Papers

Field

Top tools here

Open problems in Anomaly detectors

Lack of strong deep representations for tabular anomaly detection1 paper raises it · 1 addresses it
Deep features underperform on tabular data due to weak or unavailable representations, limiting anomaly detection effectiveness.
- Adapting prior-data fitted networks for tabular anomaly detectionraises · addresses
Handling heterogeneous and misaligned multimodal data in anomaly detection2 papers raise it · 2 address it
Real-world systems produce multimodal data with semantic gaps and asynchronous dependencies, making robust anomaly detection difficult.
- Physical-Variable-Informed Deep Learning for Robust Diagnosis in Industrial Fluid Transport Systemsraises · addresses
- BEACON: Bridging Multimodal Semantics and Asynchronous Propagation for Cloud System Anomaly Detectionraises · addresses
Cross-node adversarial transferability in edge-deployed models2 papers raise it · 2 address it
Compromised edge devices can expose models, enabling adversarial attacks that transfer across other devices sharing the same model.
- Model Exposure on One Device Endangers Others: Rethinking Edge Neural Network Security across Devicesraises · addresses
- Mind Your Boundaries: Boundary-Aware Model Obfuscation against Cross-node Attackraises · addresses
Class imbalance and camouflaged fraud in financial anomaly detection1 paper raises it · 1 addresses it
Fraudulent transactions are rare and often disguised, making them hard to detect with standard methods.
- RGH-GNN : Risk-Gated Heterogeneous Graph Neural Network for Financial Fraud Detectionraises · addresses
Robustness to network traffic anomalies in IoT device fingerprinting1 paper raises it · 1 addresses it
Real-world IoT traffic is variable, and anomalies like packet drops or reordering degrade fingerprinting accuracy.
- Robust Lightweight IoT Device Fingerprinting Under Network Traffic Anomaliesraises · addresses

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

adversarial · based intrusion detection · network intrusion82 papers17 this week
anomaly detectors · anomaly detection · series anomaly detection113 papers11 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Coming with more sources: repos

Activity

Recent papers

All in Research →

arXiv cs.DBOct 5
Protocol-Sensitive Evaluation of Log Anomaly Detection: Component Costs and Target-Access Sensitivity on HDFS and BGL
Hang Xiao, Janet Sung, Zhaoyi Li, Gangzhen Qian, Chuhong Xu
Protocol choices can change the conclusions drawn from log anomaly detection benchmarks even when detector settings are fixed. We present a joint empirical study of split construction, representation visibility, and component costs using six fixed count, sequence, and semantic configurations on Hadoop Distributed File System (HDFS) and Blue Gene/L (BGL) logs. Random splits place several configurations near the average-precision ceiling, whereas group-disjoint HDFS and chronological BGL evaluation produce lower scores and different observed orderings. At a fixed BGL cutoff, parser choice spans 0.124 in semantic XGBoost mean average precision while preserving its lead over count XGBoost; the earliest rolling period reverses that ordering. A two-factor cross-system ablation contrasts source-only representations with offline transductive access to unlabeled target templates through the representation corpus and inverse document frequency: HDFS-to-BGL mean average precision moves from 0.191 with source-only access to 0.325 with union-corpus, target-IDF access, and the intermediate conditions reveal direction-dependent interactions in average precision and retrieval at fixed review…
PDF arXiv
arXiv cs.CROct 4
AutoDP-LLM: Automating Data Pre-processing for Intrusion Detection Systems using Large Language Models
Bao-Phong Nguyen, Gia-Khanh Pham, Thai-Duong Do, Mai Xuan Trang, Minh-Tuan Le +5
The increasing complexity and scale of modern cyber-attacks demand intelligent and computationally efficient Intrusion Detection Systems (IDS). However, designing effective data pre-processing pipelines traditionally involves substantial trial-and-error effort and repeated evaluation of alternative configurations. For large, high-dimensional network traffic data, this process can create a significant computational burden. In this work, we propose AutoDP-LLM, an automated pre-processing framework designed to reduce manual pipeline development and computational overhead. Specifically, AutoDP-LLM leverages Large Language Models (LLMs) to autonomously generate and validate executable data pre-processing pipelines. The framework combines deterministic host-side planning with LLM-based specialist agents to formulate data-processing strategies, synthesize executable code, and adaptively determine retained feature sets using semantic reasoning and training-derived statistical evidence, without requiring a predefined feature budget. Focusing on multiclass intrusion detection, we evaluate AutoDP-LLM on the UNSW-NB15 and NSL-KDD benchmark datasets using multiple downstream classifiers.…
PDF arXiv
arXiv cs.CVOct 4
Anchor and Adapt: Asymmetric Prompt Adaptation for Few-Shot Industrial Anomaly Detection
Mengyang Zhao, Teng Fu, Haiyang Yu, Ke Niu, Bin Li +1
In few-shot industrial anomaly detection, the few normal target images provide no direct defect supervision, making anomaly prompts difficult to learn from these samples alone. Some vision-language methods therefore use manually specified descriptions to supply explicit anomaly semantics. However, constructing these descriptions requires product-specific effort, and their effectiveness depends on prompt selection. We propose Anchor and Adapt, a two-stage prompt learning framework that separates the acquisition of anomaly semantics from adaptation to target normal appearance. Stage I learns transferable normal and abnormal anchors from annotated auxiliary data. Stage II keeps these anchors fixed and adapts an additional normal branch using the few target normal samples. The inherited and adapted normal branches jointly characterize target normality, with text-anchor regularization encouraging consistency with the generic normal prior and separation from the abnormal anchors. This design retains learned anomaly knowledge while reducing dependence on category-specific anomaly templates, without requiring synthetic anomaly generation. Cross-dataset experiments between MVTec-AD and…
PDF arXiv
arXiv cs.CVOct 4
RoMod: Temporal Routing Modulation via Mixture-of-Experts for Video Anomaly Detection
Chao Huang, Pengfei Wei, Benfeng Wang, Chengliang Liu, Wei Wang +3
Intermediate-layer features from multimodal large language models have shown strong potential for video anomaly detection (VAD), yet the origin of their discriminative power remains unclear. We study this question using sparse mixture-of-experts (MoE) models, whose explicit expert structure and sparse activation make their internal computation easier to inspect. With a fully frozen backbone and no additional training, we find that anomaly-related evidence is concentrated in a small set of experts. These experts recur across layers, spontaneously specialize in different anomaly types, and together form a dynamic routing subnetwork. We further show that the output channels most strongly influenced by these experts are also the hidden dimensions that contain the most anomaly-relevant information. Routing statistics can therefore serve as an internal anomaly cue that complements semantic features.Based on these findings, we propose RoMod, an efficient VAD framework trained with only \(5\%\) of weakly labeled videos. RoMod includes a Routing-Modulated Fusion module, RoMF, and a Routing-aware Temporal Network, RoTN. RoMF uses routing signals to adaptively recalibrate hidden semantic…
PDF arXiv
arXiv cs.CVOct 4
Representation--Behavior Alignment for Explainable Weakly-Supervised Video Anomaly Detection
Chao Huang, Pengfei Wei, Kaige Li, Chengliang Liu, Wei Wang +2
Multimodal Large Language Models (MLLMs) provide a natural way to make video anomaly detection more explainable. However, their final decisions do not always fully use the discriminative information contained in their hidden states, an issue we refer to as representation--behavior misalignment. We decompose this gap into a capacity component that measures discriminative information never aggregated into the readout position, and a directional component that measures the angular mismatch between the optimal and the native normal--abnormal axis at that position. Across multiple video anomaly detection benchmarks and MLLM backbones the directional component dominates, and residual-stream tracing shows that native-axis separability rises sharply in several mid-to-late attention layers. Because both components are governed by attention rather than MLP updates, we propose Representation--Behavior Alignment (RBA), a parameter-efficient method that adapts those layers using video-level labels alone while updating about 0.012\% of the backbone parameters. Experiments on three benchmarks show that RBA improves native-readout performance and better aligns the model's decision direction with…
PDF arXiv
arXiv cs.LGOct 4
A Data-Driven Framework for Unsupervised Monitoring of Transmission Systems Using End-of-Line Testing Data: A Case Study at Ford Motor Company
Mohammad N. Bisheh, Mehrdad Moradi, Parinaz Farajiparvar, Colin Brady, Rajesh Gupta +4
Sensing technologies have advanced rapidly across industries ranging from energy to automotive manufacturing. These systems generate high-dimensional (HD) data characterized by complex nonlinear patterns and strong temporal dependencies. Traditional statistical monitoring methods are often limited in their ability to capture such nonlinear structure. Likewise, many analytical approaches used in End-of-Line testing rely on predefined thresholds and heuristic rules, which restrict their ability to detect informative anomaly signatures in HD temporal data. In contrast, while modern deep learning and generative AI models offer strong predictive capabilities, they are often unsuitable in applications where data are costly to collect and where the monitoring system must remain interpretable, low-latency, computationally efficient, and usable by non-technical practitioners. To overcome these limitations, we propose an advanced multivariate monitoring framework for HD data. The framework operates in two stages. In the first stage, the data are preprocessed to remove incomplete and non-informative samples and to temporally align time series data. In the second stage, nonlinear…
PDF arXiv

Papers

Topics in this field

adversarial · based intrusion detection · network intrusion82 papers17 this week
anomaly detectors · anomaly detection · series anomaly detection113 papers11 this week

Recent papers

All in Research →

arXiv cs.DBOct 5
Protocol-Sensitive Evaluation of Log Anomaly Detection: Component Costs and Target-Access Sensitivity on HDFS and BGL
Hang Xiao, Janet Sung, Zhaoyi Li, Gangzhen Qian, Chuhong Xu
Protocol choices can change the conclusions drawn from log anomaly detection benchmarks even when detector settings are fixed. We present a joint empirical study of split construction, representation visibility, and component costs using six fixed count, sequence, and semantic configurations on Hadoop Distributed File System (HDFS) and Blue Gene/L (BGL) logs. Random splits place several configurations near the average-precision ceiling, whereas group-disjoint HDFS and chronological BGL evaluation produce lower scores and different observed orderings. At a fixed BGL cutoff, parser choice spans 0.124 in semantic XGBoost mean average precision while preserving its lead over count XGBoost; the earliest rolling period reverses that ordering. A two-factor cross-system ablation contrasts source-only representations with offline transductive access to unlabeled target templates through the representation corpus and inverse document frequency: HDFS-to-BGL mean average precision moves from 0.191 with source-only access to 0.325 with union-corpus, target-IDF access, and the intermediate conditions reveal direction-dependent interactions in average precision and retrieval at fixed review…
PDF arXiv
arXiv cs.CROct 4
AutoDP-LLM: Automating Data Pre-processing for Intrusion Detection Systems using Large Language Models
Bao-Phong Nguyen, Gia-Khanh Pham, Thai-Duong Do, Mai Xuan Trang, Minh-Tuan Le +5
The increasing complexity and scale of modern cyber-attacks demand intelligent and computationally efficient Intrusion Detection Systems (IDS). However, designing effective data pre-processing pipelines traditionally involves substantial trial-and-error effort and repeated evaluation of alternative configurations. For large, high-dimensional network traffic data, this process can create a significant computational burden. In this work, we propose AutoDP-LLM, an automated pre-processing framework designed to reduce manual pipeline development and computational overhead. Specifically, AutoDP-LLM leverages Large Language Models (LLMs) to autonomously generate and validate executable data pre-processing pipelines. The framework combines deterministic host-side planning with LLM-based specialist agents to formulate data-processing strategies, synthesize executable code, and adaptively determine retained feature sets using semantic reasoning and training-derived statistical evidence, without requiring a predefined feature budget. Focusing on multiclass intrusion detection, we evaluate AutoDP-LLM on the UNSW-NB15 and NSL-KDD benchmark datasets using multiple downstream classifiers.…
PDF arXiv
arXiv cs.CVOct 4
Anchor and Adapt: Asymmetric Prompt Adaptation for Few-Shot Industrial Anomaly Detection
Mengyang Zhao, Teng Fu, Haiyang Yu, Ke Niu, Bin Li +1
In few-shot industrial anomaly detection, the few normal target images provide no direct defect supervision, making anomaly prompts difficult to learn from these samples alone. Some vision-language methods therefore use manually specified descriptions to supply explicit anomaly semantics. However, constructing these descriptions requires product-specific effort, and their effectiveness depends on prompt selection. We propose Anchor and Adapt, a two-stage prompt learning framework that separates the acquisition of anomaly semantics from adaptation to target normal appearance. Stage I learns transferable normal and abnormal anchors from annotated auxiliary data. Stage II keeps these anchors fixed and adapts an additional normal branch using the few target normal samples. The inherited and adapted normal branches jointly characterize target normality, with text-anchor regularization encouraging consistency with the generic normal prior and separation from the abnormal anchors. This design retains learned anomaly knowledge while reducing dependence on category-specific anomaly templates, without requiring synthetic anomaly generation. Cross-dataset experiments between MVTec-AD and…
PDF arXiv
arXiv cs.CVOct 4
RoMod: Temporal Routing Modulation via Mixture-of-Experts for Video Anomaly Detection
Chao Huang, Pengfei Wei, Benfeng Wang, Chengliang Liu, Wei Wang +3
Intermediate-layer features from multimodal large language models have shown strong potential for video anomaly detection (VAD), yet the origin of their discriminative power remains unclear. We study this question using sparse mixture-of-experts (MoE) models, whose explicit expert structure and sparse activation make their internal computation easier to inspect. With a fully frozen backbone and no additional training, we find that anomaly-related evidence is concentrated in a small set of experts. These experts recur across layers, spontaneously specialize in different anomaly types, and together form a dynamic routing subnetwork. We further show that the output channels most strongly influenced by these experts are also the hidden dimensions that contain the most anomaly-relevant information. Routing statistics can therefore serve as an internal anomaly cue that complements semantic features.Based on these findings, we propose RoMod, an efficient VAD framework trained with only \(5\%\) of weakly labeled videos. RoMod includes a Routing-Modulated Fusion module, RoMF, and a Routing-aware Temporal Network, RoTN. RoMF uses routing signals to adaptively recalibrate hidden semantic…
PDF arXiv
arXiv cs.CVOct 4
Representation--Behavior Alignment for Explainable Weakly-Supervised Video Anomaly Detection
Chao Huang, Pengfei Wei, Kaige Li, Chengliang Liu, Wei Wang +2
Multimodal Large Language Models (MLLMs) provide a natural way to make video anomaly detection more explainable. However, their final decisions do not always fully use the discriminative information contained in their hidden states, an issue we refer to as representation--behavior misalignment. We decompose this gap into a capacity component that measures discriminative information never aggregated into the readout position, and a directional component that measures the angular mismatch between the optimal and the native normal--abnormal axis at that position. Across multiple video anomaly detection benchmarks and MLLM backbones the directional component dominates, and residual-stream tracing shows that native-axis separability rises sharply in several mid-to-late attention layers. Because both components are governed by attention rather than MLP updates, we propose Representation--Behavior Alignment (RBA), a parameter-efficient method that adapts those layers using video-level labels alone while updating about 0.012\% of the backbone parameters. Experiments on three benchmarks show that RBA improves native-readout performance and better aligns the model's decision direction with…
PDF arXiv
arXiv cs.LGOct 4
A Data-Driven Framework for Unsupervised Monitoring of Transmission Systems Using End-of-Line Testing Data: A Case Study at Ford Motor Company
Mohammad N. Bisheh, Mehrdad Moradi, Parinaz Farajiparvar, Colin Brady, Rajesh Gupta +4
Sensing technologies have advanced rapidly across industries ranging from energy to automotive manufacturing. These systems generate high-dimensional (HD) data characterized by complex nonlinear patterns and strong temporal dependencies. Traditional statistical monitoring methods are often limited in their ability to capture such nonlinear structure. Likewise, many analytical approaches used in End-of-Line testing rely on predefined thresholds and heuristic rules, which restrict their ability to detect informative anomaly signatures in HD temporal data. In contrast, while modern deep learning and generative AI models offer strong predictive capabilities, they are often unsuitable in applications where data are costly to collect and where the monitoring system must remain interpretable, low-latency, computationally efficient, and usable by non-technical practitioners. To overcome these limitations, we propose an advanced multivariate monitoring framework for HD data. The framework operates in two stages. In the first stage, the data are preprocessed to remove incomplete and non-informative samples and to temporally align time series data. In the second stage, nonlinear…
PDF arXiv

Active contributors · 90 days

Activity · 12 weeks

Coming with more sources: repos

Fields · AI · updated 34m ago

Anomaly detectors

Found by the topic model: anomaly detectors, adversarial.

28papers this week−34.9% vs last week

All papers · 195 With code · 1

Newest Most relevant

177 papers this month

Open problems in Anomaly detectors

Lack of strong deep representations for tabular anomaly detection1 paper raises it · 1 addresses it
Deep features underperform on tabular data due to weak or unavailable representations, limiting anomaly detection effectiveness.
- Adapting prior-data fitted networks for tabular anomaly detectionraises · addresses
Handling heterogeneous and misaligned multimodal data in anomaly detection2 papers raise it · 2 address it
Real-world systems produce multimodal data with semantic gaps and asynchronous dependencies, making robust anomaly detection difficult.
- Physical-Variable-Informed Deep Learning for Robust Diagnosis in Industrial Fluid Transport Systemsraises · addresses
- BEACON: Bridging Multimodal Semantics and Asynchronous Propagation for Cloud System Anomaly Detectionraises · addresses
Cross-node adversarial transferability in edge-deployed models2 papers raise it · 2 address it
Compromised edge devices can expose models, enabling adversarial attacks that transfer across other devices sharing the same model.
- Model Exposure on One Device Endangers Others: Rethinking Edge Neural Network Security across Devicesraises · addresses
- Mind Your Boundaries: Boundary-Aware Model Obfuscation against Cross-node Attackraises · addresses
Class imbalance and camouflaged fraud in financial anomaly detection1 paper raises it · 1 addresses it
Fraudulent transactions are rare and often disguised, making them hard to detect with standard methods.
- RGH-GNN : Risk-Gated Heterogeneous Graph Neural Network for Financial Fraud Detectionraises · addresses
Robustness to network traffic anomalies in IoT device fingerprinting1 paper raises it · 1 addresses it
Real-world IoT traffic is variable, and anomalies like packet drops or reordering degrade fingerprinting accuracy.
- Robust Lightweight IoT Device Fingerprinting Under Network Traffic Anomaliesraises · addresses

Named by an AI from these papers' abstracts.