaders of Harbin,ChinaProject(HEUCF1508)supported by the Fundamental Research Funds for the Central Universities,China
文摘For anomaly detection,anomalies existing in the background will affect the detection performance.Accordingly,a background refinement method based on the local density is proposed to remove the anomalies from thebackground.In this work,the local density is measured by its spectral neighbors through a certain radius which is obtained by calculating the mean median of the distance matrix.Further,a two-step segmentation strategy is designed.The first segmentation step divides the original background into two subsets,a large subset composed by background pixels and a small subset containing both background pixels and anomalies.The second segmentation step employing Otsu method with an aim to obtain a discrimination threshold is conducted on the small subset.Then the pixels whose local densities are lower than the threshold are removed.Finally,to validate the effectiveness of the proposed method,it combines Reed-Xiaoli detector and collaborative-representation-based detector to detect anomalies.Experiments are conducted on two real hyperspectral datasets.Results show that the proposed method achieves better detection performance.
文摘Research on the range anomaly suppression algorithm in laser radar （ladar） range images is significant in the application and development of ladar. But most of existing algorithms cannot protect the edge and linear target well while suppressing the range anomaly. Aiming at this problem, the differences among the edge, linear target, and range anomaly are analyzed and a novel algo- rithm based on neighborhood pixels detection is proposed. Firstly, the range differences between current pixel and its neighborhood pixels are calculated. Then, the number of neighborhood pixels is detected by the range difference threshold. Finally, whether the current pixel is a range anomaly is distinguished by the neighbor- hood pixel number threshold. Experimental results show that the new algorithm not only has a better range anomaly suppression performance and higher efficiency, but also protects the edge and linear target preferably compared with other algorithms.
基金supported by the National Natural Science Foundation of China(7190121061973310).
文摘Solar arrays are important and indispensable parts of spacecraft and provide energy support for spacecraft to operate in orbit and complete on-orbit missions.When a spacecraft is in orbit,because the solar array is exposed to the harsh space environment,with increasing working time,the performance of its internal electronic components gradually degrade until abnormal damage occurs.This damage makes solar array power generation unable to fully meet the energy demand of a spacecraft.Therefore,timely and accurate detection of solar array anomalies is of great significance for the on-orbit operation and maintenance management of spacecraft.In this paper,we propose an anomaly detection method for spacecraft solar arrays based on the integrated least squares support vector machine(ILS-SVM)model:it selects correlated telemetry data from spacecraft solar arrays to form a training set and extracts n groups of training subsets from this set,then gets n corresponding least squares support vector machine(LS-SVM)submodels by training on these training subsets,respectively;after that,the ILS-SVM model is obtained by integrating these submodels through a weighting operation to increase the prediction accuracy and so on;finally,based on the obtained ILS-SVM model,a parameterfree and unsupervised anomaly determination method is proposed to detect the health status of solar arrays.We use the telemetry data set from a satellite in orbit to carry out experimental verification and find that the proposed method can diagnose solar array anomalies in time and can capture the signs before a solar array anomaly occurs,which reflects the applicability of the method.
基金the National Grand Fundamental Research "973" Program of China (2004CB318109)the High-Technology Research and Development Plan of China (863-307-7-5)the National Information Security 242 Program ofChina (2005C39).
文摘A novel method for detecting anomalous program behavior is presented, which is applicable to hostbased intrusion detection systems that monitor system call activities. The method constructs a homogeneous Markov chain model to characterize the normal behavior of a privileged program, and associates the states of the Markov chain with the unique system calls in the training data. At the detection stage, the probabilities that the Markov chain model supports the system call sequences generated by the program are computed. A low probability indicates an anomalous sequence that may result from intrusive activities. Then a decision rule based on the number of anomalous sequences in a locality frame is adopted to classify the program＇s behavior. The method gives attention to both computational efficiency and detection accuracy, and is especially suitable for on-line detection. It has been applied to practical host-based intrusion detection systems.
基金Project(41674109) supported by the National Natural Science Foundation of China
文摘Airborne electromagnetic transient method enjoys the advantages of high-efficiency and the high resolution of electromagnetic anomalies,especially suitable for mining detection around goaf areas and deep exploration of minerals.In this paper,we calculated the full-wave airborne transient electromagnetic data,according to the result of numerical research,the advantage of switch-off time response in electromagnetic detection was proofed via experiments.Firstly,based on the full-wave airborne transient electromagnetic system developed by Jilin University(JLU-ATEMI),we proposed a method to compute the full-waveform electromagnetic(EM)data of 3D model using the FDTD approach and convolution algorithm,and verify the calculation by the response of homogenous half-space.Then,through comparison of switch-off-time response and off-time response,we studied the effect of ramp time on anomaly detection.Finally,we arranged two experimental electromagnetic detection,the results indicated that the switch-off-time response can reveal the shallow target more effectively,and the full-waveform airborne electromagnetic system is an effective technique for shallow target detection.
基金Project(50374079) supported by the National Natural Science Foundation of China
文摘It is difficult to detect the anomalies whose matching relationship among some data attributes is very different from others’ in a dataset. Aiming at this problem, an approach based on wavelet analysis for detecting and amending anomalous samples was proposed. Taking full advantage of wavelet analysis’ properties of multi-resolution and local analysis, this approach is able to detect and amend anomalous samples effectively. To realize the rapid numeric computation of wavelet translation for a discrete sequence, a modified algorithm based on Newton-Cores formula was also proposed. The experimental result shows that the approach is feasible with good result and good practicality.
基金funded by the National Natural Science Foundation of China, grant number 11975307the National Defense Science and Technology Innovation Special Zone Project, grant number 19-H863-01-ZT-003-003-12。
文摘The anomaly detection of electromagnetic environment situation(EMES) has essential reference value for electromagnetic equipment behavior cognition and battlefield threat assessment.In this paper,we proposed a deep learning-based method for detecting anomalies in EMES to address the problem of relatively low efficiency of electromagnetic environment situation anomaly detection(EMES-AD).Firstly,the convolutional kernel extracts the static features of different regions of the EMES.Secondly,the dynamic features of the region are obtained by using a recurrent neural network(LSTM).Thirdly,the Spatio-temporal features of the region are recovered by using a de-convolutional network and then fused to predict the EMES.The structural similarity algorithm(SSIM) is used to determine whether it is anomalous.We developed the detection framework,de-signed the network parameters,simulated the data sets containing different anomalous types of EMES,and carried out the detection experiments.The experimental results show that the proposed method is effective.
文摘图像异常检测旨在识别并定位图像中的异常区域,针对现有算法中不同层次特征信息利用不充分的问题,提出了基于多层次特征融合网络的图像异常检测算法。通过使用融合了异常先验知识的伪异常数据生成算法,对训练集进行了异常数据扩充,将异常检测任务转化为监督学习任务;构建了多层次特征融合网络,将神经网络中不同层次特征进行融合,丰富了特征中的低层纹理信息和高层语义信息,使得用于异常检测的特征更具区分性;训练时,设计了分数约束损失和一致性约束损失,并结合特征约束损失对整个网络模型进行训练。实验结果表明,MVTec数据集上图像级检测接收机工作特性曲线下面积(area under the receiver operating characteristic, AUROC)平均值为98.7%,像素级定位AUROC平均值为97.9%,每区域重叠率平均值为94.2%,均高于现有的异常检测算法。
文摘为有效解决多维时间序列(multivariate time series, MTS)无监督异常检测模型中自编码器模块容易拟合异常样本、正常MTS样本对应的隐空间特征可能被重构为异常MTS的问题,设计一种具有三重生成对抗的MTS异常检测模型。以LSTM自编码器为生成器,基于重构误差生成伪标签,由判别器区分经伪标签过滤后的重构MTS和原始MTS;采用两次对抗训练将LSTM自编码器的隐空间约束为均匀分布,减少LSTM自编码器隐空间特征重构出异常MTS的可能性。多个公开MTS数据集上的实验结果表明,T-GAN能在带有污染数据的训练集上更好学习正常MTS分布,取得较高的异常检测效果。
文摘近年来,黑客攻击、网络钓鱼、勒索病毒等事件频发,使得区块链交易异常检测成为当前研究的热点之一。XGBoost作为一种基于梯度提升框架的机器学习算法,可灵活地处理数据特征,不仅关注模型的预测误差,还考虑了每个样本的相对重要性。在前人区块链交易异常检测研究的基础上,将XGBoost与随机森林算法相结合,提出了基于XGBoost和随机森林的区块链异常交易检测模型(Blockchain Anomalous Transaction Detection Based on XGBoost and Random Forests,BATD_XRF)。模型分为数据特征处理、特征选择、分类检测3个模块,选取Elliptic Data Set、Bitcoin Alpha Dataset和Bitcoin OTC Trust Network Dataset数据集,使用主成分分析方法对数据进行二分类。特征选择过程中通过Gini Mean Decrease计算平均递减量,进一步确定特征的相对重要性。分类检测过程中提出网络搜索参数调优算法,并进行10倍交叉验证。最终通过与其他模型的对比实验,证明了所提模型在区块链交易异常检测中的准确性更高,训练时间更短。
文摘为解决传统检测方法在处理复杂、动态以及数据长度实时变化的飞行轨迹数据时特征提取不准确、检测效率较低的问题,提出一种结合长短时记忆(Long Short-Term Memory, LSTM)网络和支持向量数据描述(Support Vector Data Description, SVDD)的无监督异常检测方法。利用LSTM网络提取可变长度飞行轨迹的关键特征,并将其转化为固定长度的序列表示;通过SVDD算法构建多维超球分类器,对正常飞行轨迹进行建模,从而识别潜在异常轨迹。为进一步提升模型性能,引入基于梯度的优化算法(Gradient-Based training algorithm, GB),实现LSTM与SVDD参数的联合训练,大幅度提高检测精度和计算效率。仿真实验结果表明,新提出的基于梯度优化的长短时记忆网络和支持向量数据描述模型(Long Short-Term Memory network and Support Vector Data Description model based on Gradient-Based training algorithm optimization, LSTM-GBSVDD)的飞行轨迹异常检测方法在处理复杂、多变的飞行轨迹异常检测任务中表现出较好的有效性和优越性,有较强的应用前景。
