Unsupervised Log Anomaly Detection Method Based on Multi-Feature

Log anomaly detection is an important paradigm for system troubleshooting. Existing log anomaly detection based on Long Short-Term Memory (LSTM) networks is time-consuming to handle long sequences. Transformer model is introduced to promote efficiency. However, most existing Transformer-based log anomaly detection methods convert unstructured log messages into structured templates by log parsing, which introduces parsing errors. They only extract simple semantic feature, which ignores other features, and are generally supervised, relying on the amount of labeled data. To overcome the limitations of existing methods, this paper proposes a novel unsupervised log anomaly detection method based on multi-feature (UMFLog). UMFLog includes two sub-models to consider two kinds of features: semantic feature and statistical feature, respectively. UMFLog applies the log original content with detailed parameters instead of templates or template IDs to avoid log parsing errors. In the first sub-model, UMFLog uses Bidirectional Encoder Representations from Transformers (BERT) instead of random initialization to extract effective semantic feature, and an unsupervised hypersphere-based Transformer model to learn compact log sequence representations and obtain anomaly candidates. In the second sub-model, UMFLog exploits a statistical feature-based Variational Autoencoder (VAE) about word occurrence times to identify the final anomaly from anomaly candidates. Extensive experiments and evaluations are conducted on three real public log datasets. The results show that UMFLog significantly improves F1-scores compared to the state-of-the-art (SOTA) methods because of the multi-feature.     

Fine-Grained Features for Image Captioning

Image captioning involves two different major modalities (image and sentence) that convert a given image into a language that adheres to visual semantics. Almost all methods first extract image features to reduce the difficulty of visual semantic embedding and then use the caption model to generate fluent sentences. The Convolutional Neural Network (CNN) is often used to extract image features in image captioning, and the use of object detection networks to extract region features has achieved great success. However, the region features retrieved by this method are object-level and do not pay attention to fine-grained details because of the detection model’s limitation. We offer an approach to address this issue that more properly generates captions by fusing fine-grained features and region features. First, we extract fine-grained features using a panoramic segmentation algorithm. Second, we suggest two fusion methods and contrast their fusion outcomes. An X-linear Attention Network (X-LAN) serves as the foundation for both fusion methods. According to experimental findings on the COCO dataset, the two-branch fusion approach is superior. It is important to note that on the COCO Karpathy test split, CIDEr is increased up to 134.3% in comparison to the baseline, highlighting the potency and viability of our method.     

Early stage white etching crack identification using artificial neural networks

White Etching Cracks (WEC) in gearbox bearings is a major concern in the wind turbine industry, which can lead to a premature failure of the gearbox. Though many hypotheses regarding the generation of WEC have been proposed over the decades, the answer is still disputable. To trace back the failures to earlier stages before they occur, an innovative sensor-set has been utilized on a test rig to monitor the influencing factors that lead to WEC. This paperwork seeks to recognize abnormal patterns from recorded sensor data and derive statements of sensible sensor combinations in WEC early detection. A Long Short Term Memory (LSTM) network-based autoencoder is proposed for the anomaly detection (AD) task. Employing an auto-associative sequence-to-sequence predictor, a model is trained to reconstruct the normal time series data without WEC. The reconstruction error of testing time series data is evaluated for the determination of its anomaly. The results show that the specified LSTM autoencoder framework can qualitatively distinguish anomalies from collected multivariate time series data. Moreover, the anomaly score evaluated via reconstruction-error-based metrics can discriminate normal and abnormal behaviors in the study. This investigation’s results entail a significant step towards early WEC risk detection and more cost-efficient wind turbine technology if this approach can be further applied on stream data with plausible thresholds in monitoring system.

     

Unsupervised Anomaly Detection Approach Based on Adversarial Memory Autoencoders for Multivariate Time Series

The widespread usage of Cyber Physical Systems (CPSs) generates a vast volume of time series data, and precisely determining anomalies in the data is critical for practical production. Autoencoder is the mainstream method for time series anomaly detection, and the anomaly is judged by reconstruction error. However, due to the strong generalization ability of neural networks, some abnormal samples close to normal samples may be judged as normal, which fails to detect the abnormality. In addition, the dataset rarely provides sufficient anomaly labels. This research proposes an unsupervised anomaly detection approach based on adversarial memory autoencoders for multivariate time series to solve the above problem. Firstly, an encoder encodes the input data into low-dimensional space to acquire a feature vector. Then, a memory module is used to learn the feature vector’s prototype patterns and update the feature vectors. The updating process allows partial forgetting of information to prevent model overgeneralization. After that, two decoders reconstruct the input data. Finally, this research uses the Peak Over Threshold (POT) method to calculate the threshold to determine anomalous samples from normal samples. This research uses a two-stage adversarial training strategy during model training to enlarge the gap between the reconstruction error of normal and abnormal samples. The proposed method achieves significant anomaly detection results on synthetic and real datasets from power systems, water treatment plants, and computer clusters. The F1 score reached an average of 0.9196 on the five datasets, which is 0.0769 higher than the best baseline method.     

Performance Anomaly Detection in Web Services: An RNN- Based Approach Using Dynamic Quality of Service Features

Performance anomaly detection is the process of identifying occurrences that do not conform to expected behavior or correlate with other incidents or events in time series data. Anomaly detection has been applied to areas such as fraud detection, intrusion detection systems, and network systems. In this paper, we propose an anomaly detection framework that uses dynamic features of quality of service that are collected in a simulated setup. Three variants of recurrent neural networks-SimpleRNN, long short term memory, and gated recurrent unit are evaluated. The results reveal that the proposed method effectively detects anomalies in web services with high accuracy. The performance of the proposed anomaly detection framework is superior to that of existing approaches using maximum accuracy and detection rate metrics.     

Anomaly detection of aircraft lead-acid battery

The lead-acid battery has been widely used in various fields. In civil aviation aircraft, it plays a vital role in the power system to maintain normal operation during the flight mission. Thus, an effective abnormal detection system for monitoring and diagnosing the status of aircraft lead-acid battery is essential to ensure its safety and reliability. This paper aims to effectively identify aircraft battery faulty using unsupervised anomaly detection techniques. It introduces state-of-the-art anomaly detection algorithms and evaluates their performance on a large real civil aviation battery data. The experimental results show that the latest isolation-based anomaly detectors, iForest and iNNE, have outstanding performance on this task and have promising applicability as efficient methods for guaranteeing the lead-acid battery quality and reliability in civil aviation aircraft.     

Least squares timestamp synchronization for local broadcast networks

The analysis of computer network experiments strongly relies on event log files recorded by the participating network nodes during the experiment. Timing related issues play an important role here for a number of central parameters like, e.g., end-to-end delay. As each node uses its local clock to timestamp the events in the log files, the large deviation of standard crystal oscillator based clocks imposes some big problems. We look at this issue in the case of networks with local broadcast media, where occurring transmissions can often be observed by multiple network nodes. We have developed a method to correct the timestamps in such an environment in a previous paper. Here, we present a second solution. For this new solution, we give bounds on the synchronization quality and compare the two approaches by means of simulation.     

Managing for resilience: early detection of regime shifts in complex systems

The broad implications of catastrophic regime shifts have prompted the need to find methods that are not only able to detect regime shifts but more importantly, identify them before they occur. Rising variance, skewness, kurtosis, and critical slowing down have all been proposed as indicators of impending regime shifts. However, these approaches typically do not signal a shift until it is well underway. Further, they have primarily been used to evaluate simple systems; hence, additional work is needed to adapt these methods, if possible, to real systems which typically are complex and multivariate. Fisher information is a key method in information theory and affords the ability to characterize the dynamic behavior of systems. In this work, Fisher information is compared to traditional indicators through the assessment of model and real systems and identified as a leading indicator of impending regime shifts. Evidenced by the great deal of activity in this research area, it is understood that such work could lead to better methods for detecting and managing systems that are of significant importance to humans. Thus, we believe the results of this work offer great promise for resilience science and sustainability.     

基于逻辑回归模型的流量异常检测方法研究

网络流量作为异常检测的基本数据源,其行为特征的准确描述,是网络异常行为实时检测的重要依据.本文针对流量异常检测问题,提出了一种基于逻辑回归模型的网络流量异常检测方法.通过分析源IP、目的 IP等多个网络流量基本特征,构造了网络异常行为和正常行为的训练机,并且在此基础上采用逻辑回归建立起网络异常流量挖掘模型.利用实验室所采集的真实网络流量对所构建的模型进行检测,以验证该模型的有效性.实验结果表明本文所建立的网络模型在异常流量挖掘方面准确度高、实时性好.     

Anomaly IoT Node Detection Based on Local Outlier Factor and Time Series

The heterogeneous nodes in the Internet of Things (IoT) are relatively weak in the computing power and storage capacity. Therefore, traditional algorithms of network security are not suitable for the IoT. Once these nodes alternate between normal behavior and anomaly behavior, it is difficult to identify and isolate them by the network system in a short time, thus the data transmission accuracy and the integrity of the network function will be affected negatively. Based on the characteristics of IoT, a lightweight local outlier factor detection method is used for node detection. In order to further determine whether the nodes are an anomaly or not, the varying behavior of those nodes in terms of time is considered in this research, and a time series method is used to make the system respond to the randomness and selectiveness of anomaly behavior nodes effectively in a short period of time. Simulation results show that the proposed method can improve the accuracy of the data transmitted by the network and achieve better performance.     

基于相对密度的DNS请求数据流源IP异常检测算法

研究了域名系统(DNS)的异常检测.通过对基于相对密度的离群点检测算法的研究,提出了一种基于相对密度的DNS请求数据流源IP异常检测算法.该算法计算每个源IP的相对密度,并将该密度的倒数作为其异常值评分;在计算相对密度时,从查询次数、源端口熵值、所请求非法域名占比等9个维度来表示一个源IP.试验结果表明,这种基于相对密度的源IP异常检测方法,能正确地根据各个源IP不同的异常程度,给出其相应的异常值评分.     

pH响应性食品包装材料的制备及其对酸性气体的识别指示性研究

目的 针对食品新鲜度下降过程产生的酸性气体(以CO2为例)进行识别和指示.方法 以高直链玉米淀粉、聚乙烯醇及交联剂等多种助剂为原料,负载pH响应性复合指示剂,利用高分子溶液聚合方式制得高直链玉米淀粉基pH响应性食品包装材料,简称HASF.结果 对HASF指示材料透光性、吸水性、水溶性、力学性能进行分析,确定最佳比例;通过对指示材料CO2的识别检测,确定复合指示剂中甲基红与溴百里酚蓝最优体积比为1:2,最佳体积分数为6％;指示材料的红外光谱和扫描电镜显示,材料内部各组分间分散均匀,性质统一,相容性良好,该食品包装复合膜的性能稳定.结论 HASF指示材料可适用于食品包装材料.同时,HASF指示材料可通过颜色转变对酸性气体进行识别和指示,为食品包装材料智能化提供了可能.     

盾构螺旋输送机适应性设计智能决策

螺旋输送机作为土压平衡式盾构的重要功能部件之一,常常需要进行设计调整以满足新的工程需求.但是,设计调整容易导致产品指标发生过量变动,进而对产品的可靠性、安全性和可维护性等产生负面影响.为最大化重用已有的、经过工程验证的设计方案,降低设计调整的负面影响,提出了一种盾构螺旋输送机适应性设计智能决策方法.首先,收集盾构螺旋输...     

正向选择免疫算法在结构损伤诊断中的应用

结构状况可根据结构响应信号的异常进行判断,人工免疫系统能有效地应用于信号的异常检测。对基于免疫机制的正向选择算法进行了研究,利用具有时频局部化特性的小波包分解得到表征结构特征的小波包能量谱,通过正向选择算法检测小波包能量谱的异常来辨识结构状况。对正向选择算法进行了改进,可减少"自我"空间检测子的生成数目,加快检测速度,促进正向选择算法的实际应用。以ASCE学会提出的基准结构为对象,验证了正向选择算法在损伤诊断中的有效性,并与反向算法进行了比较。     

基于改进YOLOv5s的护帮板异常检测方法研究

准确识别护帮板支护状态,判断护帮板是否与采煤机发生干涉,是实现煤矿安全生产的重要一环。提出了一种基于改进YOLOv5s的护帮板异常检测方法。建立了护帮板数据集hb_data2021,对YOLOv5s模型进行改进。根据基于改进YOLOv5s的护帮板状态检测结果的标签分类,判断护帮板状态是否异常。为了减小YOLOv5s模型的参数量,采用MobileNetV3 和轻量级注意力机制NAM（normalization-based attention module,标准化注意力模块）替换主干特征提取网络。为了提高护帮板检测精度,改进损失函数为α-CIoU,并进行知识蒸馏。实验结果表明：蒸馏后的网络平均精度提高了1.0%,参数量减小了33.4%,推理加速34.2%;基于改进YOLOv5s的护帮板异常检测方法效果良好,将其部署在NVIDIA Jetson Xavier平台上,可以满足实时检测视频的要求。将检测模型移植到巡检机器人的嵌入式平台上,可以实现护帮板异常检测,满足煤矿工业实际需求。     

基于高维随机矩阵特征值之差的滚动轴承状态异常检测算法

针对滚动轴承异常检测准确性差、精度低及数据维度灾难造成检测困难等问题,提出一种基于随机矩阵特征值之差指标的滚动轴承状态异常检测算法.运用平移时间窗对不同时刻的轴承信息锁定,并通过分段、随机化、扩增和维度重构等方法构造出高维随机特征矩阵;利用随机矩阵理论对高维数据良好的处理能力,给出了滚动轴承特征值之差指标的构造方法及动...     

The science-industry interface in the petroleum industry: Correlation of time series of indicators and their spectra,and growth modelling

Petroleum production and exploration, used as petroleum industry indicators, and accumulation of petroleum-related geoscience literature, used as a science indicator, were compared by several means to gauge the degree of interaction between science and the industry in the period 1934–1990. Methods of comparison employed were: time domain correlations and crosscorrelation; correlations of spectra using coherence and crosspower spectra, and growth-modelling of the indicators. A fifty-year exploration cycle was found, beginning about 1945. Principal features of this cycle seem to coincide with prominent features in the time series for geoscience literature, and both of these variables are correlated with petroleum production. All three variables appear to have been determined ultimately by economic and political events which affected the petroleum industry. All of them show long-period cycles which coincide with the fourth Kondratiev cycle and the beginning of the fifth Kondratiev. The longest time series used (petroleum production in the United States, 1860–1990) shows long-period cycles matching the third, fourth and fifth Kondratiev cycles.     

A Model for Helmet-Wearing Detection of Non-Motor Drivers Based on YOLOv5s

Detecting non-motor drivers’ helmets has significant implications for traffic control. Currently, most helmet detection methods are susceptible to the complex background and need more accuracy and better robustness of small object detection, which are unsuitable for practical application scenarios. Therefore, this paper proposes a new helmet-wearing detection algorithm based on the You Only Look Once version 5 (YOLOv5). First, the Dilated convolution In Coordinate Attention (DICA) layer is added to the backbone network. DICA combines the coordinated attention mechanism with atrous convolution to replace the original convolution layer, which can increase the perceptual field of the network to get more contextual information. Also, it can reduce the network’s learning of unnecessary features in the background and get attention to small objects. Second, the Rebuild Bidirectional Feature Pyramid Network (Re-BiFPN) is used as a feature extraction network. Re-BiFPN uses cross-scale feature fusion to combine the semantic information features at the high level with the spatial information features at the bottom level, which facilitates the model to learn object features at different scales. Verified on the proposed “Helmet Wearing dataset for Non-motor Drivers (HWND),” the results show that the proposed model is superior to the current detection algorithms, with the mean average precision (mAP) of 94.3% under complex background.     

Oxygen detection using UV-activated electrospun poly(ethylene oxide) fibers encapsulated with TiO2 nanoparticles

A UV-activated oxygen indicator was developed in this study. The indicator was prepared by dispersing TiO₂ nanoparticles, glycerol, and methylene blue in poly(ethylene oxide) solution using aqueous ethanol as a solvent. The solution was electrospun or solvent cast to produce oxygen-sensitive fibrous membrane and continuous cast film, respectively. Sensitivity characteristics of the resulting indicators to UV irradiation and oxygen detection, at different component ratios, were evaluated. Scanning electron microscopy results show that the diameter of the electrospun fibers varied from about 350 to 1000 nm. The electrospun indicators were 4–5 times more sensitive to UV irradiation as compared to continuous film indicators prepared by casting, mainly due to morphological differences between the two poly(ethylene oxide) carriers. Increasing ethanol concentration of the electrospinning solvent enhanced the sensitivity of the indicator to UV irradiation. Moreover, the photo-bleaching step of the indicator was highly dependent on the active component ratios in the formulation. FTIR spectroscopy was employed to study the interactions between the active compounds in the indicator. This study demonstrated that electrospun TiO₂-based indicator could be promising for oxygen detection in modified atmosphere packaging applications.     

A probabilistic method for the detection of obstructed cracks of beam-type structures using spatial wavelet transform

This paper reports both the theoretical development and the numerical verification of a practical wavelet-based crack detection method, which identifies first the number of cracks and then the corresponding crack locations and extents. The value of the proposed method lies in its ability to detect obstructed cracks when measurement at or close to the cracked region is not possible. In such situations, most nonmodel-based methods, which rely on the abnormal change of certain indicators (e.g., curvature and strain mode shapes) at or close to the cracks, cannot be used. Most model-based methods follow the model updating approach. That is, they treat the crack location and extent as model parameters and identify them by minimizing the discrepancy between the modelled and measured dynamic responses. Most model-based methods in the literature can only be used in single- or multi-crack cases with a given number of cracks. One of the objectives of this paper is to develop a model-based crack detection method that is applicable in a general situation when the number of cracks is not known in advance.

To explicitly handle the uncertainties associated with measurement noise and modelling error, the proposed method uses the Bayesian probabilistic approach. In particular, the method aims to calculate the posterior (updated) probability density function (PDF) of the crack locations and the corresponding extents.

The proposed wavelet-based crack detection method is verified and demonstrated through a comprehensive series of numerical case studies, in which noisy data were generated by a Bernoulli–Euler beam with semi-rigid connections. The results show that the method can correctly identify the number of cracks even when the crack extent is small. The effects of the number of cracks and the crack extents on the results of crack detection are also studied and discussed in this paper.