Papers

Field

Top tools here

Open problems in Anomaly detectors

Lack of strong deep representations for tabular anomaly detection1 paper raises it · 1 addresses it
Deep features underperform on tabular data due to weak or unavailable representations, limiting anomaly detection effectiveness.
- Adapting prior-data fitted networks for tabular anomaly detectionraises · addresses
Handling heterogeneous and misaligned multimodal data in anomaly detection2 papers raise it · 2 address it
Real-world systems produce multimodal data with semantic gaps and asynchronous dependencies, making robust anomaly detection difficult.
- Physical-Variable-Informed Deep Learning for Robust Diagnosis in Industrial Fluid Transport Systemsraises · addresses
- BEACON: Bridging Multimodal Semantics and Asynchronous Propagation for Cloud System Anomaly Detectionraises · addresses
Cross-node adversarial transferability in edge-deployed models2 papers raise it · 2 address it
Compromised edge devices can expose models, enabling adversarial attacks that transfer across other devices sharing the same model.
- Model Exposure on One Device Endangers Others: Rethinking Edge Neural Network Security across Devicesraises · addresses
- Mind Your Boundaries: Boundary-Aware Model Obfuscation against Cross-node Attackraises · addresses
Class imbalance and camouflaged fraud in financial anomaly detection1 paper raises it · 1 addresses it
Fraudulent transactions are rare and often disguised, making them hard to detect with standard methods.
- RGH-GNN : Risk-Gated Heterogeneous Graph Neural Network for Financial Fraud Detectionraises · addresses
Robustness to network traffic anomalies in IoT device fingerprinting1 paper raises it · 1 addresses it
Real-world IoT traffic is variable, and anomalies like packet drops or reordering degrade fingerprinting accuracy.
- Robust Lightweight IoT Device Fingerprinting Under Network Traffic Anomaliesraises · addresses

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

adversarial · based intrusion detection · network intrusion82 papers17 this week
anomaly detectors · anomaly detection · series anomaly detection113 papers11 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Coming with more sources: repos

Activity

Recent papers

All in Research →

arXiv cs.CROct 5
GCTAuto-encoder: A Cross modal Framework for Security Flaw Detection in IoT Networks
Najmieh Sadat Safarabadi
IoT encompasses diverse physical entities, from smart home devices to autonomous vehicles, creating a complex environment with heterogeneous security models. This heterogeneity makes IoT sub-systems vulnerable to various network attacks. Modern security systems must therefore be more robust to ensure security and privacy for IoT applications. A highly secure IoT system also demands real time insight, requiring data collection at the edge of the computing layer. This diversity calls for a unified security model applied at the foundational level. Edge intelligence offers a direct approach to handling device diversity. A key goal of edge intelligence in IoT is to extract insight from local data; security models can then use this data to build local node protections, and integrating AI models yields an advanced security solution. This research proposes a novel deep learning algorithm for effective intrusion detection at the edge, supported by a cloud-based IoT framework. We evaluate the proposed cross modal deep learning algorithm against baseline models. The contribution is a cross domain Deep Neural Network (DNN) algorithm for intrusion detection. The objective is to assess a…
PDF arXiv
arXiv cs.AIOct 5
Normality Constraint Learning: Adapting Foundation Models for Time Series Anomaly Detection
Xiaohui Zhou, Yijie Wang, Hongzuo Xu, Weixuan Liang, Guansong Pang
Time Series Foundation Models (TSFMs) achieve strong generalization by learning to reconstruct or forecast broad temporal patterns from large-scale time series during pre-training. Yet this strength can become a weakness for anomaly detection: TSFMs may model rare anomalous patterns as effectively as normal ones, allowing anomalies to be accurately reconstructed or forecasted and thus diminishing their reconstruction/forecasting error-based anomaly scores. This paper proposes $\underline{\textbf{N}}$$\textbf{ormality}$ $\underline{\textbf{C}}$$\textbf{onstraint}$ $\underline{\textbf{L}}$$\textbf{earning}$ ($\textbf{NCL}$), a lightweight plug-and-play framework that adapts pre-trained TSFMs for accurate anomaly detection without modifying their pre-trained parameters. Our key insight is to constrain the broad pattern space of TSFMs to the normal structure of a target time series, preventing their broad modeling capability from obscuring abnormal deviations. Specifically, NCL constructs a compact normality subspace from a few normal patch features and adaptively steers each patch feature toward normality within this subspace, guided by contrastive constraints that form compact and…
PDF arXiv
arXiv cs.LGOct 5
Anlu: Enabling In-Context Time Series Anomaly Detection in Foundation Models via Counterfactual Supervision
Tian Lan, Yifei Gao, Yimeng Lu, Xuming An, Meng Wang +3
Whether a time-series pattern is anomalous often depends on the operating regime of the monitored process. A missing event can signal a fault in one regime and be routine in another, and the query alone may not reveal which regime applies. We study in-context learning (ICL) for time series anomaly detection (TSAD) through reference-conditioned detection, where a reference record provides evidence about expected behavior and model parameters remain fixed at inference. Supplying the reference is not enough: when training anomalies are recognizable from the query alone, the detector can fit its targets while ignoring the reference. We therefore introduce counterfactual supervision, which pairs one query with two references that support different normal rules and labels the query under each. At positions where the two labels disagree, no detector that ignores the reference can fit both targets. Anlu learns from this supervision by adding a reference memory and zero-initialized gated adapters to a frozen time-series foundation model (TSFM) pretrained for anomaly detection. On the 350 TSB-AD-U evaluation sequences, Anlu raises the mean VUS-PR of the frozen TSFM from 0.542 to 0.607.…
PDF arXiv
arXiv cs.LGOct 5
Machine learning for journal entry testing: A type-aware evaluation of anomaly detectors under a review budget
Jan Gronewald, Michel Scherer, Nijat Mehdiyev
Journal entry anomaly detectors are commonly evaluated on the full population with ROC-AUC, precision and recall, ignoring the review budget and which anomaly types are found. We propose a type-aware evaluation combining per-type recall, fair-share type recall (FSR), which caps each type's credit at its budget share, type coverage and first-hit rank. We evaluate nine unsupervised detectors, a supervised reference and feedback-driven Deep Semi-Supervised Anomaly Detection (DeepSAD) on four real client ledgers with injected typed anomalies and a public synthetic ledger. On the largest client ledger, principal component analysis (PCA), an autoencoder (AE) and a variational autoencoder (VAE) each place on average 98 anomalies among the first 100 postings, but at least 95.8 belong to one type. FSR instead favours a nearest-neighbour (kNN) detector and changes the top-ranked detector on three of four client ledgers. Representation also matters: one-hot encoding exposes unseen accounts, whereas frequency encoding leaves unseen contra accounts largely undetected. On the public ledger, the Histogram-Based Outlier Score (HBOS) and Empirical Cumulative Distribution-Based Outlier Detection…
PDF arXiv
arXiv cs.LGOct 5
Feature identification for parameter extraction and defect detection using machine learning
Yan Guo, Helda Pahlavani, Artem Khachaturiants, Khalid Elsayed, Jakob van de Laar +3
Process control of advanced semiconductor nodes is not only pushing the limits of metrology equipment requirements in terms of resolution and throughput but also in terms of the richness of data to be extracted to enable engineers to finetune the process steps for increased yield. The move towards 3D structures requires extraction of critical dimension parameters from structures which can vary largely from layer to layer. For in-line process control, the necessary automation forces the development of layer and equipment-specific dedicated image processing algorithms. Similarly, with the increase in stochastic defects in the EUV era, detection of defects at the nm scale requires the identification of features captured in low resolution to meet the throughput requirements of HVM fabs, which can again lead to custom algorithm development. With the emergence of ML-based image processing methods, this process of algorithm development for both cases can be accelerated. In this work, we provide the general framework under which the images obtained from high-speed scanning probe microscopy-based systems can be used to train a network for either feature detection for parameter extraction…
PDF arXiv
arXiv cs.CROct 5
Online AutoML: Evaluating Poisoning Attacks on Cost-Utility Adversarial Training Defence Strategy for IoT Networks
Chukwunonso Henry Nwokoye, Khalil El-Khatib, Li Yang
Machine learning (ML)-powered poisoning attack vectors are adversarial maneuvers whereby an attacker intentionally inserts, corrupts, or alters training data to distort an ML model's learning process. The objective is to diminish model efficacy, instill biases, induce misclassifications, or include concealed backdoors that may be attacked during implementation. In streaming contexts, poisoning attacks pose significant risks since models perpetually update based on incoming streams of data. An assailant may incrementally introduce harmful samples into this data stream, leading the model to assimilate erroneous features over time without timely identification. Therefore, this study is aimed at evaluating the efficacy of the adversarial training (AT) defense approach against poisoning attacks (label flip and noise injection) using an online AutoML pipeline for Internet of Things (IoT) networks. Specifically, poisoning attacks (label flip and noise injection) were applied to streaming-capable AutoML learners (Hoeffding Tree (HT), Leveraging Bagging (LB), Adaptive Random Forest (ARF), Hoeffding Adaptive Tree (HAT), and Streaming Random Patches (SRP)). Under the strongest poisoning…
PDF arXiv

Papers

Topics in this field

adversarial · based intrusion detection · network intrusion82 papers17 this week
anomaly detectors · anomaly detection · series anomaly detection113 papers11 this week

Recent papers

All in Research →

arXiv cs.CROct 5
GCTAuto-encoder: A Cross modal Framework for Security Flaw Detection in IoT Networks
Najmieh Sadat Safarabadi
IoT encompasses diverse physical entities, from smart home devices to autonomous vehicles, creating a complex environment with heterogeneous security models. This heterogeneity makes IoT sub-systems vulnerable to various network attacks. Modern security systems must therefore be more robust to ensure security and privacy for IoT applications. A highly secure IoT system also demands real time insight, requiring data collection at the edge of the computing layer. This diversity calls for a unified security model applied at the foundational level. Edge intelligence offers a direct approach to handling device diversity. A key goal of edge intelligence in IoT is to extract insight from local data; security models can then use this data to build local node protections, and integrating AI models yields an advanced security solution. This research proposes a novel deep learning algorithm for effective intrusion detection at the edge, supported by a cloud-based IoT framework. We evaluate the proposed cross modal deep learning algorithm against baseline models. The contribution is a cross domain Deep Neural Network (DNN) algorithm for intrusion detection. The objective is to assess a…
PDF arXiv
arXiv cs.AIOct 5
Normality Constraint Learning: Adapting Foundation Models for Time Series Anomaly Detection
Xiaohui Zhou, Yijie Wang, Hongzuo Xu, Weixuan Liang, Guansong Pang
Time Series Foundation Models (TSFMs) achieve strong generalization by learning to reconstruct or forecast broad temporal patterns from large-scale time series during pre-training. Yet this strength can become a weakness for anomaly detection: TSFMs may model rare anomalous patterns as effectively as normal ones, allowing anomalies to be accurately reconstructed or forecasted and thus diminishing their reconstruction/forecasting error-based anomaly scores. This paper proposes $\underline{\textbf{N}}$$\textbf{ormality}$ $\underline{\textbf{C}}$$\textbf{onstraint}$ $\underline{\textbf{L}}$$\textbf{earning}$ ($\textbf{NCL}$), a lightweight plug-and-play framework that adapts pre-trained TSFMs for accurate anomaly detection without modifying their pre-trained parameters. Our key insight is to constrain the broad pattern space of TSFMs to the normal structure of a target time series, preventing their broad modeling capability from obscuring abnormal deviations. Specifically, NCL constructs a compact normality subspace from a few normal patch features and adaptively steers each patch feature toward normality within this subspace, guided by contrastive constraints that form compact and…
PDF arXiv
arXiv cs.LGOct 5
Anlu: Enabling In-Context Time Series Anomaly Detection in Foundation Models via Counterfactual Supervision
Tian Lan, Yifei Gao, Yimeng Lu, Xuming An, Meng Wang +3
Whether a time-series pattern is anomalous often depends on the operating regime of the monitored process. A missing event can signal a fault in one regime and be routine in another, and the query alone may not reveal which regime applies. We study in-context learning (ICL) for time series anomaly detection (TSAD) through reference-conditioned detection, where a reference record provides evidence about expected behavior and model parameters remain fixed at inference. Supplying the reference is not enough: when training anomalies are recognizable from the query alone, the detector can fit its targets while ignoring the reference. We therefore introduce counterfactual supervision, which pairs one query with two references that support different normal rules and labels the query under each. At positions where the two labels disagree, no detector that ignores the reference can fit both targets. Anlu learns from this supervision by adding a reference memory and zero-initialized gated adapters to a frozen time-series foundation model (TSFM) pretrained for anomaly detection. On the 350 TSB-AD-U evaluation sequences, Anlu raises the mean VUS-PR of the frozen TSFM from 0.542 to 0.607.…
PDF arXiv
arXiv cs.LGOct 5
Machine learning for journal entry testing: A type-aware evaluation of anomaly detectors under a review budget
Jan Gronewald, Michel Scherer, Nijat Mehdiyev
Journal entry anomaly detectors are commonly evaluated on the full population with ROC-AUC, precision and recall, ignoring the review budget and which anomaly types are found. We propose a type-aware evaluation combining per-type recall, fair-share type recall (FSR), which caps each type's credit at its budget share, type coverage and first-hit rank. We evaluate nine unsupervised detectors, a supervised reference and feedback-driven Deep Semi-Supervised Anomaly Detection (DeepSAD) on four real client ledgers with injected typed anomalies and a public synthetic ledger. On the largest client ledger, principal component analysis (PCA), an autoencoder (AE) and a variational autoencoder (VAE) each place on average 98 anomalies among the first 100 postings, but at least 95.8 belong to one type. FSR instead favours a nearest-neighbour (kNN) detector and changes the top-ranked detector on three of four client ledgers. Representation also matters: one-hot encoding exposes unseen accounts, whereas frequency encoding leaves unseen contra accounts largely undetected. On the public ledger, the Histogram-Based Outlier Score (HBOS) and Empirical Cumulative Distribution-Based Outlier Detection…
PDF arXiv
arXiv cs.LGOct 5
Feature identification for parameter extraction and defect detection using machine learning
Yan Guo, Helda Pahlavani, Artem Khachaturiants, Khalid Elsayed, Jakob van de Laar +3
Process control of advanced semiconductor nodes is not only pushing the limits of metrology equipment requirements in terms of resolution and throughput but also in terms of the richness of data to be extracted to enable engineers to finetune the process steps for increased yield. The move towards 3D structures requires extraction of critical dimension parameters from structures which can vary largely from layer to layer. For in-line process control, the necessary automation forces the development of layer and equipment-specific dedicated image processing algorithms. Similarly, with the increase in stochastic defects in the EUV era, detection of defects at the nm scale requires the identification of features captured in low resolution to meet the throughput requirements of HVM fabs, which can again lead to custom algorithm development. With the emergence of ML-based image processing methods, this process of algorithm development for both cases can be accelerated. In this work, we provide the general framework under which the images obtained from high-speed scanning probe microscopy-based systems can be used to train a network for either feature detection for parameter extraction…
PDF arXiv
arXiv cs.CROct 5
Online AutoML: Evaluating Poisoning Attacks on Cost-Utility Adversarial Training Defence Strategy for IoT Networks
Chukwunonso Henry Nwokoye, Khalil El-Khatib, Li Yang
Machine learning (ML)-powered poisoning attack vectors are adversarial maneuvers whereby an attacker intentionally inserts, corrupts, or alters training data to distort an ML model's learning process. The objective is to diminish model efficacy, instill biases, induce misclassifications, or include concealed backdoors that may be attacked during implementation. In streaming contexts, poisoning attacks pose significant risks since models perpetually update based on incoming streams of data. An assailant may incrementally introduce harmful samples into this data stream, leading the model to assimilate erroneous features over time without timely identification. Therefore, this study is aimed at evaluating the efficacy of the adversarial training (AT) defense approach against poisoning attacks (label flip and noise injection) using an online AutoML pipeline for Internet of Things (IoT) networks. Specifically, poisoning attacks (label flip and noise injection) were applied to streaming-capable AutoML learners (Hoeffding Tree (HT), Leveraging Bagging (LB), Adaptive Random Forest (ARF), Hoeffding Adaptive Tree (HAT), and Streaming Random Patches (SRP)). Under the strongest poisoning…
PDF arXiv

Active contributors · 90 days

Activity · 12 weeks

Coming with more sources: repos

Fields · AI · updated 1m ago

Anomaly detectors

Found by the topic model: anomaly detectors, adversarial.

28papers this week−34.9% vs last week

All papers · 195 With code · 1

Newest Most relevant

177 papers this month

Open problems in Anomaly detectors

Lack of strong deep representations for tabular anomaly detection1 paper raises it · 1 addresses it
Deep features underperform on tabular data due to weak or unavailable representations, limiting anomaly detection effectiveness.
- Adapting prior-data fitted networks for tabular anomaly detectionraises · addresses
Handling heterogeneous and misaligned multimodal data in anomaly detection2 papers raise it · 2 address it
Real-world systems produce multimodal data with semantic gaps and asynchronous dependencies, making robust anomaly detection difficult.
- Physical-Variable-Informed Deep Learning for Robust Diagnosis in Industrial Fluid Transport Systemsraises · addresses
- BEACON: Bridging Multimodal Semantics and Asynchronous Propagation for Cloud System Anomaly Detectionraises · addresses
Cross-node adversarial transferability in edge-deployed models2 papers raise it · 2 address it
Compromised edge devices can expose models, enabling adversarial attacks that transfer across other devices sharing the same model.
- Model Exposure on One Device Endangers Others: Rethinking Edge Neural Network Security across Devicesraises · addresses
- Mind Your Boundaries: Boundary-Aware Model Obfuscation against Cross-node Attackraises · addresses
Class imbalance and camouflaged fraud in financial anomaly detection1 paper raises it · 1 addresses it
Fraudulent transactions are rare and often disguised, making them hard to detect with standard methods.
- RGH-GNN : Risk-Gated Heterogeneous Graph Neural Network for Financial Fraud Detectionraises · addresses
Robustness to network traffic anomalies in IoT device fingerprinting1 paper raises it · 1 addresses it
Real-world IoT traffic is variable, and anomalies like packet drops or reordering degrade fingerprinting accuracy.
- Robust Lightweight IoT Device Fingerprinting Under Network Traffic Anomaliesraises · addresses

Named by an AI from these papers' abstracts.