Papers

Field

Top tools here

Open problems in Anomaly detectors

Data heterogeneity in federated anomaly detection2 papers raise it · 2 address it
Non-IID data across clients degrades model accuracy and training stability in collaborative settings like malware or ransomware detection.
- Federated Learning for Malware Image Classification under Data Heterogeneityraises · addresses
- AdaFedXplain: Adaptive Federated Learning with Explainable AI for Ransomware Detectionraises · addresses
Lack of strong deep representations for tabular anomaly detection1 paper raises it · 2 address it
Deep learning has had limited impact on tabular anomaly detection due to weak or unavailable deep features.
- Adapting prior-data fitted networks for tabular anomaly detectionraises · addresses
- Universal Semantic Enhancement for Weakly Supervised Anomaly Detectionaddresses
Evaluation bias from recording or dataset artifacts1 paper raises it · 1 addresses it
Benchmark datasets may contain spurious signals (e.g., recording differences) that inflate performance and mislead model comparisons.
- Recording-Aware Evaluation of Multimodal OT Intrusion Detectionraises · addresses
Scalability and efficiency in real-time anomaly detection1 paper raises it · 1 addresses it
Real-world deployments require low-latency, high-throughput processing, especially in multi-site or edge-cloud systems.
- YUTELA: A Scalable Edge Cloud AIoT System for Multi-Site Video Anomaly Detection with Scene Specific Adaptationraises · addresses
Explainability and interpretability in federated anomaly detection1 paper raises it · 1 addresses it
Federated learning models often lack transparency, making it hard to trust or debug decisions in critical applications like ransomware detection.
- AdaFedXplain: Adaptive Federated Learning with Explainable AI for Ransomware Detectionraises · addresses

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

anomaly detectors · anomaly detection · series anomaly detection110 papers13 this week
adversarial · based intrusion detection · network intrusion74 papers10 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Coming with more sources: repos

Activity

Recent papers

All in Research →

arXiv cs.LGOct 17
CARTA: Self-Supervised Reusable Transaction Embeddings via Heterogeneous Tokenization and Cross-Attention
Shreyas K. Chandrahas, Jose Munoz, Satish Babu Bellapu
Acquiring fraud labels for payment transactions is expensive and inconsistent across tasks, and high-cardinality identifiers such as merchant names make one-hot feature pipelines infeasible at scale. We present CARTA, a self-supervised encoder that learns a compact 16-dim embedding from raw transactions without labels; the frozen embedding is then reused for label-efficient fraud probing and exploratory unsupervised risk stratification without retraining the encoder. CARTA uses type-specific projections with learned embedding tables for high-cardinality identifiers, trained with token excision and InfoNCE contrastive loss. On IEEE-CIS, its linear probe at 1% of labels exceeds a raw-feature probe at 100%; on IBM TabFormer (2M rows), its frozen embedding reaches GBDT AUPRC 0.508, above frequency encoding (0.411) and the merchant-dropping baseline (0.022), though fully-supervised CatBoost is stronger. CARTA is a label-free, reusable representation that complements task-specific supervised models.
PDF arXiv
arXiv cs.CROct 16
Recording-Aware Evaluation of Multimodal OT Intrusion Detection
Mustafa Umut Ozbek, Khalil El-Khatib, Li Yang
Machine-learning-based intrusion detection systems (IDSs) for operational technology (OT) are commonly evaluated on benchmark datasets in which normal and attack data are collected in separate recordings. In such settings, high performance may reflect recording-associated differences as well as attack behavior. We introduce a recording-aware evaluation procedure that compares attack windows with background from the same recording, uses prior data for model fitting and calibration, tests temporal alignment against randomized event schedules, and reports event coverage together with alarm burden. On the ProvICS multimodal dataset, cyber modalities strongly distinguish the benign and attack recordings before the first labeled attack. Same-recording evaluation reverses the apparent modality ranking across all studied window sizes: the physical view becomes the strongest individual modality, while cyber-only fusion shows the largest difference between cross-recording and same-recording AUC, reaching 0.54. Operational analysis further shows that permissive event-overlap metrics can overstate detection when a small number of long alarm episodes cover multiple actions. An external…
PDF arXiv
arXiv cs.LGOct 16
Universal Semantic Enhancement for Weakly Supervised Anomaly Detection
Siyu Zhou, Yuqin Xie, Hao Yuan, Yingjie Zhou
Weakly supervised anomaly detection on tabular data is an essential task in many label-scarce applications, since tabular data is widely encountered and it is commonly observed in practice that only a limited number of labeled anomalies are available alongside abundant unlabeled samples. Most existing methods try to learn features that capture the inherent distribution patterns in the target domain. However, such features often struggle to provide a complete description of possible abnormal characteristics and are highly susceptible to overfitting the extremely scarce labels. To address this challenge, we propose a weakly supervised anomaly detection method based on universal semantic enhancement for tabular data, which fuses the universal knowledge from a pre-trained tabular foundation model with the domain-specific knowledge learned on the target dataset. The two types of knowledge are naturally complementary: universal semantics describe the common patterns of tabular data across domains, while the domain-specific features capture the inherent distributions of normal and anomalous behaviors in the target dataset. A prototype-conditioned modulation mechanism is then designed to…
PDF arXiv
arXiv cs.LGOct 16
What Remains Without Test Labels? Re-evaluating a Graph-Level Anomaly Detection Benchmark
Yujie Lu, Da Yan
Graph-level anomaly detectors are trained only on normal graphs, yet benchmarks may use test labels for model selection. We examine whether UB-GOLD results reused by later papers support label-free detection. We audit UB-GOLD and 14 GLAD code bases, re-run 21 detectors on UB-GOLD's folds under selection rules with and without test labels, and evaluate sensitivity to known structural changes. Test labels select checkpoints in UB-GOLD's shared training loop and checkpoints or hyperparameters in 8 of the 14 code bases. UB-GOLD also evaluates its kernel baselines against misaligned labels. Across nine datasets, selecting checkpoints by test AUROC adds an average of 5.12 AUROC points [3.97, 6.24] for the 12 UB-GOLD detectors relative to the final checkpoint and 4.13 [3.32, 4.79] relative to held-out normal graphs. In a post hoc permutation analysis with no truly better checkpoint, picking the best of noisy test evaluations still yields a gain more than half as large as the one observed against the final checkpoint. Configurations tuned on test labels score a further 1.53 points [0.64, 2.42] above repository defaults, a gap that mixes the value of test labels with that of tuning…
PDF arXiv
arXiv cs.SIOct 16
Graphlet-based Decentralized Finance Transaction Method Classification
Célestin Coquidé, Alessio Brini, Natkamon Tovanich
Decentralized Finance (DeFi) transactions involve complex interactions among accounts, smart contracts, and tokens. We investigate whether network topology can identify transaction methods that describe DeFi operations. We extract directed graphlet features to classify the 30 most frequent methods. Our results show that graphlet features complement event log counts in improving classification performance. Using SHapley Additive exPlanations (SHAP), we further derive model explanations that reveal method-specific graphlet structural patterns.
PDF arXiv
arXiv cs.CVOct 16
Knowledge-Guided Distributional Prompt Learning with Visual Hierarchy for Zero-Shot Anomaly Detection
Jiyul Ham, Seongho Yoon, Yonggon Jung, Sangjae Lee, Jun-Geol Baek
Zero-shot anomaly detection (ZSAD) aims to detect anomalies in previously unseen classes using auxiliary images, with applications such as industrial visual inspection and medical imaging. Recent vision-language-model-based approaches improve ZSAD by aligning textual and visual representations, while distributional prompting further models prompt variability for unseen categories. However, existing methods do not explicitly combine normality-referenced distributional modeling with hierarchy-specific prompt specialization, limiting their ability to model anomalous semantics relative to normality while addressing both image-level detection and fine-grained localization. We propose Hierarchical Knowledge-Guided Distributional Prompt Learning (HiDist), a normality-referenced hierarchical distributional prompt framework for ZSAD. HiDist models each prompt token with a diagonal Gaussian distribution and generates stochastic prompt variations through Monte Carlo sampling. Rather than learning normal and anomalous distributions independently, anomalous prompt distributions are parameterized as deviations from learned normal references, explicitly encoding their dependency. The resulting…
PDF arXiv

Papers

Topics in this field

anomaly detectors · anomaly detection · series anomaly detection110 papers13 this week
adversarial · based intrusion detection · network intrusion74 papers10 this week

Recent papers

All in Research →

arXiv cs.LGOct 17
CARTA: Self-Supervised Reusable Transaction Embeddings via Heterogeneous Tokenization and Cross-Attention
Shreyas K. Chandrahas, Jose Munoz, Satish Babu Bellapu
Acquiring fraud labels for payment transactions is expensive and inconsistent across tasks, and high-cardinality identifiers such as merchant names make one-hot feature pipelines infeasible at scale. We present CARTA, a self-supervised encoder that learns a compact 16-dim embedding from raw transactions without labels; the frozen embedding is then reused for label-efficient fraud probing and exploratory unsupervised risk stratification without retraining the encoder. CARTA uses type-specific projections with learned embedding tables for high-cardinality identifiers, trained with token excision and InfoNCE contrastive loss. On IEEE-CIS, its linear probe at 1% of labels exceeds a raw-feature probe at 100%; on IBM TabFormer (2M rows), its frozen embedding reaches GBDT AUPRC 0.508, above frequency encoding (0.411) and the merchant-dropping baseline (0.022), though fully-supervised CatBoost is stronger. CARTA is a label-free, reusable representation that complements task-specific supervised models.
PDF arXiv
arXiv cs.CROct 16
Recording-Aware Evaluation of Multimodal OT Intrusion Detection
Mustafa Umut Ozbek, Khalil El-Khatib, Li Yang
Machine-learning-based intrusion detection systems (IDSs) for operational technology (OT) are commonly evaluated on benchmark datasets in which normal and attack data are collected in separate recordings. In such settings, high performance may reflect recording-associated differences as well as attack behavior. We introduce a recording-aware evaluation procedure that compares attack windows with background from the same recording, uses prior data for model fitting and calibration, tests temporal alignment against randomized event schedules, and reports event coverage together with alarm burden. On the ProvICS multimodal dataset, cyber modalities strongly distinguish the benign and attack recordings before the first labeled attack. Same-recording evaluation reverses the apparent modality ranking across all studied window sizes: the physical view becomes the strongest individual modality, while cyber-only fusion shows the largest difference between cross-recording and same-recording AUC, reaching 0.54. Operational analysis further shows that permissive event-overlap metrics can overstate detection when a small number of long alarm episodes cover multiple actions. An external…
PDF arXiv
arXiv cs.LGOct 16
Universal Semantic Enhancement for Weakly Supervised Anomaly Detection
Siyu Zhou, Yuqin Xie, Hao Yuan, Yingjie Zhou
Weakly supervised anomaly detection on tabular data is an essential task in many label-scarce applications, since tabular data is widely encountered and it is commonly observed in practice that only a limited number of labeled anomalies are available alongside abundant unlabeled samples. Most existing methods try to learn features that capture the inherent distribution patterns in the target domain. However, such features often struggle to provide a complete description of possible abnormal characteristics and are highly susceptible to overfitting the extremely scarce labels. To address this challenge, we propose a weakly supervised anomaly detection method based on universal semantic enhancement for tabular data, which fuses the universal knowledge from a pre-trained tabular foundation model with the domain-specific knowledge learned on the target dataset. The two types of knowledge are naturally complementary: universal semantics describe the common patterns of tabular data across domains, while the domain-specific features capture the inherent distributions of normal and anomalous behaviors in the target dataset. A prototype-conditioned modulation mechanism is then designed to…
PDF arXiv
arXiv cs.LGOct 16
What Remains Without Test Labels? Re-evaluating a Graph-Level Anomaly Detection Benchmark
Yujie Lu, Da Yan
Graph-level anomaly detectors are trained only on normal graphs, yet benchmarks may use test labels for model selection. We examine whether UB-GOLD results reused by later papers support label-free detection. We audit UB-GOLD and 14 GLAD code bases, re-run 21 detectors on UB-GOLD's folds under selection rules with and without test labels, and evaluate sensitivity to known structural changes. Test labels select checkpoints in UB-GOLD's shared training loop and checkpoints or hyperparameters in 8 of the 14 code bases. UB-GOLD also evaluates its kernel baselines against misaligned labels. Across nine datasets, selecting checkpoints by test AUROC adds an average of 5.12 AUROC points [3.97, 6.24] for the 12 UB-GOLD detectors relative to the final checkpoint and 4.13 [3.32, 4.79] relative to held-out normal graphs. In a post hoc permutation analysis with no truly better checkpoint, picking the best of noisy test evaluations still yields a gain more than half as large as the one observed against the final checkpoint. Configurations tuned on test labels score a further 1.53 points [0.64, 2.42] above repository defaults, a gap that mixes the value of test labels with that of tuning…
PDF arXiv
arXiv cs.SIOct 16
Graphlet-based Decentralized Finance Transaction Method Classification
Célestin Coquidé, Alessio Brini, Natkamon Tovanich
Decentralized Finance (DeFi) transactions involve complex interactions among accounts, smart contracts, and tokens. We investigate whether network topology can identify transaction methods that describe DeFi operations. We extract directed graphlet features to classify the 30 most frequent methods. Our results show that graphlet features complement event log counts in improving classification performance. Using SHapley Additive exPlanations (SHAP), we further derive model explanations that reveal method-specific graphlet structural patterns.
PDF arXiv
arXiv cs.CVOct 16
Knowledge-Guided Distributional Prompt Learning with Visual Hierarchy for Zero-Shot Anomaly Detection
Jiyul Ham, Seongho Yoon, Yonggon Jung, Sangjae Lee, Jun-Geol Baek
Zero-shot anomaly detection (ZSAD) aims to detect anomalies in previously unseen classes using auxiliary images, with applications such as industrial visual inspection and medical imaging. Recent vision-language-model-based approaches improve ZSAD by aligning textual and visual representations, while distributional prompting further models prompt variability for unseen categories. However, existing methods do not explicitly combine normality-referenced distributional modeling with hierarchy-specific prompt specialization, limiting their ability to model anomalous semantics relative to normality while addressing both image-level detection and fine-grained localization. We propose Hierarchical Knowledge-Guided Distributional Prompt Learning (HiDist), a normality-referenced hierarchical distributional prompt framework for ZSAD. HiDist models each prompt token with a diagonal Gaussian distribution and generates stochastic prompt variations through Monte Carlo sampling. Rather than learning normal and anomalous distributions independently, anomalous prompt distributions are parameterized as deviations from learned normal references, explicitly encoding their dependency. The resulting…
PDF arXiv

Active contributors · 90 days

Activity · 12 weeks

Coming with more sources: repos

Fields · AI · updated 5m ago

Anomaly detectors

Found by the topic model: anomaly detectors, adversarial.

23papers this week−45.2% vs last week

All papers · 184 With code · 1

Newest Most relevant

170 papers this month

Open problems in Anomaly detectors

Data heterogeneity in federated anomaly detection2 papers raise it · 2 address it
Non-IID data across clients degrades model accuracy and training stability in collaborative settings like malware or ransomware detection.
- Federated Learning for Malware Image Classification under Data Heterogeneityraises · addresses
- AdaFedXplain: Adaptive Federated Learning with Explainable AI for Ransomware Detectionraises · addresses
Lack of strong deep representations for tabular anomaly detection1 paper raises it · 2 address it
Deep learning has had limited impact on tabular anomaly detection due to weak or unavailable deep features.
- Adapting prior-data fitted networks for tabular anomaly detectionraises · addresses
- Universal Semantic Enhancement for Weakly Supervised Anomaly Detectionaddresses
Evaluation bias from recording or dataset artifacts1 paper raises it · 1 addresses it
Benchmark datasets may contain spurious signals (e.g., recording differences) that inflate performance and mislead model comparisons.
- Recording-Aware Evaluation of Multimodal OT Intrusion Detectionraises · addresses
Scalability and efficiency in real-time anomaly detection1 paper raises it · 1 addresses it
Real-world deployments require low-latency, high-throughput processing, especially in multi-site or edge-cloud systems.
- YUTELA: A Scalable Edge Cloud AIoT System for Multi-Site Video Anomaly Detection with Scene Specific Adaptationraises · addresses
Explainability and interpretability in federated anomaly detection1 paper raises it · 1 addresses it
Federated learning models often lack transparency, making it hard to trust or debug decisions in critical applications like ransomware detection.
- AdaFedXplain: Adaptive Federated Learning with Explainable AI for Ransomware Detectionraises · addresses

Named by an AI from these papers' abstracts.