WorldWideScience

Sample records for anomalies detected prior

  1. Anomaly Detection in Sequences

    Data.gov (United States)

    National Aeronautics and Space Administration — We present a set of novel algorithms which we call sequenceMiner, that detect and characterize anomalies in large sets of high-dimensional symbol sequences that...

  2. Theoretically Optimal Distributed Anomaly Detection

    Data.gov (United States)

    National Aeronautics and Space Administration — A novel general framework for distributed anomaly detection with theoretical performance guarantees is proposed. Our algorithmic approach combines existing anomaly...

  3. Detecting Patterns of Anomalies

    Science.gov (United States)

    2009-03-01

    detect anomalies in the dataset is used in [Leung and Leckie, 2005] and [Eskin et al., 2002]. One-class SVMs [Li et al., 2003, Heller et al., 2003] and...IEE Proceedings F, 140(2): 107–113, 1993. J.D.F. Habbema, J. Hermans , and K. Vandenbroek. A stepwise discriminant analysis pro- gram using density...Technometrics, 29(4):409–412, 1987. K.A. Heller , K.M. Svore, A. Keromytis, and S.J. Stolfo. One class support vector machines for detecting anomalous

  4. Caution is recommended prior to sildenafil use in vascular anomalies.

    Science.gov (United States)

    Rankin, Hannah; Zwicker, Kelley; Trenor, Cameron C

    2015-11-01

    Since publication of a single case report of lymphatic malformation improvement during sildenafil therapy for pulmonary hypertension, sildenafil use has propagated across multiple vascular anomalies diagnoses. Vascular anomalies are rare conditions, often with poor long-term outcomes from available therapies, making these patients vulnerable to novel therapy use. We have retrospectively reviewed 14 children with vascular anomalies treated with sildenafil. None of these patients reported improvement of disease while on treatment and some reported side effects including infections and bleeding. Pending more convincing prospective data, we recommend caution prior to sildenafil use for vascular anomalies.

  5. Seismic data fusion anomaly detection

    Science.gov (United States)

    Harrity, Kyle; Blasch, Erik; Alford, Mark; Ezekiel, Soundararajan; Ferris, David

    2014-06-01

    Detecting anomalies in non-stationary signals has valuable applications in many fields including medicine and meteorology. These include uses such as identifying possible heart conditions from an Electrocardiography (ECG) signals or predicting earthquakes via seismographic data. Over the many choices of anomaly detection algorithms, it is important to compare possible methods. In this paper, we examine and compare two approaches to anomaly detection and see how data fusion methods may improve performance. The first approach involves using an artificial neural network (ANN) to detect anomalies in a wavelet de-noised signal. The other method uses a perspective neural network (PNN) to analyze an arbitrary number of "perspectives" or transformations of the observed signal for anomalies. Possible perspectives may include wavelet de-noising, Fourier transform, peak-filtering, etc.. In order to evaluate these techniques via signal fusion metrics, we must apply signal preprocessing techniques such as de-noising methods to the original signal and then use a neural network to find anomalies in the generated signal. From this secondary result it is possible to use data fusion techniques that can be evaluated via existing data fusion metrics for single and multiple perspectives. The result will show which anomaly detection method, according to the metrics, is better suited overall for anomaly detection applications. The method used in this study could be applied to compare other signal processing algorithms.

  6. Anomaly detection on cup anemometers

    Science.gov (United States)

    Vega, Enrique; Pindado, Santiago; Martínez, Alejandro; Meseguer, Encarnación; García, Luis

    2014-12-01

    The performances of two rotor-damaged commercial anemometers (Vector Instruments A100 LK) were studied. The calibration results (i.e. the transfer function) were very linear, the aerodynamic behavior being more efficient than the one shown by both anemometers equipped with undamaged rotors. No detection of the anomaly (the rotors’ damage) was possible based on the calibration results. However, the Fourier analysis clearly revealed this anomaly.

  7. Hyperspectral anomaly detection using enhanced global factors

    Science.gov (United States)

    Paciencia, Todd J.; Bauer, Kenneth W.

    2016-05-01

    Dimension reduction techniques have become one popular unsupervised approach used towards detecting anomalies in hyperspectral imagery. Although demonstrating promising results in the literature on specific images, these methods can become difficult to directly interpret and often require tuning of their parameters to achieve high performance on a specific set of images. This lack of generality is also compounded by the need to remove noise and atmospheric absorption spectral bands from the image prior to detection. Without a process for this band selection and to make the methods adaptable to different image compositions, performance becomes difficult to maintain across a wider variety of images. Here, we present a framework that uses factor analysis to provide a robust band selection and more meaningful dimension reduction with which to detect anomalies in the imagery. Measurable characteristics of the image are used to create an automated decision process that allows the algorithm to adjust to a particular image, while maintaining high detection performance. The framework and its algorithms are detailed, and results are shown for forest, desert, sea, rural, urban, anomaly-sparse, and anomaly-dense imagery types from different sensors. Additionally, the method is compared to current state-of-the-art methods and is shown to be computationally efficient.

  8. Survey of Anomaly Detection Methods

    Energy Technology Data Exchange (ETDEWEB)

    Ng, B

    2006-10-12

    This survey defines the problem of anomaly detection and provides an overview of existing methods. The methods are categorized into two general classes: generative and discriminative. A generative approach involves building a model that represents the joint distribution of the input features and the output labels of system behavior (e.g., normal or anomalous) then applies the model to formulate a decision rule for detecting anomalies. On the other hand, a discriminative approach aims directly to find the decision rule, with the smallest error rate, that distinguishes between normal and anomalous behavior. For each approach, we will give an overview of popular techniques and provide references to state-of-the-art applications.

  9. Anomaly detection in online social networks

    CERN Document Server

    Savage, David; Yu, Xinghuo; Chou, Pauline; Wang, Qingmai

    2016-01-01

    Anomalies in online social networks can signify irregular, and often illegal behaviour. Anomalies in online social networks can signify irregular, and often illegal behaviour. Detection of such anomalies has been used to identify malicious individuals, including spammers, sexual predators, and online fraudsters. In this paper we survey existing computational techniques for detecting anomalies in online social networks. We characterise anomalies as being either static or dynamic, and as being labelled or unlabelled, and survey methods for detecting these different types of anomalies. We suggest that the detection of anomalies in online social networks is composed of two sub-processes; the selection and calculation of network features, and the classification of observations from this feature space. In addition, this paper provides an overview of the types of problems that anomaly detection can address and identifies key areas of future research.

  10. Network anomaly detection a machine learning perspective

    CERN Document Server

    Bhattacharyya, Dhruba Kumar

    2013-01-01

    With the rapid rise in the ubiquity and sophistication of Internet technology and the accompanying growth in the number of network attacks, network intrusion detection has become increasingly important. Anomaly-based network intrusion detection refers to finding exceptional or nonconforming patterns in network traffic data compared to normal behavior. Finding these anomalies has extensive applications in areas such as cyber security, credit card and insurance fraud detection, and military surveillance for enemy activities. Network Anomaly Detection: A Machine Learning Perspective presents mach

  11. Anomaly Detection in Dynamic Networks

    Energy Technology Data Exchange (ETDEWEB)

    Turcotte, Melissa [Los Alamos National Lab. (LANL), Los Alamos, NM (United States)

    2014-10-14

    Anomaly detection in dynamic communication networks has many important security applications. These networks can be extremely large and so detecting any changes in their structure can be computationally challenging; hence, computationally fast, parallelisable methods for monitoring the network are paramount. For this reason the methods presented here use independent node and edge based models to detect locally anomalous substructures within communication networks. As a first stage, the aim is to detect changes in the data streams arising from node or edge communications. Throughout the thesis simple, conjugate Bayesian models for counting processes are used to model these data streams. A second stage of analysis can then be performed on a much reduced subset of the network comprising nodes and edges which have been identified as potentially anomalous in the first stage. The first method assumes communications in a network arise from an inhomogeneous Poisson process with piecewise constant intensity. Anomaly detection is then treated as a changepoint problem on the intensities. The changepoint model is extended to incorporate seasonal behavior inherent in communication networks. This seasonal behavior is also viewed as a changepoint problem acting on a piecewise constant Poisson process. In a static time frame, inference is made on this extended model via a Gibbs sampling strategy. In a sequential time frame, where the data arrive as a stream, a novel, fast Sequential Monte Carlo (SMC) algorithm is introduced to sample from the sequence of posterior distributions of the change points over time. A second method is considered for monitoring communications in a large scale computer network. The usage patterns in these types of networks are very bursty in nature and don’t fit a Poisson process model. For tractable inference, discrete time models are considered, where the data are aggregated into discrete time periods and probability models are fitted to the

  12. Algorithms for Anomaly Detection - Lecture 1

    CERN Document Server

    CERN. Geneva

    2017-01-01

    The concept of statistical anomalies, or outliers, has fascinated experimentalists since the earliest attempts to interpret data. We want to know why some data points don’t seem to belong with the others: perhaps we want to eliminate spurious or unrepresentative data from our model. Or, the anomalies themselves may be what we are interested in: an outlier could represent the symptom of a disease, an attack on a computer network, a scientific discovery, or even an unfaithful partner. We start with some general considerations, such as the relationship between clustering and anomaly detection, the choice between supervised and unsupervised methods, and the difference between global and local anomalies. Then we will survey the most representative anomaly detection algorithms, highlighting what kind of data each approach is best suited to, and discussing their limitations. We will finish with a discussion of the difficulties of anomaly detection in high-dimensional data and some new directions for anomaly detec...

  13. Algorithms for Anomaly Detection - Lecture 2

    CERN Document Server

    CERN. Geneva

    2017-01-01

    The concept of statistical anomalies, or outliers, has fascinated experimentalists since the earliest attempts to interpret data. We want to know why some data points don’t seem to belong with the others: perhaps we want to eliminate spurious or unrepresentative data from our model. Or, the anomalies themselves may be what we are interested in: an outlier could represent the symptom of a disease, an attack on a computer network, a scientific discovery, or even an unfaithful partner. We start with some general considerations, such as the relationship between clustering and anomaly detection, the choice between supervised and unsupervised methods, and the difference between global and local anomalies. Then we will survey the most representative anomaly detection algorithms, highlighting what kind of data each approach is best suited to, and discussing their limitations. We will finish with a discussion of the difficulties of anomaly detection in high-dimensional data and some new directions for anomaly detec...

  14. Data Mining for Anomaly Detection

    Science.gov (United States)

    Biswas, Gautam; Mack, Daniel; Mylaraswamy, Dinkar; Bharadwaj, Raj

    2013-01-01

    The Vehicle Integrated Prognostics Reasoner (VIPR) program describes methods for enhanced diagnostics as well as a prognostic extension to current state of art Aircraft Diagnostic and Maintenance System (ADMS). VIPR introduced a new anomaly detection function for discovering previously undetected and undocumented situations, where there are clear deviations from nominal behavior. Once a baseline (nominal model of operations) is established, the detection and analysis is split between on-aircraft outlier generation and off-aircraft expert analysis to characterize and classify events that may not have been anticipated by individual system providers. Offline expert analysis is supported by data curation and data mining algorithms that can be applied in the contexts of supervised learning methods and unsupervised learning. In this report, we discuss efficient methods to implement the Kolmogorov complexity measure using compression algorithms, and run a systematic empirical analysis to determine the best compression measure. Our experiments established that the combination of the DZIP compression algorithm and CiDM distance measure provides the best results for capturing relevant properties of time series data encountered in aircraft operations. This combination was used as the basis for developing an unsupervised learning algorithm to define "nominal" flight segments using historical flight segments.

  15. Efficient Accurate Context-Sensitive Anomaly Detection

    Institute of Scientific and Technical Information of China (English)

    2007-01-01

    For program behavior-based anomaly detection, the only way to ensure accurate monitoring is to construct an efficient and precise program behavior model. A new program behavior-based anomaly detection model,called combined pushdown automaton (CPDA) model was proposed, which is based on static binary executable analysis. The CPDA model incorporates the optimized call stack walk and code instrumentation technique to gain complete context information. Thereby the proposed method can detect more attacks, while retaining good performance.

  16. Improved prenatal detection of chromosomal anomalies

    DEFF Research Database (Denmark)

    Frøslev-Friis, Christina; Hjort-Pedersen, Karina; Henriques, Carsten U;

    2011-01-01

    Prenatal screening for karyotype anomalies takes place in most European countries. In Denmark, the screening method was changed in 2005. The aim of this study was to study the trends in prevalence and prenatal detection rates of chromosome anomalies and Down syndrome (DS) over a 22-year period....

  17. Comparison of Unsupervised Anomaly Detection Methods

    Data.gov (United States)

    National Aeronautics and Space Administration — Several different unsupervised anomaly detection algorithms have been applied to Space Shuttle Main Engine (SSME) data to serve the purpose of developing a...

  18. Anomaly Detection in Power Quality at Data Centers

    Science.gov (United States)

    Grichine, Art; Solano, Wanda M.

    2015-01-01

    The goal during my internship at the National Center for Critical Information Processing and Storage (NCCIPS) is to implement an anomaly detection method through the StruxureWare SCADA Power Monitoring system. The benefit of the anomaly detection mechanism is to provide the capability to detect and anticipate equipment degradation by monitoring power quality prior to equipment failure. First, a study is conducted that examines the existing techniques of power quality management. Based on these findings, and the capabilities of the existing SCADA resources, recommendations are presented for implementing effective anomaly detection. Since voltage, current, and total harmonic distortion demonstrate Gaussian distributions, effective set-points are computed using this model, while maintaining a low false positive count.

  19. Reducing customer minutes lost by anomaly detection?

    NARCIS (Netherlands)

    Bakker, M.; Vreeburg, J.H.G.; Rietveld, L.C.; van der Roer, M.

    2012-01-01

    An method which compares measured and predicted water demands to detect anomalies, was developed and tested on three data sets of water demand of three years in which and 25 pipe bursts were reported. The method proved to be able to detect bursts where the water loss exceeds 30% of the average water

  20. Contextual Detection of Anomalies within Hyperspectral Images

    Science.gov (United States)

    2011-03-01

    Hyperspectral Imagery (HSI), Unsupervised Target Detection, Target Identification, Contextual Anomaly Detection 16. SECURITY CLASSIFICATION OF: 17. LIMITATION...processing. Hyperspectral imaging has a wide range of applications within remote sensing, not limited to terrain classification , environmental monitoring...Johnson, R. J. (2008). Improved feature extraction, feature selection, and identification techniques that create a fast unsupervised hyperspectral

  1. An Immune Inspired Approach to Anomaly Detection

    CERN Document Server

    Twycross, Jamie

    2009-01-01

    The immune system provides a rich metaphor for computer security: anomaly detection that works in nature should work for machines. However, early artificial immune system approaches for computer security had only limited success. Arguably, this was due to these artificial systems being based on too simplistic a view of the immune system. We present here a second generation artificial immune system for process anomaly detection. It improves on earlier systems by having different artificial cell types that process information. Following detailed information about how to build such second generation systems, we find that communication between cells types is key to performance. Through realistic testing and validation we show that second generation artificial immune systems are capable of anomaly detection beyond generic system policies. The paper concludes with a discussion and outline of the next steps in this exciting area of computer security.

  2. Dendritic Cells for Anomaly Detection

    CERN Document Server

    Greensmith, Julie; Aickelin, Uwe

    2010-01-01

    Artificial immune systems, more specifically the negative selection algorithm, have previously been applied to intrusion detection. The aim of this research is to develop an intrusion detection system based on a novel concept in immunology, the Danger Theory. Dendritic Cells (DCs) are antigen presenting cells and key to the activation of the human signals from the host tissue and correlate these signals with proteins know as antigens. In algorithmic terms, individual DCs perform multi-sensor data fusion based on time-windows. The whole population of DCs asynchronously correlates the fused signals with a secondary data stream. The behaviour of human DCs is abstracted to form the DC Algorithm (DCA), which is implemented using an immune inspired framework, libtissue. This system is used to detect context switching for a basic machine learning dataset and to detect outgoing portscans in real-time. Experimental results show a significant difference between an outgoing portscan and normal traffic.

  3. Anomaly Detection and Attribution Using Bayesian Networks

    Science.gov (United States)

    2014-06-01

    UNCLASSIFIED Anomaly Detection and Attribution Using Bayesian Networks Andrew Kirk, Jonathan Legg and Edwin El-Mahassni National Security and...detection in Bayesian networks , en- abling both the detection and explanation of anomalous cases in a dataset. By exploiting the structure of a... Bayesian network , our algorithm is able to efficiently search for local maxima of data conflict between closely related vari- ables. Benchmark tests using

  4. Anomaly-based Network Intrusion Detection Methods

    Directory of Open Access Journals (Sweden)

    Pavel Nevlud

    2013-01-01

    Full Text Available The article deals with detection of network anomalies. Network anomalies include everything that is quite different from the normal operation. For detection of anomalies were used machine learning systems. Machine learning can be considered as a support or a limited type of artificial intelligence. A machine learning system usually starts with some knowledge and a corresponding knowledge organization so that it can interpret, analyse, and test the knowledge acquired. There are several machine learning techniques available. We tested Decision tree learning and Bayesian networks. The open source data-mining framework WEKA was the tool we used for testing the classify, cluster, association algorithms and for visualization of our results. The WEKA is a collection of machine learning algorithms for data mining tasks.

  5. Network Anomaly Detection Based on Wavelet Analysis

    Directory of Open Access Journals (Sweden)

    Ali A. Ghorbani

    2008-11-01

    Full Text Available Signal processing techniques have been applied recently for analyzing and detecting network anomalies due to their potential to find novel or unknown intrusions. In this paper, we propose a new network signal modelling technique for detecting network anomalies, combining the wavelet approximation and system identification theory. In order to characterize network traffic behaviors, we present fifteen features and use them as the input signals in our system. We then evaluate our approach with the 1999 DARPA intrusion detection dataset and conduct a comprehensive analysis of the intrusions in the dataset. Evaluation results show that the approach achieves high-detection rates in terms of both attack instances and attack types. Furthermore, we conduct a full day's evaluation in a real large-scale WiFi ISP network where five attack types are successfully detected from over 30 millions flows.

  6. Detection of cardiovascular anomalies: Hybrid systems approach

    KAUST Repository

    Ledezma, Fernando

    2012-06-06

    In this paper, we propose a hybrid interpretation of the cardiovascular system. Based on a model proposed by Simaan et al. (2009), we study the problem of detecting cardiovascular anomalies that can be caused by variations in some physiological parameters, using an observerbased approach. We present the first numerical results obtained. © 2012 IFAC.

  7. A Methodological Overview on Anomaly Detection

    NARCIS (Netherlands)

    Callegari, C.; Coluccia, A.; D'Alconzo, A.; Ellens, W.; Giordano, S.; Mandjes, M.; Pagano, P.; Pepe, T.; Ricciato, F.; Żuraniewski, P.; Biersack, E.; Callegari, C.; Matijasevic, M.

    2013-01-01

    In this Chapter we give an overview of statistical methods for anomaly detection (AD), thereby targeting an audience of practitioners with general knowledge of statistics. We focus on the applicability of the methods by stating and comparing the conditions in which they can be applied and by discuss

  8. A methodological overview on anomaly detection

    NARCIS (Netherlands)

    Callegari, C.; Coluccia, A.; D'alconzo, A.; Ellens, W.; Giordano, S.; Mandjes, M.; Pagano, M.; Pepe, T.; Ricciato, F.; Zuraniewski, P.W.

    2013-01-01

    In this Chapter we give an overview of statistical methods for anomaly detection (AD), thereby targeting an audience of practitioners with general knowledge of statistics. We focus on the applicability of the methods by stating and comparing the conditions in which they can be applied and by discuss

  9. OPAD data analysis. [Optical Plumes Anomaly Detection

    Science.gov (United States)

    Buntine, Wray L.; Kraft, Richard; Whitaker, Kevin; Cooper, Anita E.; Powers, W. T.; Wallace, Tim L.

    1993-01-01

    Data obtained in the framework of an Optical Plume Anomaly Detection (OPAD) program intended to create a rocket engine health monitor based on spectrometric detections of anomalous atomic and molecular species in the exhaust plume are analyzed. The major results include techniques for handling data noise, methods for registration of spectra to wavelength, and a simple automatic process for estimating the metallic component of a spectrum.

  10. Outlier Detection Method Use for the Network Flow Anomaly Detection

    Directory of Open Access Journals (Sweden)

    Rimas Ciplinskas

    2016-06-01

    Full Text Available New and existing methods of cyber-attack detection are constantly being developed and improved because there is a great number of attacks and the demand to protect from them. In prac-tice, current methods of attack detection operates like antivirus programs, i. e. known attacks signatures are created and attacks are detected by using them. These methods have a drawback – they cannot detect new attacks. As a solution, anomaly detection methods are used. They allow to detect deviations from normal network behaviour that may show a new type of attack. This article introduces a new method that allows to detect network flow anomalies by using local outlier factor algorithm. Accom-plished research allowed to identify groups of features which showed the best results of anomaly flow detection according the highest values of precision, recall and F-measure.

  11. Surface latent heat flux anomalies prior to the Indonesia Mw9.0 earthquake of 2004

    Institute of Scientific and Technical Information of China (English)

    2006-01-01

    The temporal and spatial variations of surface latent heat flux (SLHF) before and after the Mw9.0 earthquake that occurred on the west coast of Sumatra, Indonesia on 26 December 2004 are summarized. It is found that before the earthquake significant SLHF anomalies occurred at the epicentral area and its vicinity. The largest SLHF anomaly occurred on the subduction zone in the middle part of Burma micro-plate, where the middle part of the rupture zone is located and the aftershocks are concentrated. The developments of the anomaly involved growing of the anomaly from small to large and spreading of the anomaly from disordered to concentrated. The anomaly began to occur on the east extensional boundary of the Burma micro-plate and its adjacent oceanic basin, and then propagated to the west compressive boundary, where the subduction zone exists. Finally, the anomaly disappeared after the main shock. The seismic source is considered to be a dissipation system. The increase of stress prior to an earthquake may enhance the exchange of energy and material between the seismic source system and the outer system, resulting in the increase of the rate of energy exchange between sea surface and atmosphere, which is believed to be the main reason of the generation of SLHF anomaly.

  12. Anomaly Detection using the "Isolation Forest" algorithm

    CERN Document Server

    CERN. Geneva

    2015-01-01

    Anomaly detection can provide clues about an outlying minority class in your data: hackers in a set of network events, fraudsters in a set of credit card transactions, or exotic particles in a set of high-energy collisions. In this talk, we analyze a real dataset of breast tissue biopsies, with malignant results forming the minority class. The "Isolation Forest" algorithm finds anomalies by deliberately “overfitting” models that memorize each data point. Since outliers have more empty space around them, they take fewer steps to memorize. Intuitively, a house in the country can be identified simply as “that house out by the farm”, while a house in the city needs a longer description like “that house in Brooklyn, near Prospect Park, on Union Street, between the firehouse and the library, not far from the French restaurant”. We first use anomaly detection to find outliers in the biopsy data, then apply traditional predictive modeling to discover rules that separate anomalies from normal data...

  13. Unsupervised Topic Discovery by Anomaly Detection

    Science.gov (United States)

    2013-09-01

    anomalous. 7 c. Support Vector Machines SVM was first introduced by Cortes and Vapnik [9], and it was used to detect anomalies in a single class...into a single file to be consumed by the LDA program. 2. Whitepaper posted on Facebook The population whitepaper posted on Facebook talks about...It talks about the importance of marriage and parenthood and the measures taken by the government to encourage parenthood . It addresses unpopular

  14. Trusted Anomaly Detection with Context Dependency

    Institute of Scientific and Technical Information of China (English)

    PENG Xin-guang; YAN Mei-feng

    2006-01-01

    Anomaly detection of privileged processes is one of the most important means to safeguard the host and system security. The key problem for improving detection performance is to identify local behavior of the short sequences in traces of system calls accurately. An alternative modeling method was proposed based on the typical pattern matching of short sequences, which builds upon the concepts of short sequences with context dependency and the specially designed aggregation algorithm. The experimental results indicate that the modeling method considering the context dependency improves clearly the sensitive decision threshold as compared with the previous modeling method.

  15. Residual generator for cardiovascular anomalies detection

    KAUST Repository

    Belkhatir, Zehor

    2014-06-01

    This paper discusses the possibility of using observer-based approaches for cardiovascular anomalies detection and isolation. We consider a lumped parameter model of the cardiovascular system that can be written in a form of nonlinear state-space representation. We show that residuals that are sensitive to variations in some cardiovascular parameters and to abnormal opening and closure of the valves, can be generated. Since the whole state is not easily available for measurement, we propose to associate the residual generator to a robust extended kalman filter. Numerical results performed on synthetic data are provided.

  16. Firewall policy anomaly detection and resolution

    Directory of Open Access Journals (Sweden)

    Ms. R.V.Darade

    2014-06-01

    Full Text Available Security of all private networks in businesses and institutions is achieved by firewall. Firewall provides protection by the quality of policy configured. Lack of Systematic analysis mechanism and Tools, Complex firewall configuration makes designing and managing firewall policies difficult. With help of segmentation rule, anomaly management framework is designed for accurate detection and effective resolution of anomalies. Using this technique, packets of network can be divided into set of disjoint packet space segments. Every segment is associated with unique set of firewall rules which specify an overlap relation among all firewall rules whic h could be conflicting or redundant. Flexible conflict resolution method is provided which has many resolution stra tegies for risk assessment of protected networks and its policy definition. Firewall logs are maintained by using association rule mining on these logs to find frequent logs, which in turned filtered to find malicious packets. Apriori algorithm is used to find frequent element from above logs. In each round, it computes the support for all candidate-item-sets. Candidate-item-sets with frequency above the minimum support parameter are selected at the end of each round; these frequent item-sets of round are used in the next round to construct candidate -item-sets. The algorithm halts when item-sets with desired frequency not found .

  17. Firewall policy anomaly detection and resolution

    Directory of Open Access Journals (Sweden)

    R.V. Darade

    2015-11-01

    Full Text Available Security of all private networks in businesses and institutions is achieved by firewall. Firewall provides protection by the quality of policy configured. Lack of Systematic analysis mechanism and Tools, Complex firewall configuration makes designing and managing firewall policies difficult. With help of segmentation rule, anomaly management framework is designed for accurate detection and effective resolution of anomalies. Using this technique, packets of network can be divided into set of disjoint packet space segments. Every segment is associated with unique set of firewall rules which specify an overlap relation among all firewall rules which could be conflicting or redundant. Flexible conflict resolution method is provided which has many resolution strategies for risk assessment of protected networks and its policy definition. Firewall logs are maintained by using association rule mining on these logs to find frequent logs, which in turned filtered to find malicious packets. Apriori algorithm is used to find frequent element from above logs. In each round, it computes the support for all candidate-item-sets. Candidate-item-sets with frequency above the minimum support parameter are selected at the end of each round; these frequent item-sets of round are used in the next round to construct candidate -item-sets. The algorithm halts when item-sets with desired frequency not found .

  18. Detecting syntactic and semantic anomalies in schizophrenia.

    Science.gov (United States)

    Moro, Andrea; Bambini, Valentina; Bosia, Marta; Anselmetti, Simona; Riccaboni, Roberta; Cappa, Stefano F; Smeraldi, Enrico; Cavallaro, Roberto

    2015-12-01

    One of the major challenges in the study of language in schizophrenia is to identify specific levels of the linguistic structure that might be selectively impaired. While historically a main semantic deficit has been widely claimed, results are mixed, with also evidence of syntactic impairment. This might be due to heterogeneity in materials and paradigms across studies, which often do not allow to tap into single linguistic components. Moreover, the interaction between linguistic and neurocognitive deficits is still unclear. In this study, we concentrated on syntactic and semantic knowledge. We employed an anomaly detection task including short and long sentences with either syntactic errors violating the principles of Universal Grammar, or a novel form of semantic errors, resulting from a contradiction in the computation of the whole sentence meaning. Fifty-eight patients with diagnosis of schizophrenia were compared to 30 healthy subjects. Results showed that, in patients, only the ability to identify syntactic anomaly, both in short and long sentences, was impaired. This result cannot be explained by working memory abilities or psychopathological features. These findings suggest the presence of an impairment of syntactic knowledge in schizophrenia, at least partially independent of the cognitive and psychopathological profile. On the contrary, we cannot conclude that there is a semantic impairment, at least in terms of compositional semantics abilities.

  19. Method for detecting software anomalies based on recurrence plot analysis

    OpenAIRE

    Michał Mosdorf

    2012-01-01

    Presented paper evaluates method for detecting software anomalies based on recurrence plot analysis of trace log generated by software execution. Described method for detecting software anomalies is based on windowed recurrence quantification analysis for selected measures (e.g. Recurrence rate - RR or Determinism - DET). Initial results show that proposed method is useful in detecting silent software anomalies that do not result in typical crashes (e.g. exceptions).

  20. Method for detecting software anomalies based on recurrence plot analysis

    Directory of Open Access Journals (Sweden)

    Michał Mosdorf

    2012-03-01

    Full Text Available Presented paper evaluates method for detecting software anomalies based on recurrence plot analysis of trace log generated by software execution. Described method for detecting software anomalies is based on windowed recurrence quantification analysis for selected measures (e.g. Recurrence rate - RR or Determinism - DET. Initial results show that proposed method is useful in detecting silent software anomalies that do not result in typical crashes (e.g. exceptions.

  1. Unsupervised Anomaly Detection for Liquid-Fueled Rocket Prop...

    Data.gov (United States)

    National Aeronautics and Space Administration — Title: Unsupervised Anomaly Detection for Liquid-Fueled Rocket Propulsion Health Monitoring. Abstract: This article describes the results of applying four...

  2. DISTRIBUTED ANOMALY DETECTION USING SATELLITE DATA FROM MULTIPLE MODALITIES

    Data.gov (United States)

    National Aeronautics and Space Administration — DISTRIBUTED ANOMALY DETECTION USING SATELLITE DATA FROM MULTIPLE MODALITIES KANISHKA BHADURI*, KAMALIKA DAS, AND PETR VOTAVA* Abstract. There has been a tremendous...

  3. Towards Reliable Evaluation of Anomaly-Based Intrusion Detection Performance

    Science.gov (United States)

    Viswanathan, Arun

    2012-01-01

    This report describes the results of research into the effects of environment-induced noise on the evaluation process for anomaly detectors in the cyber security domain. This research was conducted during a 10-week summer internship program from the 19th of August, 2012 to the 23rd of August, 2012 at the Jet Propulsion Laboratory in Pasadena, California. The research performed lies within the larger context of the Los Angeles Department of Water and Power (LADWP) Smart Grid cyber security project, a Department of Energy (DoE) funded effort involving the Jet Propulsion Laboratory, California Institute of Technology and the University of Southern California/ Information Sciences Institute. The results of the present effort constitute an important contribution towards building more rigorous evaluation paradigms for anomaly-based intrusion detectors in complex cyber physical systems such as the Smart Grid. Anomaly detection is a key strategy for cyber intrusion detection and operates by identifying deviations from profiles of nominal behavior and are thus conceptually appealing for detecting "novel" attacks. Evaluating the performance of such a detector requires assessing: (a) how well it captures the model of nominal behavior, and (b) how well it detects attacks (deviations from normality). Current evaluation methods produce results that give insufficient insight into the operation of a detector, inevitably resulting in a significantly poor characterization of a detectors performance. In this work, we first describe a preliminary taxonomy of key evaluation constructs that are necessary for establishing rigor in the evaluation regime of an anomaly detector. We then focus on clarifying the impact of the operational environment on the manifestation of attacks in monitored data. We show how dynamic and evolving environments can introduce high variability into the data stream perturbing detector performance. Prior research has focused on understanding the impact of this

  4. Some isotopic and geochemical anomalies observed in Mexico prior to large scale earthquakes and volcanic eruptions

    Energy Technology Data Exchange (ETDEWEB)

    Cruz R, S. de la; Armienta, M.A.; Segovia A, N

    1992-05-15

    A brief account of some experiences obtained in Mexico, related with the identification of geochemical precursors of volcanic eruptions and isotopic precursors of earthquakes and volcanic activity is given. The cases of three recent events of volcanic activity and one large earthquake are discussed in the context of an active geological environment. The positive results in the identification of some geochemical precursors that helped to evaluate the eruptive potential during two volcanic crises (Tacana 1986 and Colima 1991), and the significant radon-in-soil anomalies observed during a volcanic catastrophic eruption (El Chichon, 1982) and prior to a major earthquake (Michoacan, 1985) are critically analysed. (Author)

  5. Anomaly detection enhanced classification in computer intrusion detection

    Energy Technology Data Exchange (ETDEWEB)

    Fugate, M. L. (Michael L.); Gattiker, J. R. (James R.)

    2002-01-01

    This report describes work with the goal of enhancing capabilities in computer intrusion detection. The work builds upon a study of classification performance, that compared various methods of classifying information derived from computer network packets into attack versus normal categories, based on a labeled training dataset. This previous work validates our classification methods, and clears the ground for studying whether and how anomaly detection can be used to enhance this performance, The DARPA project that initiated the dataset used here concluded that anomaly detection should be examined to boost the performance of machine learning in the computer intrusion detection task. This report investigates the data set for aspects that will be valuable for anomaly detection application, and supports these results with models constructed from the data. In this report, the term anomaly detection means learning a model from unlabeled data, and using this to make some inference about future data. Our data is a feature vector derived from network packets: an 'example' or 'sample'. On the other hand, classification means building a model from labeled data, and using that model to classify unlabeled (future) examples. There is some precedent in the literature for combining these methods. One approach is to stage the two techniques, using anomaly detection to segment data into two sets for classification. An interpretation of this is a method to combat nonstationarity in the data. In our previous work, we demonstrated that the data has substantial temporal nonstationarity. With classification methods that can be thought of as learning a decision surface between two statistical distributions, performance is expected to degrade significantly when classifying examples that are from regions not well represented in the training set. Anomaly detection can be seen as a problem of learning the density (landscape) or the support (boundary) of a statistical

  6. Online Anomaly Energy Consumption Detection Using Lambda Architecture

    DEFF Research Database (Denmark)

    Liu, Xiufeng; Iftikhar, Nadeem; Nielsen, Per Sieverts;

    2016-01-01

    With the widely use of smart meters in the energy sector, anomaly detection becomes a crucial mean to study the unusual consumption behaviors of customers, and to discover unexpected events of using energy promptly. Detecting consumption anomalies is, essentially, a real-time big data analytics p...

  7. Multicriteria Similarity-Based Anomaly Detection Using Pareto Depth Analysis.

    Science.gov (United States)

    Hsiao, Ko-Jen; Xu, Kevin S; Calder, Jeff; Hero, Alfred O

    2016-06-01

    We consider the problem of identifying patterns in a data set that exhibits anomalous behavior, often referred to as anomaly detection. Similarity-based anomaly detection algorithms detect abnormally large amounts of similarity or dissimilarity, e.g., as measured by the nearest neighbor Euclidean distances between a test sample and the training samples. In many application domains, there may not exist a single dissimilarity measure that captures all possible anomalous patterns. In such cases, multiple dissimilarity measures can be defined, including nonmetric measures, and one can test for anomalies by scalarizing using a nonnegative linear combination of them. If the relative importance of the different dissimilarity measures are not known in advance, as in many anomaly detection applications, the anomaly detection algorithm may need to be executed multiple times with different choices of weights in the linear combination. In this paper, we propose a method for similarity-based anomaly detection using a novel multicriteria dissimilarity measure, the Pareto depth. The proposed Pareto depth analysis (PDA) anomaly detection algorithm uses the concept of Pareto optimality to detect anomalies under multiple criteria without having to run an algorithm multiple times with different choices of weights. The proposed PDA approach is provably better than using linear combinations of the criteria, and shows superior performance on experiments with synthetic and real data sets.

  8. Automated Network Anomaly Detection with Learning, Control and Mitigation

    Science.gov (United States)

    Ippoliti, Dennis

    2014-01-01

    Anomaly detection is a challenging problem that has been researched within a variety of application domains. In network intrusion detection, anomaly based techniques are particularly attractive because of their ability to identify previously unknown attacks without the need to be programmed with the specific signatures of every possible attack.…

  9. Application of Bayesian Dynamic Forecast in Anomaly Detection

    Institute of Scientific and Technical Information of China (English)

    YAN Hui; CAO Yuanda

    2005-01-01

    A macroscopical anomaly detection method based on intrusion statistic and Bayesian dynamic forecast is presented. A large number of alert data that cannot be dealt with in time are always aggregated in control centers of large-scale intrusion detection systems. In order to improve the efficiency and veracity of intrusion analysis, the intrusion intensity values are picked from alert data and Bayesian dynamic forecast method is used to detect anomaly. The experiments show that the new method is effective on detecting macroscopical anomaly in large-scale intrusion detection systems.

  10. Detection Range of Airborne Magnetometers in Magnetic Anomaly Detection

    Directory of Open Access Journals (Sweden)

    Chengjing Li

    2015-11-01

    Full Text Available Airborne magnetometers are utilized for the small-range search, precise positioning, and identification of the ferromagnetic properties of underwater targets. As an important performance parameter of sensors, the detection range of airborne magnetometers is commonly set as a fixed value in references regardless of the influences of environment noise, target magnetic properties, and platform features in a classical model to detect airborne magnetic anomalies. As a consequence, deviation in detection ability analysis is observed. In this study, a novel detection range model is proposed on the basis of classic detection range models of airborne magnetometers. In this model, probability distribution is applied, and the magnetic properties of targets and the environment noise properties of a moving submarine are considered. The detection range model is also constructed by considering the distribution of the moving submarine during detection. A cell-averaging greatest-of-constant false alarm rate test method is also used to calculate the detection range of the model at a desired false alarm rate. The detection range model is then used to establish typical submarine search probabilistic models. Results show that the model can be used to evaluate not only the effects of ambient magnetic noise but also the moving and geomagnetic features of the target and airborne detection platform. The model can also be utilized to display the actual operating range of sensor systems.

  11. Online Anomaly Energy Consumption Detection Using Lambda Architecture

    DEFF Research Database (Denmark)

    Liu, Xiufeng; Iftikhar, Nadeem; Nielsen, Per Sieverts

    2016-01-01

    With the widely use of smart meters in the energy sector, anomaly detection becomes a crucial mean to study the unusual consumption behaviors of customers, and to discover unexpected events of using energy promptly. Detecting consumption anomalies is, essentially, a real-time big data analytics...... problem, which does data mining on a large amount of parallel data streams from smart meters. In this paper, we propose a supervised learning and statistical-based anomaly detection method, and implement a Lambda system using the in-memory distributed computing framework, Spark and its extension Spark...... Streaming. The system supports not only iterative refreshing the detection models from scalable data sets, but also real-time anomaly detection on scalable live data streams. This paper empirically evaluates the system and the detection algorithm, and the results show the effectiveness and the scalability...

  12. EUROCAT website data on prenatal detection rates of congenital anomalies

    DEFF Research Database (Denmark)

    Garne, Ester; Dolk, Helen; Loane, Maria

    2010-01-01

    The EUROCAT website www.eurocat-network.eu publishes prenatal detection rates for major congenital anomalies using data from European population-based congenital anomaly registers, covering 28% of the EU population as well as non-EU countries. Data are updated annually. This information can...

  13. Anomaly Detection in Microblogging via Co-Clustering

    Institute of Scientific and Technical Information of China (English)

    杨武; 申国伟; 王魏; 宫良一; 于焱; 董国忠

    2015-01-01

    Traditional anomaly detection on microblogging mostly focuses on individual anomalous users or messages. Since anomalous users employ advanced intelligent means, the anomaly detection is greatly poor in performance. In this paper, we propose an innovative framework of anomaly detection based on bipartite graph and co-clustering. A bipartite graph between users and messages is built to model the homogeneous and heterogeneous interactions. The proposed co-clustering algorithm based on nonnegative matrix tri-factorization can detect anomalous users and messages simultaneously. The homogeneous relations modeled by the bipartite graph are used as constraints to improve the accuracy of the co-clustering algorithm. Experimental results show that the proposed scheme can detect individual and group anomalies with high accuracy on a Sina Weibo dataset.

  14. An entropy-based unsupervised anomaly detection pattern learning algorithm

    Institute of Scientific and Technical Information of China (English)

    YANG Ying-jie; MA Fan-yuan

    2005-01-01

    Currently, most anomaly detection pattern learning algorithms require a set of purely normal data from which they train their model. If the data contain some intrusions buried within the training data, the algorithm may not detect these attacks because it will assume that they are normal. In reality, it is very hard to guarantee that there are no attack items in the collected training data. Focusing on this problem, in this paper,firstly a new anomaly detection measurement is proposed according to the probability characteristics of intrusion instances and normal instances. Secondly, on the basis of anomaly detection measure, we present a clusteringbased unsupervised anomaly detection patterns learning algorithm, which can overcome the shortage above. Finally, some experiments are conducted to verify the proposed algorithm is valid.

  15. Network Traffic Anomalies Detection and Identification with Flow Monitoring

    CERN Document Server

    Nguyen, Huy; Kim, Dong Il; Choi, Deokjai

    2010-01-01

    Network management and security is currently one of the most vibrant research areas, among which, research on detecting and identifying anomalies has attracted a lot of interest. Researchers are still struggling to find an effective and lightweight method for anomaly detection purpose. In this paper, we propose a simple, robust method that detects network anomalous traffic data based on flow monitoring. Our method works based on monitoring the four predefined metrics that capture the flow statistics of the network. In order to prove the power of the new method, we did build an application that detects network anomalies using our method. And the result of the experiments proves that by using the four simple metrics from the flow data, we do not only effectively detect but can also identify the network traffic anomalies.

  16. An enhanced stream mining approach for network anomaly detection

    Science.gov (United States)

    Bellaachia, Abdelghani; Bhatt, Rajat

    2005-03-01

    Network anomaly detection is one of the hot topics in the market today. Currently, researchers are trying to find a way in which machines could automatically learn both normal and anomalous behavior and thus detect anomalies if and when they occur. Most important applications which could spring out of these systems is intrusion detection and spam mail detection. In this paper, the primary focus on the problem and solution of "real time" network intrusion detection although the underlying theory discussed may be used for other applications of anomaly detection (like spam detection or spy-ware detection) too. Since a machine needs a learning process on its own, data mining has been chosen as a preferred technique. The object of this paper is to present a real time clustering system; we call Enhanced Stream Mining (ESM) which could analyze packet information (headers, and data) to determine intrusions.

  17. Anomaly Detection from ASRS Databases of Textual Reports

    Data.gov (United States)

    National Aeronautics and Space Administration — Our primary goal is to automatically analyze textual reports from the Aviation Safety Reporting System (ASRS) database to detect/discover the anomaly categories...

  18. In-Flight Diagnosis and Anomaly Detection Project

    Data.gov (United States)

    National Aeronautics and Space Administration — In flight diagnosis and anomaly detection is a difficult challenge that requires sufficient observation and real-time processing of health information. Our approach...

  19. Anomaly Detection and Diagnosis Algorithms for Discrete Symbols

    Data.gov (United States)

    National Aeronautics and Space Administration — We present a set of novel algorithms which we call sequenceMiner that detect and characterize anomalies in large sets of high-dimensional symbol sequences that arise...

  20. Comparative Analysis of Data-Driven Anomaly Detection Methods

    Data.gov (United States)

    National Aeronautics and Space Administration — This paper provides a review of three different advanced machine learning algorithms for anomaly detection in continuous data streams from a ground-test firing of a...

  1. Solving a prisoner's dilemma in distributed anomaly detection

    Data.gov (United States)

    National Aeronautics and Space Administration — Anomaly detection has recently become an important problem in many industrial and financial applications. In several instances, the data to be analyzed for possible...

  2. On the Utility of Anonymized Flow Traces for Anomaly Detection

    CERN Document Server

    Burkhart, Martin; May, Martin

    2008-01-01

    The sharing of network traces is an important prerequisite for the development and evaluation of efficient anomaly detection mechanisms. Unfortunately, privacy concerns and data protection laws prevent network operators from sharing these data. Anonymization is a promising solution in this context; however, it is unclear if the sanitization of data preserves the traffic characteristics or introduces artifacts that may falsify traffic analysis results. In this paper, we examine the utility of anonymized flow traces for anomaly detection. We quantitatively evaluate the impact of IP address anonymization, namely variations of permutation and truncation, on the detectability of large-scale anomalies. Specifically, we analyze three weeks of un-sampled and non-anonymized network traces from a medium-sized backbone network. We find that all anonymization techniques, except prefix-preserving permutation, degrade the utility of data for anomaly detection. We show that the degree of degradation depends to a large exten...

  3. Condition Parameter Modeling for Anomaly Detection in Wind Turbines

    Directory of Open Access Journals (Sweden)

    Yonglong Yan

    2014-05-01

    Full Text Available Data collected from the supervisory control and data acquisition (SCADA system, used widely in wind farms to obtain operational and condition information about wind turbines (WTs, is of important significance for anomaly detection in wind turbines. The paper presents a novel model for wind turbine anomaly detection mainly based on SCADA data and a back-propagation neural network (BPNN for automatic selection of the condition parameters. The SCADA data sets are determined through analysis of the cumulative probability distribution of wind speed and the relationship between output power and wind speed. The automatic BPNN-based parameter selection is for reduction of redundant parameters for anomaly detection in wind turbines. Through investigation of cases of WT faults, the validity of the automatic parameter selection-based model for WT anomaly detection is verified.

  4. Statistical Inference for Detecting Structures and Anomalies in Networks

    Science.gov (United States)

    2015-08-27

    AFRL-AFOSR-VA-TR-2015-0262 Statistical Inference for Detecting Structures and Anomalies in Networks Cris Moore SANTA FE INSTITUTE OF SCIENCE INC...AND SUBTITLE Statistical Inference for Detecting Structures and Anomalies in Networks 5a. CONTRACT NUMBER N/A 5b. GRANT NUMBER FA9550-12-1-0432 5c...developing powerful and scalable Bayesian statistical and related inference methods for community structure, hierarchies, core-periphery structure

  5. Anomaly detection in GPS data based on visual analytics

    OpenAIRE

    Yu, Y.; Liao, Z; Chen, B

    2010-01-01

    Modern machine learning techniques provide robust approaches for data-driven modeling and critical information extraction, while human experts hold the advantage of possessing high-level intelligence and domain-specific expertise. We combine the power of the two for anomaly detection in GPS data by integrating them through a visualization and human-computer interaction interface. In this paper we introduce GPSvas (GPS Visual Analytics System), a system that detects anomalies in GPS data using...

  6. Support vector machines for TEC seismo-ionospheric anomalies detection

    Directory of Open Access Journals (Sweden)

    M. Akhoondzadeh

    2013-02-01

    Full Text Available Using time series prediction methods, it is possible to pursue the behaviors of earthquake precursors in the future and to announce early warnings when the differences between the predicted value and the observed value exceed the predefined threshold value. Support Vector Machines (SVMs are widely used due to their many advantages for classification and regression tasks. This study is concerned with investigating the Total Electron Content (TEC time series by using a SVM to detect seismo-ionospheric anomalous variations induced by the three powerful earthquakes of Tohoku (11 March 2011, Haiti (12 January 2010 and Samoa (29 September 2009. The duration of TEC time series dataset is 49, 46 and 71 days, for Tohoku, Haiti and Samoa earthquakes, respectively, with each at time resolution of 2 h. In the case of Tohoku earthquake, the results show that the difference between the predicted value obtained from the SVM method and the observed value reaches the maximum value (i.e., 129.31 TECU at earthquake time in a period of high geomagnetic activities. The SVM method detected a considerable number of anomalous occurrences 1 and 2 days prior to the Haiti earthquake and also 1 and 5 days before the Samoa earthquake in a period of low geomagnetic activities. In order to show that the method is acting sensibly with regard to the results extracted during nonevent and event TEC data, i.e., to perform some null-hypothesis tests in which the methods would also be calibrated, the same period of data from the previous year of the Samoa earthquake date has been taken into the account. Further to this, in this study, the detected TEC anomalies using the SVM method were compared to the previous results (Akhoondzadeh and Saradjian, 2011; Akhoondzadeh, 2012 obtained from the mean, median, wavelet and Kalman filter methods. The SVM detected anomalies are similar to those detected using the previous methods. It can be concluded that SVM can be a suitable learning method

  7. 3D Scene Priors for Road Detection

    NARCIS (Netherlands)

    J.M. Alvarez; T. Gevers; A.M. Lopez

    2010-01-01

    Vision-based road detection is important in different areas of computer vision such as autonomous driving, car collision warning and pedestrian crossing detection. However, current vision-based road detection methods are usually based on low-level features and they assume structured roads, road homo

  8. Lidar detection algorithm for time and range anomalies

    Science.gov (United States)

    Ben-David, Avishai; Davidson, Charles E.; Vanderbeek, Richard G.

    2007-10-01

    A new detection algorithm for lidar applications has been developed. The detection is based on hyperspectral anomaly detection that is implemented for time anomaly where the question "is a target (aerosol cloud) present at range R within time t1 to t2" is addressed, and for range anomaly where the question "is a target present at time t within ranges R1 and R2" is addressed. A detection score significantly different in magnitude from the detection scores for background measurements suggests that an anomaly (interpreted as the presence of a target signal in space/time) exists. The algorithm employs an option for a preprocessing stage where undesired oscillations and artifacts are filtered out with a low-rank orthogonal projection technique. The filtering technique adaptively removes the one over range-squared dependence of the background contribution of the lidar signal and also aids visualization of features in the data when the signal-to-noise ratio is low. A Gaussian-mixture probability model for two hypotheses (anomaly present or absent) is computed with an expectation-maximization algorithm to produce a detection threshold and probabilities of detection and false alarm. Results of the algorithm for CO2 lidar measurements of bioaerosol clouds Bacillus atrophaeus (formerly known as Bacillus subtilis niger, BG) and Pantoea agglomerans, Pa (formerly known as Erwinia herbicola, Eh) are shown and discussed.

  9. A New Methodology for Early Anomaly Detection of BWR Instabilities

    Energy Technology Data Exchange (ETDEWEB)

    Ivanov, K. N.

    2005-11-27

    The objective of the performed research is to develop an early anomaly detection methodology so as to enhance safety, availability, and operational flexibility of Boiling Water Reactor (BWR) nuclear power plants. The technical approach relies on suppression of potential power oscillations in BWRs by detecting small anomalies at an early stage and taking appropriate prognostic actions based on an anticipated operation schedule. The research utilizes a model of coupled (two-phase) thermal-hydraulic and neutron flux dynamics, which is used as a generator of time series data for anomaly detection at an early stage. The model captures critical nonlinear features of coupled thermal-hydraulic and nuclear reactor dynamics and (slow time-scale) evolution of the anomalies as non-stationary parameters. The time series data derived from this nonlinear non-stationary model serves as the source of information for generating the symbolic dynamics for characterization of model parameter changes that quantitatively represent small anomalies. The major focus of the presented research activity was on developing and qualifying algorithms of pattern recognition for power instability based on anomaly detection from time series data, which later can be used to formulate real-time decision and control algorithms for suppression of power oscillations for a variety of anticipated operating conditions. The research being performed in the framework of this project is essential to make significant improvement in the capability of thermal instability analyses for enhancing safety, availability, and operational flexibility of currently operating and next generation BWRs.

  10. Amalgamation of Anomaly-Detection Indices for Enhanced Process Monitoring

    KAUST Repository

    Harrou, Fouzi

    2016-01-29

    Accurate and effective anomaly detection and diagnosis of modern industrial systems are crucial for ensuring reliability and safety and for maintaining desired product quality. Anomaly detection based on principal component analysis (PCA) has been studied intensively and largely applied to multivariate processes with highly cross-correlated process variables; howver conventional PCA-based methods often fail to detect small or moderate anomalies. In this paper, the proposed approach integrates two popular process-monitoring detection tools, the conventional PCA-based monitoring indices Hotelling’s T2 and Q and the exponentially weighted moving average (EWMA). We develop two EWMA tools based on the Q and T2 statistics, T2-EWMA and Q-EWMA, to detect anomalies in the process mean. The performances of the proposed methods were compared with that of conventional PCA-based anomaly-detection methods by applying each method to two examples: a synthetic data set and experimental data collected from a flow heating system. The results clearly show the benefits and effectiveness of the proposed methods over conventional PCA-based methods.

  11. Anomalies.

    Science.gov (United States)

    Online-Offline, 1999

    1999-01-01

    This theme issue on anomalies includes Web sites, CD-ROMs and software, videos, books, and additional resources for elementary and junior high school students. Pertinent activities are suggested, and sidebars discuss UFOs, animal anomalies, and anomalies from nature; and resources covering unexplained phenonmenas like crop circles, Easter Island,…

  12. Unfolding the procedure of characterizing recorded ultra low frequency, kHZ and MHz electromagnetic anomalies prior to the L'Aquila earthquake as pre-seismic ones. Part II

    CERN Document Server

    Eftaxias, K; Contoyiannis, Y; Papadimitriou, C; Kalimeri, M; Kopanas, J; Antonopoulos, G; Nomicos, C

    2009-01-01

    Ultra low frequency-ULF (1 Hz or lower), kHz and MHz electromagnetic (EM) anomalies were recorded prior to the L'Aquila catastrophic earthquake (EQ) that occurred on April 6, 2009. The detected anomalies followed this temporal scheme. (i) The MHZ EM anomalies were detected on March 26, 2009 and April 2, 2009. The kHz EM anomalies were emerged on April, 4 2009. The ULF EM anomaly was continuously recorded from March 29, 2009 up to April 2, 2009. "Are EQs predictable?" is a question hotly debated in the science community. Its answer begs for another question: "Are there credible EQ precursors?". Despite fairly abundant circumstantial evidence pre-seismic EM signals have not been adequately accepted as real physical quantities. Therefore, the question effortlessly arises as to whether the observed anomalies before the L'Aquila EQ were seismogenic or not. The main goal of this work is to provide some insight into this issue.

  13. SCADA Protocol Anomaly Detection Utilizing Compression (SPADUC) 2013

    Energy Technology Data Exchange (ETDEWEB)

    Gordon Rueff; Lyle Roybal; Denis Vollmer

    2013-01-01

    There is a significant need to protect the nation’s energy infrastructures from malicious actors using cyber methods. Supervisory, Control, and Data Acquisition (SCADA) systems may be vulnerable due to the insufficient security implemented during the design and deployment of these control systems. This is particularly true in older legacy SCADA systems that are still commonly in use. The purpose of INL’s research on the SCADA Protocol Anomaly Detection Utilizing Compression (SPADUC) project was to determine if and how data compression techniques could be used to identify and protect SCADA systems from cyber attacks. Initially, the concept was centered on how to train a compression algorithm to recognize normal control system traffic versus hostile network traffic. Because large portions of the TCP/IP message traffic (called packets) are repetitive, the concept of using compression techniques to differentiate “non-normal” traffic was proposed. In this manner, malicious SCADA traffic could be identified at the packet level prior to completing its payload. Previous research has shown that SCADA network traffic has traits desirable for compression analysis. This work investigated three different approaches to identify malicious SCADA network traffic using compression techniques. The preliminary analyses and results presented herein are clearly able to differentiate normal from malicious network traffic at the packet level at a very high confidence level for the conditions tested. Additionally, the master dictionary approach used in this research appears to initially provide a meaningful way to categorize and compare packets within a communication channel.

  14. Visual analytics of anomaly detection in large data streams

    Science.gov (United States)

    Hao, Ming C.; Dayal, Umeshwar; Keim, Daniel A.; Sharma, Ratnesh K.; Mehta, Abhay

    2009-01-01

    Most data streams usually are multi-dimensional, high-speed, and contain massive volumes of continuous information. They are seen in daily applications, such as telephone calls, retail sales, data center performance, and oil production operations. Many analysts want insight into the behavior of this data. They want to catch the exceptions in flight to reveal the causes of the anomalies and to take immediate action. To guide the user in finding the anomalies in the large data stream quickly, we derive a new automated neighborhood threshold marking technique, called AnomalyMarker. This technique is built on cell-based data streams and user-defined thresholds. We extend the scope of the data points around the threshold to include the surrounding areas. The idea is to define a focus area (marked area) which enables users to (1) visually group the interesting data points related to the anomalies (i.e., problems that occur persistently or occasionally) for observing their behavior; (2) discover the factors related to the anomaly by visualizing the correlations between the problem attribute with the attributes of the nearby data items from the entire multi-dimensional data stream. Mining results are quickly presented in graphical representations (i.e., tooltip) for the user to zoom into the problem regions. Different algorithms are introduced which try to optimize the size and extent of the anomaly markers. We have successfully applied this technique to detect data stream anomalies in large real-world enterprise server performance and data center energy management.

  15. Probabilistic Anomaly Detection Based On System Calls Analysis

    Directory of Open Access Journals (Sweden)

    Przemysław Maciołek

    2007-01-01

    Full Text Available We present an application of probabilistic approach to the anomaly detection (PAD. Byanalyzing selected system calls (and their arguments, the chosen applications are monitoredin the Linux environment. This allows us to estimate “(abnormality” of their behavior (bycomparison to previously collected profiles. We’ve attached results of threat detection ina typical computer environment.

  16. Poseidon: a 2-tier anomaly-based intrusion detection system

    NARCIS (Netherlands)

    Bolzoni, Damiano; Zambon, Emmanuele; Etalle, Sandro; Hartel, Pieter

    2005-01-01

    We present Poseidon, a new anomaly based intrusion detection system. Poseidon is payload-based, and presents a two-tier architecture: the first stage consists of a Self-Organizing Map, while the second one is a modified PAYL system. Our benchmarks on the 1999 DARPA data set show a higher detection r

  17. Anomaly Detection In Additively Manufactured Parts Using Laser Doppler Vibrometery

    Energy Technology Data Exchange (ETDEWEB)

    Hernandez, Carlos A. [Lawrence Livermore National Lab. (LLNL), Livermore, CA (United States)

    2015-09-29

    Additively manufactured parts are susceptible to non-uniform structure caused by the unique manufacturing process. This can lead to structural weakness or catastrophic failure. Using laser Doppler vibrometry and frequency response analysis, non-contact detection of anomalies in additively manufactured parts may be possible. Preliminary tests show promise for small scale detection, but more future work is necessary.

  18. Anomaly detection of blast furnace condition using tuyere cameras

    Science.gov (United States)

    Yamahira, Naoshi; Hirata, Takehide; Tsuda, Kazuro; Morikawa, Yasuyuki; Takata, Yousuke

    2016-09-01

    We present a method of anomaly detection using multivariate statistical process control(MSPC) to detect the abnormal behaviors of a blast furnace. Tuyere cameras attached circumferentially at the lower side of a blast furnace are used to monitor the inside of the furnace and this method extracts abnormal behaviors of intensities. It is confirmed that with our method, detecting timing is earlier than operators' notice. Besides, misalignment of cameras doesn't affect detecting performance, which is important property in actual use.

  19. Dependence-Based Anomaly Detection Methodologies

    Science.gov (United States)

    2012-08-16

    tricks the user to enter their Netflix login. Detecting it is out of our scope and requires site authentication (i.e., certification verification... Netflix login. Detecting it is out of our scope and requires site authentication (i.e., certification verification) and user education. The preliminary

  20. Anomaly Detection with Score functions based on Nearest Neighbor Graphs

    CERN Document Server

    Zhao, Manqi

    2009-01-01

    We propose a novel non-parametric adaptive anomaly detection algorithm for high dimensional data based on score functions derived from nearest neighbor graphs on $n$-point nominal data. Anomalies are declared whenever the score of a test sample falls below $\\alpha$, which is supposed to be the desired false alarm level. The resulting anomaly detector is shown to be asymptotically optimal in that it is uniformly most powerful for the specified false alarm level, $\\alpha$, for the case when the anomaly density is a mixture of the nominal and a known density. Our algorithm is computationally efficient, being linear in dimension and quadratic in data size. It does not require choosing complicated tuning parameters or function approximation classes and it can adapt to local structure such as local change in dimensionality. We demonstrate the algorithm on both artificial and real data sets in high dimensional feature spaces.

  1. A hybrid approach for efficient anomaly detection using metaheuristic methods

    Directory of Open Access Journals (Sweden)

    Tamer F. Ghanem

    2015-07-01

    Full Text Available Network intrusion detection based on anomaly detection techniques has a significant role in protecting networks and systems against harmful activities. Different metaheuristic techniques have been used for anomaly detector generation. Yet, reported literature has not studied the use of the multi-start metaheuristic method for detector generation. This paper proposes a hybrid approach for anomaly detection in large scale datasets using detectors generated based on multi-start metaheuristic method and genetic algorithms. The proposed approach has taken some inspiration of negative selection-based detector generation. The evaluation of this approach is performed using NSL-KDD dataset which is a modified version of the widely used KDD CUP 99 dataset. The results show its effectiveness in generating a suitable number of detectors with an accuracy of 96.1% compared to other competitors of machine learning algorithms.

  2. On-line intermittent connector anomaly detection

    Data.gov (United States)

    National Aeronautics and Space Administration — This paper investigates a non-traditional use of differential current sensor and current sensor to detect intermittent disconnection problems in connectors. An...

  3. Anomaly Detection Based on Sensor Data in Petroleum Industry Applications

    Directory of Open Access Journals (Sweden)

    Luis Martí

    2015-01-01

    Full Text Available Anomaly detection is the problem of finding patterns in data that do not conform to an a priori expected behavior. This is related to the problem in which some samples are distant, in terms of a given metric, from the rest of the dataset, where these anomalous samples are indicated as outliers. Anomaly detection has recently attracted the attention of the research community, because of its relevance in real-world applications, like intrusion detection, fraud detection, fault detection and system health monitoring, among many others. Anomalies themselves can have a positive or negative nature, depending on their context and interpretation. However, in either case, it is important for decision makers to be able to detect them in order to take appropriate actions. The petroleum industry is one of the application contexts where these problems are present. The correct detection of such types of unusual information empowers the decision maker with the capacity to act on the system in order to correctly avoid, correct or react to the situations associated with them. In that application context, heavy extraction machines for pumping and generation operations, like turbomachines, are intensively monitored by hundreds of sensors each that send measurements with a high frequency for damage prevention. In this paper, we propose a combination of yet another segmentation algorithm (YASA, a novel fast and high quality segmentation algorithm, with a one-class support vector machine approach for efficient anomaly detection in turbomachines. The proposal is meant for dealing with the aforementioned task and to cope with the lack of labeled training data. As a result, we perform a series of empirical studies comparing our approach to other methods applied to benchmark problems and a real-life application related to oil platform turbomachinery anomaly detection.

  4. Anomaly detection based on sensor data in petroleum industry applications.

    Science.gov (United States)

    Martí, Luis; Sanchez-Pi, Nayat; Molina, José Manuel; Garcia, Ana Cristina Bicharra

    2015-01-27

    Anomaly detection is the problem of finding patterns in data that do not conform to an a priori expected behavior. This is related to the problem in which some samples are distant, in terms of a given metric, from the rest of the dataset, where these anomalous samples are indicated as outliers. Anomaly detection has recently attracted the attention of the research community, because of its relevance in real-world applications, like intrusion detection, fraud detection, fault detection and system health monitoring, among many others. Anomalies themselves can have a positive or negative nature, depending on their context and interpretation. However, in either case, it is important for decision makers to be able to detect them in order to take appropriate actions. The petroleum industry is one of the application contexts where these problems are present. The correct detection of such types of unusual information empowers the decision maker with the capacity to act on the system in order to correctly avoid, correct or react to the situations associated with them. In that application context, heavy extraction machines for pumping and generation operations, like turbomachines, are intensively monitored by hundreds of sensors each that send measurements with a high frequency for damage prevention. In this paper, we propose a combination of yet another segmentation algorithm (YASA), a novel fast and high quality segmentation algorithm, with a one-class support vector machine approach for efficient anomaly detection in turbomachines. The proposal is meant for dealing with the aforementioned task and to cope with the lack of labeled training data. As a result, we perform a series of empirical studies comparing our approach to other methods applied to benchmark problems and a real-life application related to oil platform turbomachinery anomaly detection.

  5. Novel anomaly detection approach for telecommunication network proactive performance monitoring

    Institute of Scientific and Technical Information of China (English)

    Yanhua YU; Jun WANG; Xiaosu ZHAN; Junde SONG

    2009-01-01

    The mode of telecommunication network management is changing from "network oriented" to "subscriber oriented". Aimed at enhancing subscribers'feeling, proactive performance monitoring (PPM) can enable a fast fault correction by detecting anomalies designating performance degradation. In this paper, a novel anomaly detection approach is the proposed taking advantage of time series prediction and the associated confidence interval based on multiplicative autoregressive integrated moving average (ARIMA). Furthermore, under the assumption that the training residual is a white noise process following a normal distribution, the associated confidence interval of prediction can be figured out under any given confidence degree 1-α by constructing random variables satisfying t distribution. Experimental results verify the method's effectiveness.

  6. Anomaly detection using classified eigenblocks in GPR image

    Science.gov (United States)

    Kim, Min Ju; Kim, Seong Dae; Lee, Seung-eui

    2016-05-01

    Automatic landmine detection system using ground penetrating radar has been widely researched. For the automatic mine detection system, system speed is an important factor. Many techniques for mine detection have been developed based on statistical background. Among them, a detection technique employing the Principal Component Analysis(PCA) has been used for clutter reduction and anomaly detection. However, the PCA technique can retard the entire process, because of large basis dimension and a numerous number of inner product operations. In order to overcome this problem, we propose a fast anomaly detection system using 2D DCT and PCA. Our experiments use a set of data obtained from a test site where the anti-tank and anti- personnel mines are buried. We evaluate the proposed system in terms of the ROC curve. The result shows that the proposed system performs much better than the conventional PCA systems from the viewpoint of speed and false alarm rate.

  7. Anomaly detection for machine learning redshifts applied to SDSS galaxies

    CERN Document Server

    Hoyle, Ben; Paech, Kerstin; Bonnett, Christopher; Seitz, Stella; Weller, Jochen

    2015-01-01

    We present an analysis of anomaly detection for machine learning redshift estimation. Anomaly detection allows the removal of poor training examples, which can adversely influence redshift estimates. Anomalous training examples may be photometric galaxies with incorrect spectroscopic redshifts, or galaxies with one or more poorly measured photometric quantity. We select 2.5 million 'clean' SDSS DR12 galaxies with reliable spectroscopic redshifts, and 6730 'anomalous' galaxies with spectroscopic redshift measurements which are flagged as unreliable. We contaminate the clean base galaxy sample with galaxies with unreliable redshifts and attempt to recover the contaminating galaxies using the Elliptical Envelope technique. We then train four machine learning architectures for redshift analysis on both the contaminated sample and on the preprocessed 'anomaly-removed' sample and measure redshift statistics on a clean validation sample generated without any preprocessing. We find an improvement on all measured stat...

  8. Incremental Commute Time Distance and Applications in Anomaly Detection Systems

    CERN Document Server

    Khoa, Nguyen Lu Dang

    2011-01-01

    Commute Time Distance (CTD) is a random walk based metric on graphs. CTD has found widespread applications in many domains including personalized search, collaborative filtering and making search engines robust against manipulation. Our interest is inspired by the use of CTD as a metric for anomaly detection. It has been shown that CTD can be used to simultaneously identify both global and local anomalies. Here we propose an accurate and efficient approximation for computing the CTD in an incremental fashion in order to facilitate real-time applications. An online anomaly detection algorithm is designed where the CTD of each new arriving data point to any point in the current graph can be estimated in constant time ensuring a real-time response. Moreover, the proposed approach can also be applied in many other applications that utilize commute time distance.

  9. Detection of data taking anomalies for the ATLAS experiment

    CERN Document Server

    De Castro Vargas Fernandes, Julio; The ATLAS collaboration; Lehmann Miotto, Giovanna

    2015-01-01

    The physics signals produced by the ATLAS detector at the Large Hadron Collider (LHC) at CERN are acquired and selected by a distributed Trigger and Data AcQuistition (TDAQ) system, comprising a large number of hardware devices and software components. In this work, we focus on the problem of online detection of anomalies along the data taking period. Anomalies, in this context, are defined as an unexpected behaviour of the TDAQ system that result in a loss of data taking efficiency: the causes for those anomalies may come from the TDAQ itself or from external sources. While the TDAQ system operates, it publishes several useful information (trigger rates, dead times, memory usage…). Such information over time creates a set of time series that can be monitored in order to detect (and react to) problems (or anomalies). Here, we approach TDAQ operation monitoring through a data quality perspective, i.e, an anomaly is seen as a loss of quality (an outlier) and it is reported: this information can be used to rea...

  10. The use of Compton scattering in detecting anomaly in soil-possible use in pyromaterial detection

    Science.gov (United States)

    Abedin, Ahmad Firdaus Zainal; Ibrahim, Noorddin; Zabidi, Noriza Ahmad; Demon, Siti Zulaikha Ngah

    2016-01-01

    The Compton scattering is able to determine the signature of land mine detection based on dependency of density anomaly and energy change of scattered photons. In this study, 4.43 MeV gamma of the Am-Be source was used to perform Compton scattering. Two detectors were placed between source with distance of 8 cm and radius of 1.9 cm. Detectors of thallium-doped sodium iodide NaI(TI) was used for detecting gamma ray. There are 9 anomalies used in this simulation. The physical of anomaly is in cylinder form with radius of 10 cm and 8.9 cm height. The anomaly is buried 5 cm deep in the bed soil measured 80 cm radius and 53.5 cm height. Monte Carlo methods indicated the scattering of photons is directly proportional to density of anomalies. The difference between detector response with anomaly and without anomaly namely contrast ratio values are in a linear relationship with density of anomalies. Anomalies of air, wood and water give positive contrast ratio values whereas explosive, sand, concrete, graphite, limestone and polyethylene give negative contrast ratio values. Overall, the contrast ratio values are greater than 2 % for all anomalies. The strong contrast ratios result a good detection capability and distinction between anomalies.

  11. The use of Compton scattering in detecting anomaly in soil-possible use in pyromaterial detection

    Energy Technology Data Exchange (ETDEWEB)

    Abedin, Ahmad Firdaus Zainal; Ibrahim, Noorddin [Department of Defence Science, Universiti Pertahanan Nasional Malaysia, Kem Sungai Besi, Kuala Lumpur 57000 (Malaysia); Zabidi, Noriza Ahmad; Demon, Siti Zulaikha Ngah [Centre for Foundation Studies, Universiti Pertahanan Nasional Malaysia, Kem Sungai Besi, Kuala Lumpur 57000 (Malaysia)

    2016-01-22

    The Compton scattering is able to determine the signature of land mine detection based on dependency of density anomaly and energy change of scattered photons. In this study, 4.43 MeV gamma of the Am-Be source was used to perform Compton scattering. Two detectors were placed between source with distance of 8 cm and radius of 1.9 cm. Detectors of thallium-doped sodium iodide NaI(TI) was used for detecting gamma ray. There are 9 anomalies used in this simulation. The physical of anomaly is in cylinder form with radius of 10 cm and 8.9 cm height. The anomaly is buried 5 cm deep in the bed soil measured 80 cm radius and 53.5 cm height. Monte Carlo methods indicated the scattering of photons is directly proportional to density of anomalies. The difference between detector response with anomaly and without anomaly namely contrast ratio values are in a linear relationship with density of anomalies. Anomalies of air, wood and water give positive contrast ratio values whereas explosive, sand, concrete, graphite, limestone and polyethylene give negative contrast ratio values. Overall, the contrast ratio values are greater than 2 % for all anomalies. The strong contrast ratios result a good detection capability and distinction between anomalies.

  12. Monitoring water supply systems for anomaly detection and response

    NARCIS (Netherlands)

    Bakker, M.; Lapikas, T.; Tangena, B.H.; Vreeburg, J.H.G.

    2012-01-01

    Water supply systems are vulnerable to damage caused by unintended or intended human actions, or due to aging of the system. In order to minimize the damages and the inconvenience for the customers, a software tool was developed to detect anomalies at an early stage, and to support the responsible s

  13. FLEAD: online frequency likelihood estimation anomaly detection for mobile sensing

    NARCIS (Netherlands)

    Le, Viet-Duc; Scholten, Hans; Havinga, Paul

    2013-01-01

    With the rise of smartphone platforms, adaptive sensing becomes an predominant key to overcome intricate constraints such as smartphone's capabilities and dynamic data. One way to do this is estimating the event probability based on anomaly detection to invoke heavy processes, such as switching on m

  14. Dendritic Cells for Real-Time Anomaly Detection

    CERN Document Server

    Greensmith, Julie

    2010-01-01

    Dendritic Cells (DCs) are innate immune system cells which have the power to activate or suppress the immune system. The behaviour of human of human DCs is abstracted to form an algorithm suitable for anomaly detection. We test this algorithm on the real-time problem of port scan detection. Our results show a significant difference in artificial DC behaviour for an outgoing portscan when compared to behaviour for normal processes.

  15. Limitations of Aneuploidy and Anomaly Detection in the Obese Patient

    Directory of Open Access Journals (Sweden)

    Paula Zozzaro-Smith

    2014-07-01

    Full Text Available Obesity is a worldwide epidemic and can have a profound effect on pregnancy risks. Obese patients tend to be older and are at increased risk for structural fetal anomalies and aneuploidy, making screening options critically important for these women. Failure rates for first-trimester nuchal translucency (NT screening increase with obesity, while the ability to detect soft-markers declines, limiting ultrasound-based screening options. Obesity also decreases the chances of completing the anatomy survey and increases the residual risk of undetected anomalies. Additionally, non-invasive prenatal testing (NIPT is less likely to provide an informative result in obese patients. Understanding the limitations and diagnostic accuracy of aneuploidy and anomaly screening in obese patients can help guide clinicians in counseling patients on the screening options.

  16. Extending TOPS: Ontology-driven Anomaly Detection and Analysis System

    Science.gov (United States)

    Votava, P.; Nemani, R. R.; Michaelis, A.

    2010-12-01

    Terrestrial Observation and Prediction System (TOPS) is a flexible modeling software system that integrates ecosystem models with frequent satellite and surface weather observations to produce ecosystem nowcasts (assessments of current conditions) and forecasts useful in natural resources management, public health and disaster management. We have been extending the Terrestrial Observation and Prediction System (TOPS) to include a capability for automated anomaly detection and analysis of both on-line (streaming) and off-line data. In order to best capture the knowledge about data hierarchies, Earth science models and implied dependencies between anomalies and occurrences of observable events such as urbanization, deforestation, or fires, we have developed an ontology to serve as a knowledge base. We can query the knowledge base and answer questions about dataset compatibilities, similarities and dependencies so that we can, for example, automatically analyze similar datasets in order to verify a given anomaly occurrence in multiple data sources. We are further extending the system to go beyond anomaly detection towards reasoning about possible causes of anomalies that are also encoded in the knowledge base as either learned or implied knowledge. This enables us to scale up the analysis by eliminating a large number of anomalies early on during the processing by either failure to verify them from other sources, or matching them directly with other observable events without having to perform an extensive and time-consuming exploration and analysis. The knowledge is captured using OWL ontology language, where connections are defined in a schema that is later extended by including specific instances of datasets and models. The information is stored using Sesame server and is accessible through both Java API and web services using SeRQL and SPARQL query languages. Inference is provided using OWLIM component integrated with Sesame.

  17. Summary of Anomaly-Detection Approaches%异常检测方法综述

    Institute of Scientific and Technical Information of China (English)

    张剑; 龚俭

    2003-01-01

    The approachof anomaly detection is a vigorously adaptive technique because it can detect unknown intrusions. The paper summarizes the advantage and the shortcoming of known anomaly-detection approaches in the past,which is based on the model of intrusion detection proposed by Dorothy Denning. Moreover ,the development current of anomaly-detection is proposed on the above.

  18. Information Fusion for Anomaly Detection with the Dendritic Cell Algorithm

    CERN Document Server

    Greensmith, Julie; Tedesco, Gianni

    2010-01-01

    Dendritic cells are antigen presenting cells that provide a vital link between the innate and adaptive immune system, providing the initial detection of pathogenic invaders. Research into this family of cells has revealed that they perform information fusion which directs immune responses. We have derived a Dendritic Cell Algorithm based on the functionality of these cells, by modelling the biological signals and differentiation pathways to build a control mechanism for an artificial immune system. We present algorithmic details in addition to experimental results, when the algorithm was applied to anomaly detection for the detection of port scans. The results show the Dendritic Cell Algorithm is sucessful at detecting port scans.

  19. A new data normalization method for unsupervised anomaly intrusion detection

    Institute of Scientific and Technical Information of China (English)

    Long-zheng CAI; Jian CHEN; Yun KE; Tao CHEN; Zhi-gang LI

    2010-01-01

    Unsupervised anomaly detection can detect attacks without the need for clean or labeled training data.This paper studies the application of clustering to unsupervised anomaly detection(ACUAD).Data records are mapped to a feature space.Anomalies are detected by determining which points lie in the sparse regions of the feature space.A critical element for this method to be effective is the definition of the distance function between data records.We propose a unified normalization distance framework for records with numeric and nominal features mixed data.A heuristic method that computes the distance for nominal features is proposed,taking advantage of an important characteristic of nominal features-their probability distribution.Then,robust methods are proposed for mapping numeric features and computing their distance,these being able to tolerate the impact of the value difference in scale and diversification among features,and outliers introduced by intrusions.Empirical experiments with the KDD 1999 dataset showed that ACUAD can detect intrusions with relatively low false alarm rates compared with other approaches.

  20. ANOMALY DETECTION AND ATTRIBUTION USING AUTO FORECAST AND DIRECTED GRAPHS

    Directory of Open Access Journals (Sweden)

    Vivek Sankar

    2016-03-01

    Full Text Available In the business world, decision makers rely heavily on data to back their decisions. With the quantum of data increasing rapidly, traditional methods used to generate insights from reports and dashboards will soon become intractable. This creates a need for efficient systems which can substitute human intelligence and reduce time latency in decision making. This paper describes an approach to process time series data with multiple dimensions such as geographies, verticals, products, efficiently, and to detect anomalies in the data and further, to explain potential reasons for the occurrence of the anomalies. The algorithm implements auto selection of forecast models to make reliable forecasts and detect such anomalies. Depth First Search (DFS is applied to analyse each of these anomalies and find its root causes. The algorithm filters the redundant causes and reports the insights to the stakeholders. Apart from being a hair-trigger KPI tracking mechanism, this algorithm can also be customized for problems lke A/B testing, campaign tracking and product evaluations.

  1. Anomaly Detection for Next-Generation Space Launch Ground Operations

    Science.gov (United States)

    Spirkovska, Lilly; Iverson, David L.; Hall, David R.; Taylor, William M.; Patterson-Hine, Ann; Brown, Barbara; Ferrell, Bob A.; Waterman, Robert D.

    2010-01-01

    NASA is developing new capabilities that will enable future human exploration missions while reducing mission risk and cost. The Fault Detection, Isolation, and Recovery (FDIR) project aims to demonstrate the utility of integrated vehicle health management (IVHM) tools in the domain of ground support equipment (GSE) to be used for the next generation launch vehicles. In addition to demonstrating the utility of IVHM tools for GSE, FDIR aims to mature promising tools for use on future missions and document the level of effort - and hence cost - required to implement an application with each selected tool. One of the FDIR capabilities is anomaly detection, i.e., detecting off-nominal behavior. The tool we selected for this task uses a data-driven approach. Unlike rule-based and model-based systems that require manual extraction of system knowledge, data-driven systems take a radically different approach to reasoning. At the basic level, they start with data that represent nominal functioning of the system and automatically learn expected system behavior. The behavior is encoded in a knowledge base that represents "in-family" system operations. During real-time system monitoring or during post-flight analysis, incoming data is compared to that nominal system operating behavior knowledge base; a distance representing deviation from nominal is computed, providing a measure of how far "out of family" current behavior is. We describe the selected tool for FDIR anomaly detection - Inductive Monitoring System (IMS), how it fits into the FDIR architecture, the operations concept for the GSE anomaly monitoring, and some preliminary results of applying IMS to a Space Shuttle GSE anomaly.

  2. Anomaly Detection in Clutter using Spectrally Enhanced Ladar

    CERN Document Server

    Chhabra, Puneet S; Hopgood, James R

    2016-01-01

    Discrete return (DR) Laser Detection and Ranging (Ladar) systems provide a series of echoes that reflect from objects in a scene. These can be first, last or multi-echo returns. In contrast, Full-Waveform (FW)-Ladar systems measure the intensity of light reflected from objects continuously over a period of time. In a camouflaged scenario, e.g., objects hidden behind dense foliage, a FW-Ladar penetrates such foliage and returns a sequence of echoes including buried faint echoes. The aim of this paper is to learn local-patterns of co-occurring echoes characterised by their measured spectra. A deviation from such patterns defines an abnormal event in a forest/tree depth profile. As far as the authors know, neither DR or FW-Ladar, along with several spectral measurements, has not been applied to anomaly detection. This work presents an algorithm that allows detection of spectral and temporal anomalies in FW-Multi Spectral Ladar (FW-MSL) data samples. An anomaly is defined as a full waveform temporal and spectral ...

  3. Detecting Anomaly in Traffic Flow from Road Similarity Analysis

    KAUST Repository

    Liu, Xinran

    2016-06-02

    Taxies equipped with GPS devices are considered as 24-hour moving sensors widely distributed in urban road networks. Plenty of accurate and realtime trajectories of taxi are recorded by GPS devices and are commonly studied for understanding traffic dynamics. This paper focuses on anomaly detection in traffic volume, especially the non-recurrent traffic anomaly caused by unexpected or transient incidents, such as traffic accidents, celebrations and disasters. It is important to detect such sharp changes of traffic status for sensing abnormal events and planning their impact on the smooth volume of traffic. Unlike existing anomaly detection approaches that mainly monitor the derivation of current traffic status from history in the past, the proposed method in this paper evaluates the abnormal score of traffic on one road by comparing its current traffic volume with not only its historical data but also its neighbors. We define the neighbors as the roads that are close in sense of both geo-location and traffic patterns, which are extracted by matrix factorization. The evaluation results on trajectories data of 12,286 taxies over four weeks in Beijing show that our approach outperforms other baseline methods with higher precision and recall.

  4. Ensemble regression model-based anomaly detection for cyber-physical intrusion detection in smart grids

    DEFF Research Database (Denmark)

    Kosek, Anna Magdalena; Gehrke, Oliver

    2016-01-01

    on an ensemble of non-linear artificial neural network DER models which detect and evaluate anomalies in DER operation. The proposed method is validated against measurement data which yields a precision of 0.947 and an accuracy of 0.976. This improves the precision and accuracy of a classic model-based anomaly...

  5. Beyond Trisomy 21: Additional Chromosomal Anomalies Detected through Routine Aneuploidy Screening

    Directory of Open Access Journals (Sweden)

    Amy Metcalfe

    2014-04-01

    Full Text Available Prenatal screening is often misconstrued by patients as screening for trisomy 21 alone; however, other chromosomal anomalies are often detected. This study aimed to systematically review the literature and use diagnostic meta-analysis to derive pooled detection and false positive rates for aneuploidies other than trisomy 21 with different prenatal screening tests. Non-invasive prenatal testing had the highest detection (DR and lowest false positive (FPR rates for trisomy 13 (DR: 90.3%; FPR: 0.2%, trisomy 18 (DR: 98.1%; FPR: 0.2%, and 45,X (DR: 92.2%; FPR: 0.1%; however, most estimates came from high-risk samples. The first trimester combined test also had high DRs for all conditions studied (trisomy 13 DR: 83.1%; FPR: 4.4%; trisomy 18 DR: 91.9%; FPR: 3.5%; 45,X DR: 70.1%; FPR: 5.4%; triploidy DR: 100%; FPR: 6.3%. Second trimester triple screening had the lowest DRs and highest FPRs for all conditions (trisomy 13 DR: 43.9%; FPR: 8.1%; trisomy 18 DR: 70.5%; FPR: 3.3%; 45,X DR: 77.2%; FPR: 9.3%. Prenatal screening tests differ in their ability to accurately detect chromosomal anomalies. Patients should be counseled about the ability of prenatal screening to detect anomalies other than trisomy 21 prior to undergoing screening.

  6. Bayesian Filtering Approaches for Detecting Anomalies in Environmental Sensor Data

    Science.gov (United States)

    Hill, D. J.; Minsker, B. S.

    2006-12-01

    Recent advances in sensor technology are facilitating the deployment of sensors into the environment that can produce measurements at high spatial and/or temporal resolutions. Not only can these data be used to better characterize the system for improved modeling, but they can also be used to produce better understandings of the mechanisms of environmental processes. One such use of these data is anomaly detection to identify data that deviate from historical patterns. These anomalous data can be caused by sensor or data transmission errors or by infrequent system behaviors that are often of interest to the scientific or public safety communities. Thus, anomaly detection has many practical applications, such as data quality assurance and control (QA/QC), where anomalous data are treated as data errors; focused data collection, where anomalous data indicate segments of data that are of interest to researchers; or event detection, where anomalous data signal system behaviors that could result in a natural disaster, for example. Traditionally, most anomaly detection has been carried out manually with the assistance of data visualization tools; however, due to the large volume of data produced by environmental sensors, manual techniques are not always feasible. This study develops an automated anomaly detection method that employs dynamic Bayesian networks (DBNs) to model the states of the environmental system in which the sensors are deployed. The DBN is an artificial intelligence technique that models the evolution of the discrete and/or continuous valued states of a dynamic system by tracking changes in the system states over time. Two commonly used types of DBNs are hidden Markov models and Kalman filters. In this study, DBNs will be used to predict the expected value of unknown system states, as well as the likelihood of particular sensor measurements of those states. Unlikely measurements are then considered anomalous. The performance of the DBN based anomaly

  7. Tiresias: Online Anomaly Detection for Hierarchical Operational Network Data

    CERN Document Server

    Hong, Chi-Yao; Duffield, Nick; Wang, Jia

    2012-01-01

    Operational network data, management data such as customer care call logs and equipment system logs, is a very important source of information for network operators to detect problems in their networks. Unfortunately, there is lack of efficient tools to automatically track and detect anomalous events on operational data, causing ISP operators to rely on manual inspection of this data. While anomaly detection has been widely studied in the context of network data, operational data presents several new challenges, including the volatility and sparseness of data, and the need to perform fast detection (complicating application of schemes that require offline processing or large/stable data sets to converge). To address these challenges, we propose Tiresias, an automated approach to locating anomalous events on hierarchical operational data. Tiresias leverages the hierarchical structure of operational data to identify high-impact aggregates (e.g., locations in the network, failure modes) likely to be associated w...

  8. Detection of Cardiovascular Anomalies: An Observer-Based Approach

    KAUST Repository

    Ledezma, Fernando

    2012-07-01

    In this thesis, a methodology for the detection of anomalies in the cardiovascular system is presented. The cardiovascular system is one of the most fascinating and complex physiological systems. Nowadays, cardiovascular diseases constitute one of the most important causes of mortality in the world. For instance, an estimate of 17.3 million people died in 2008 from cardiovascular diseases. Therefore, many studies have been devoted to modeling the cardiovascular system in order to better understand its behavior and find new reliable diagnosis techniques. The lumped parameter model of the cardiovascular system proposed in [1] is restructured using a hybrid systems approach in order to include a discrete input vector that represents the influence of the mitral and aortic valves in the different phases of the cardiac cycle. Parting from this model, a Taylor expansion around the nominal values of a vector of parameters is conducted. This expansion serves as the foundation for a component fault detection process to detect changes in the physiological parameters of the cardiovascular system which could be associated with cardiovascular anomalies such as atherosclerosis, aneurysm, high blood pressure, etc. An Extended Kalman Filter is used in order to achieve a joint estimation of the state vector and the changes in the considered parameters. Finally, a bank of filters is, as in [2], used in order to detect the appearance of heart valve diseases, particularly stenosis and regurgitation. The first numerical results obtained are presented.

  9. Fusion Schemes for Ensembles of Hyperspectral Anomaly Detection Algorithms

    Science.gov (United States)

    2011-03-01

    57  Appendix B:  Storyboard ...infrared images taken from a tower experiment conducted at the  White Sands Missile Range in New  Mexico  within hundreds of meters of the targets...confidence in the resulting identity declarations.   58    Appendix B: Storyboard Fusion Schemes for Ensembles of Hyperspectral Anomaly Detection

  10. Detecting Traffic Anomalies in Urban Areas Using Taxi GPS Data

    Directory of Open Access Journals (Sweden)

    Weiming Kuang

    2015-01-01

    Full Text Available Large-scale GPS data contain hidden information and provide us with the opportunity to discover knowledge that may be useful for transportation systems using advanced data mining techniques. In major metropolitan cities, many taxicabs are equipped with GPS devices. Because taxies operate continuously for nearly 24 hours per day, they can be used as reliable sensors for the perceived traffic state. In this paper, the entire city was divided into subregions by roads, and taxi GPS data were transformed into traffic flow data to build a traffic flow matrix. In addition, a highly efficient anomaly detection method was proposed based on wavelet transform and PCA (principal component analysis for detecting anomalous traffic events in urban regions. The traffic anomaly is considered to occur in a subregion when the values of the corresponding indicators deviate significantly from the expected values. This method was evaluated using a GPS dataset that was generated by more than 15,000 taxies over a period of half a year in Harbin, China. The results show that this detection method is effective and efficient.

  11. DeepAnomaly: Combining Background Subtraction and Deep Learning for Detecting Obstacles and Anomalies in an Agricultural Field

    Directory of Open Access Journals (Sweden)

    Peter Christiansen

    2016-11-01

    Full Text Available Convolutional neural network (CNN-based systems are increasingly used in autonomous vehicles for detecting obstacles. CNN-based object detection and per-pixel classification (semantic segmentation algorithms are trained for detecting and classifying a predefined set of object types. These algorithms have difficulties in detecting distant and heavily occluded objects and are, by definition, not capable of detecting unknown object types or unusual scenarios. The visual characteristics of an agriculture field is homogeneous, and obstacles, like people, animals and other obstacles, occur rarely and are of distinct appearance compared to the field. This paper introduces DeepAnomaly, an algorithm combining deep learning and anomaly detection to exploit the homogenous characteristics of a field to perform anomaly detection. We demonstrate DeepAnomaly as a fast state-of-the-art detector for obstacles that are distant, heavily occluded and unknown. DeepAnomaly is compared to state-of-the-art obstacle detectors including “Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks” (RCNN. In a human detector test case, we demonstrate that DeepAnomaly detects humans at longer ranges (45–90 m than RCNN. RCNN has a similar performance at a short range (0–30 m. However, DeepAnomaly has much fewer model parameters and (182 ms/25 ms = a 7.28-times faster processing time per image. Unlike most CNN-based methods, the high accuracy, the low computation time and the low memory footprint make it suitable for a real-time system running on a embedded GPU (Graphics Processing Unit.

  12. A Neural Network Approach for Misuse and Anomaly Intrusion Detection

    Institute of Scientific and Technical Information of China (English)

    YAO Yu; YU Ge; GAO Fu-xiang

    2005-01-01

    An MLP(Multi-Layer Perceptron)/Elman neural network is proposed in this paper, which realizes classification with memory of past events using the real-time classification of MLP and the memorial functionality of Elman. The system's sensitivity for the memory of past events can be easily reconfigured without retraining the whole network. This approach can be used for both misuse and anomaly detection system. The intrusion detection systems(IDSs) using the hybrid MLP/Elman neural network are evaluated by the intrusion detection evaluation data sponsored by U. S. Defense Advanced Research Projects Agency (DARPA). The results of experiment are presented in Receiver Operating Characteristic (ROC) curves. The capabilites of these IDSs to identify Deny of Service(DOS) and probing attacks are enhanced.

  13. Application of Improved SOM Neural Network in Anomaly Detection

    Science.gov (United States)

    Jiang, Xueying; Liu, Kean; Yan, Jiegou; Chen, Wenhui

    For the false alarm rate, false negative rate, training time and other issues of SOM neural network algorithm, the author Gives an improved anomaly detection SOM algorithm---FPSOM through the introduction of the learning rate, which can adaptively learn the original sample space, better reflects the status of the original data. At the same time, combined with the artificial neural network, The author also gives the intelligent detection model and the model of the training module, designed the main realization of FPSOM neural network algorithm, and finally simulation experiments were carried out in KDDCUP data sets. The experiments show that the new algorithm is better than SOM which can greatly shorten the training time, and effectively improve the detection rate and reduce the false positive rate.

  14. Precursor-Like Anomalies prior to the 2008 Wenchuan Earthquake: A Critical-but-Constructive Review

    Directory of Open Access Journals (Sweden)

    Tengfei Ma

    2012-01-01

    Full Text Available Results published since the last three years on the observations of the precursor-like anomalies before the May 12, 2008, Wenchuan, Ms8.0 earthquake are collected and analyzed. These retrospective case studies would have provided heuristic clues about the preparation process of this inland great earthquake and the predictability of this destructive event if the standards for the rigorous test of earthquake forecast schemes were strictly observed. At least in some of these studies, however, several issues still need to be further examined to confirm or falsify the connection of the reported observations with the Wenchuan earthquake. Some of the problems are due to the inevitable limitation of observational infrastructure at the recent time, but some of the problems are due to the lack of communication about the test of earthquake forecast schemes. For the interdisciplinary studies on earthquake forecast, reminding of the latter issue seems of special importance for promoting the works and cooperation in this field.

  15. Anomaly Detection in Test Equipment via Sliding Mode Observers

    Science.gov (United States)

    Solano, Wanda M.; Drakunov, Sergey V.

    2012-01-01

    Nonlinear observers were originally developed based on the ideas of variable structure control, and for the purpose of detecting disturbances in complex systems. In this anomaly detection application, these observers were designed for estimating the distributed state of fluid flow in a pipe described by a class of advection equations. The observer algorithm uses collected data in a piping system to estimate the distributed system state (pressure and velocity along a pipe containing liquid gas propellant flow) using only boundary measurements. These estimates are then used to further estimate and localize possible anomalies such as leaks or foreign objects, and instrumentation metering problems such as incorrect flow meter orifice plate size. The observer algorithm has the following parts: a mathematical model of the fluid flow, observer control algorithm, and an anomaly identification algorithm. The main functional operation of the algorithm is in creating the sliding mode in the observer system implemented as software. Once the sliding mode starts in the system, the equivalent value of the discontinuous function in sliding mode can be obtained by filtering out the high-frequency chattering component. In control theory, "observers" are dynamic algorithms for the online estimation of the current state of a dynamic system by measurements of an output of the system. Classical linear observers can provide optimal estimates of a system state in case of uncertainty modeled by white noise. For nonlinear cases, the theory of nonlinear observers has been developed and its success is mainly due to the sliding mode approach. Using the mathematical theory of variable structure systems with sliding modes, the observer algorithm is designed in such a way that it steers the output of the model to the output of the system obtained via a variety of sensors, in spite of possible mismatches between the assumed model and actual system. The unique properties of sliding mode control

  16. System for Anomaly and Failure Detection (SAFD) system development

    Science.gov (United States)

    Oreilly, D.

    1992-07-01

    This task specified developing the hardware and software necessary to implement the System for Anomaly and Failure Detection (SAFD) algorithm, developed under Technology Test Bed (TTB) Task 21, on the TTB engine stand. This effort involved building two units; one unit to be installed in the Block II Space Shuttle Main Engine (SSME) Hardware Simulation Lab (HSL) at Marshall Space Flight Center (MSFC), and one unit to be installed at the TTB engine stand. Rocketdyne personnel from the HSL performed the task. The SAFD algorithm was developed as an improvement over the current redline system used in the Space Shuttle Main Engine Controller (SSMEC). Simulation tests and execution against previous hot fire tests demonstrated that the SAFD algorithm can detect engine failure as much as tens of seconds before the redline system recognized the failure. Although the current algorithm only operates during steady state conditions (engine not throttling), work is underway to expand the algorithm to work during transient condition.

  17. Log Summarization and Anomaly Detection for TroubleshootingDistributed Systems

    Energy Technology Data Exchange (ETDEWEB)

    Gunter, Dan; Tierney, Brian L.; Brown, Aaron; Swany, Martin; Bresnahan, John; Schopf, Jennifer M.

    2007-08-01

    Today's system monitoring tools are capable of detectingsystem failures such as host failures, OS errors, and network partitionsin near-real time. Unfortunately, the same cannot yet be said of theend-to-end distributed softwarestack. Any given action, for example,reliably transferring a directory of files, can involve a wide range ofcomplex and interrelated actions across multiple pieces of software:checking user certificates and permissions, getting details for allfiles, performing third-party transfers, understanding re-try policydecisions, etc. We present an infrastructure for troubleshooting complexmiddleware, a general purpose technique for configurable logsummarization, and an anomaly detection technique that works in near-realtime on running Grid middleware. We present results gathered using thisinfrastructure from instrumented Grid middleware and applications runningon the Emulab testbed. From these results, we analyze the effectivenessof several algorithms at accurately detecting a variety of performanceanomalies.

  18. Anomaly detection of microstructural defects in continuous fiber reinforced composites

    Science.gov (United States)

    Bricker, Stephen; Simmons, J. P.; Przybyla, Craig; Hardie, Russell

    2015-03-01

    Ceramic matrix composites (CMC) with continuous fiber reinforcements have the potential to enable the next generation of high speed hypersonic vehicles and/or significant improvements in gas turbine engine performance due to their exhibited toughness when subjected to high mechanical loads at extreme temperatures (2200F+). Reinforced fiber composites (RFC) provide increased fracture toughness, crack growth resistance, and strength, though little is known about how stochastic variation and imperfections in the material effect material properties. In this work, tools are developed for quantifying anomalies within the microstructure at several scales. The detection and characterization of anomalous microstructure is a critical step in linking production techniques to properties, as well as in accurate material simulation and property prediction for the integrated computation materials engineering (ICME) of RFC based components. It is desired to find statistical outliers for any number of material characteristics such as fibers, fiber coatings, and pores. Here, fiber orientation, or `velocity', and `velocity' gradient are developed and examined for anomalous behavior. Categorizing anomalous behavior in the CMC is approached by multivariate Gaussian mixture modeling. A Gaussian mixture is employed to estimate the probability density function (PDF) of the features in question, and anomalies are classified by their likelihood of belonging to the statistical normal behavior for that feature.

  19. DYNAMIC NETWORK ANOMALY INTRUSION DETECTION USING MODIFIED SOM

    Directory of Open Access Journals (Sweden)

    Aneetha.A.S

    2012-05-01

    Full Text Available Detection of unexpected and emerging new threats has become a necessity for secured internet communication with absolute data confidentiality, integrity and availability. Design and development of such a detection system shall not only be new, accurate and fast but also effective in a dynamic environment encompassing the surrounding network. In this paper, an algorithm is proposed for anomaly detection through modifying the Self – Organizing Map (SOM, by including new neighbourhood updating rules and learning rate dynamically in order to overcome the fixed architecture and random weight vector assignment. The algorithm initially starts with null network and grows with the original data space as initial weight vectors. New nodes are created using distance threshold parameter and their neighbourhood is identified using connection strength. Employing learning rule, the weight vector updation is carried out for neighbourhood nodes. Performance of the new algorithm is evaluated for using standard bench mark dataset. The result is compared with other neural network methods, shows 98% detection rate and 2% false alarm rate.

  20. A Dynamic Approach for Anomaly Detection in AODV

    Directory of Open Access Journals (Sweden)

    P.Vigneshwaran

    2011-02-01

    Full Text Available Mobile ad hoc networks (MANETs are relatively vuln erable to malicious network attacks, and therefore, security is a more significant issue than infrastru cture-based wire-less networks. In MANETs, it is di fficult to identify malicious hosts as the topology of the network dynamically changes. A malicious host can e asily interrupt a route for which it is one of the formin g nodes in the communication path. Since the topolo gy of a MANET dynamically changes, the mere use of a stat ic baseline profile is not efficient. We proposed a new anomaly-detection scheme based on a dynamic learnin g process that allows the training data to be updat ed at particular time intervals. Our dynamic learning process involves calculating the projection distanc es based on multidimensional statistics using weighted coefficients and a forgetting curve.

  1. Near-Real Time Anomaly Detection for Scientific Sensor Data

    Science.gov (United States)

    Gallegos, I.; Gates, A.; Tweedie, C. E.; goswami, S.; Jaimes, A.; Gamon, J. A.

    2011-12-01

    Verification (SDVe) prototype tool identified anomalies detected by the expert-specified data properties over the EC data. Scientists using DaProS and SDVe were able to detect environmental variability, instrument malfunctioning, and seasonal and diurnal variability in EC and hyperspectral datasets. The results of the experiment also yielded insights regarding the practices followed by scientists to specify data properties, and it exposed new data properties challenges and a potential method for capturing data quality confidence levels.

  2. Glaucoma progression detection using nonlocal Markov random field prior.

    Science.gov (United States)

    Belghith, Akram; Bowd, Christopher; Medeiros, Felipe A; Balasubramanian, Madhusudhanan; Weinreb, Robert N; Zangwill, Linda M

    2014-10-01

    Glaucoma is neurodegenerative disease characterized by distinctive changes in the optic nerve head and visual field. Without treatment, glaucoma can lead to permanent blindness. Therefore, monitoring glaucoma progression is important to detect uncontrolled disease and the possible need for therapy advancement. In this context, three-dimensional (3-D) spectral domain optical coherence tomography (SD-OCT) has been commonly used in the diagnosis and management of glaucoma patients. We present a new framework for detection of glaucoma progression using 3-D SD-OCT images. In contrast to previous works that use the retinal nerve fiber layer thickness measurement provided by commercially available instruments, we consider the whole 3-D volume for change detection. To account for the spatial voxel dependency, we propose the use of the Markov random field (MRF) model as a prior for the change detection map. In order to improve the robustness of the proposed approach, a nonlocal strategy was adopted to define the MRF energy function. To accommodate the presence of false-positive detection, we used a fuzzy logic approach to classify a 3-D SD-OCT image into a "non-progressing" or "progressing" glaucoma class. We compared the diagnostic performance of the proposed framework to the existing methods of progression detection.

  3. Unfolding the procedure of characterizing recorded ultra low frequency, kHZ and MHz electromagnetic anomalies prior to the L'Aquila earthquake as pre-seismic ones - Part 2

    Directory of Open Access Journals (Sweden)

    K. Eftaxias

    2010-02-01

    Full Text Available Ultra low frequency-ULF (1 Hz or lower, kHz and MHz electromagnetic (EM anomalies were recorded prior to the L'Aquila catastrophic earthquake (EQ that occurred on 6 April 2009. The detected anomalies followed this temporal scheme. (i The MHz EM anomalies were detected on 26 March 2009 and 2 April 2009. The kHz EM anomalies were emerged on 4 April 2009. The ULF EM anomaly was appeared from 29 March 2009 up to 3 April 2009. The question effortlessly arises as to whether the observed anomalies before the L'Aquila EQ were seismogenic or not. The main goal of this work is to provide some insight into this issue. More precisely, the main aims of this contribution are threefold: How can we recognize an EM observation as pre-seismic one? We aim, through a multidisciplinary analysis to provide some elements of a definition. How can we link an individual EM anomaly with a distinctive stage of the EQ preparation process? The present analysis is consistent with the hypothesis that the kHz EM anomalies were associated with the fracture of asperities that were distributed along the L'Aquila fault sustaining the system, while the MHz EM anomalies could be triggered by fractures in the highly disordered system that surrounded the backbone of asperities of the activated fault. How can we identify precursory symptoms in an individual EM precursor that indicate that the occurrence of the EQ is unavoidable? We clearly state that the detection of a MHz EM precursor does not mean that the occurrence of EQ is unavoidable; the abrupt emergence of kHz EM emissions indicate the fracture of asperities. The observed ULF EM anomaly supports the hypothesis of a relationship between processes produced by increasing tectonic stresses in the Earth's crust and attendant EM interactions between the crust and ionosphere. We emphasize that we attempt to specify not only whether or not a single EM anomaly is pre-seismic in itself, but mainly whether a combination of emergent ULF

  4. A Framework for an Adaptive Anomaly Detection System with Fuzzy Data Mining

    Institute of Scientific and Technical Information of China (English)

    GAO Xiang; WANG Min; ZHAO Rongchun

    2006-01-01

    In this paper, we present an adaptive anomaly detection framework that is applicable to network-based intrusion detection. Our framework employs fuzzy cluster algorithm to detect anomalies in an online, adaptive fashion without a priori knowledge of the underlying data. We evaluate our method by performing experiments over network records from the KDD CUP99 data set.

  5. A Result Fusion based Distributed Anomaly Detection System for Android Smartphones

    Directory of Open Access Journals (Sweden)

    Zhizhong Wu

    2013-02-01

    Full Text Available In this paper we present an information fusion based distributed anomaly detection system for Android mobile phones. The proposed framework realizes a clientserver architecture, the client continuously extracts various features and transfers to the server, and the server’s major task is to detect anomaly using state-of-art detection algorithms implemented as anomaly detectors. Multiple distributed servers simultaneously analyzing the feature vector using different detectors and information fusion is used to fuse the results of detectors. We also propose a cycle-based statistical approach for smartphone anomaly detection as the smartphone users usual follow regular patterns due to their periodical patterns of lives. Empirical results suggest that the proposed framework and novel anomaly detection algorithm are effective in detecting malware on Android devices.

  6. Latent Space Tracking from Heterogeneous Data with an Application for Anomaly Detection

    Science.gov (United States)

    2015-11-01

    efits classical machine learning tasks (e.g., classification [6]), as well as more novel applications (e.g., the anomaly detection). However, learning...online and unsupervised setting (e.g., anomaly detection task) is not straightforward. In this paper, we tackle the problem of online learning of

  7. The best method of detecting prior Helicobacter pyloriinfection

    Institute of Scientific and Technical Information of China (English)

    Chien-Yu Lu; Wen-Ming Wang; Deng-Chyang Wu; Chao-Hung Kuo; Yi-Ching Lo; Hung-Yi Chuang; Yuan-Chieh Yang; I-Chen Wu; Fang-Jong Yu; Yi-Chen Lee; Chang-Ming Jan

    2005-01-01

    AIM: Prior Helicobacter pylori (H pylori) infection has often been underestimated. These underestimations have misled physicians attempting to determine the significance between H pylori and certain gastrointestinal lesions such as intestinal metaplasia, atrophic gastritis, and gastric cancer. Our study endeavored to detect past H pylori infections accurately, easily,and rapidly with the newly developed immunoblot kit, Helico Blot 2.1.METHODS: Thirty-three patients, including 25 H pylori infected and 8 uninfected cases, were enrolled in our study. All patients received consecutive gastroendoscopic examinations and 13C-urea breath test (UBT) tests at 6-or 12-mo intervals for up to 4 years. Serum samples were obtained from each patient at the same time. Intragastric H pylori infection was confirmed in accordance with the gold standard. Twenty-five H pylori-infected patients received triple therapies after initial bacterial confirmation,and were successful in eradicating their infections. Serially obtained sera were tested by means of Helico Blot 2.1.RESULTS: Current infection marker detected by Helico Blot 2.1 was unreliable for representing ongoing H pylori infection. Only 35 and 37 ku antibodies of H pylori had significant seroconversion rates 1 year after having been cured. The seropositive rates of 116 ku (cytotoxin-associated antigen [CagA]) and Helico Blot 2.1 were nearly 100%during 4-year follow-up period. Both CagA antigen and Helico blot 2.1 could serve as indicators of long-term H pylori infection.CONCLUSION: Helico Blot 2.1 can detect past H pylori infections for up to 4 years, and is the best method to date for detecting previous long-term H pylori infection.

  8. Autonomic intrusion detection: Adaptively detecting anomalies over unlabeled audit data streams in computer networks

    KAUST Repository

    Wang, Wei

    2014-06-22

    In this work, we propose a novel framework of autonomic intrusion detection that fulfills online and adaptive intrusion detection over unlabeled HTTP traffic streams in computer networks. The framework holds potential for self-managing: self-labeling, self-updating and self-adapting. Our framework employs the Affinity Propagation (AP) algorithm to learn a subject’s behaviors through dynamical clustering of the streaming data. It automatically labels the data and adapts to normal behavior changes while identifies anomalies. Two large real HTTP traffic streams collected in our institute as well as a set of benchmark KDD’99 data are used to validate the framework and the method. The test results show that the autonomic model achieves better results in terms of effectiveness and efficiency compared to adaptive Sequential Karhunen–Loeve method and static AP as well as three other static anomaly detection methods, namely, k-NN, PCA and SVM.

  9. Change and Anomaly Detection in Real-Time GPS Data

    Science.gov (United States)

    Granat, R.; Pierce, M.; Gao, X.; Bock, Y.

    2008-12-01

    The California Real-Time Network (CRTN) is currently generating real-time GPS position data at a rate of 1-2Hz at over 80 locations. The CRTN data presents the possibility of studying dynamical solid earth processes in a way that complements existing seismic networks. To realize this possibility we have developed a prototype system for detecting changes and anomalies in the real-time data. Through this system, we can can correlate changes in multiple stations in order to detect signals with geographical extent. Our approach involves developing a statistical model for each GPS station in the network, and then using those models to segment the time series into a number of discrete states described by the model. We use a hidden Markov model (HMM) to describe the behavior of each station; fitting the model to the data requires neither labeled training examples nor a priori information about the system. As such, HMMs are well suited to this problem domain, in which the data remains largely uncharacterized. There are two main components to our approach. The first is the model fitting algorithm, regularized deterministic annealing expectation- maximization (RDAEM), which provides robust, high-quality results. The second is a web service infrastructure that connects the data to the statistical modeling analysis and allows us to easily present the results of that analysis through a web portal interface. This web service approach facilitates the automatic updating of station models to keep pace with dynamical changes in the data. Our web portal interface is critical to the process of interpreting the data. A Google Maps interface allows users to visually interpret state changes not only on individual stations but across the entire network. Users can drill down from the map interface to inspect detailed results for individual stations, download the time series data, and inspect fitted models. Alternatively, users can use the web portal look at the evolution of changes on the

  10. Unsupervised Network Anomaly Detection in Real-Time on Big Data

    OpenAIRE

    Dromard, Juliette; Roudière, Gilles; Owezarski, Philippe

    2015-01-01

    International audience; Network anomaly detection relies on intrusion detection systems based on knowledge databases. However, building this knowledge may take time as it requires manual inspection of experts. Actual detection systems are unable to deal with 0-day attack or new user's behavior and in consequence they may fail in correctly detecting intrusions. Unsu-pervised network anomaly detectors overcome this issue as no previous knowledge is required. In counterpart, these systems may be...

  11. A Comparative Evaluation of Unsupervised Anomaly Detection Algorithms for Multivariate Data.

    Science.gov (United States)

    Goldstein, Markus; Uchida, Seiichi

    2016-01-01

    Anomaly detection is the process of identifying unexpected items or events in datasets, which differ from the norm. In contrast to standard classification tasks, anomaly detection is often applied on unlabeled data, taking only the internal structure of the dataset into account. This challenge is known as unsupervised anomaly detection and is addressed in many practical applications, for example in network intrusion detection, fraud detection as well as in the life science and medical domain. Dozens of algorithms have been proposed in this area, but unfortunately the research community still lacks a comparative universal evaluation as well as common publicly available datasets. These shortcomings are addressed in this study, where 19 different unsupervised anomaly detection algorithms are evaluated on 10 different datasets from multiple application domains. By publishing the source code and the datasets, this paper aims to be a new well-funded basis for unsupervised anomaly detection research. Additionally, this evaluation reveals the strengths and weaknesses of the different approaches for the first time. Besides the anomaly detection performance, computational effort, the impact of parameter settings as well as the global/local anomaly detection behavior is outlined. As a conclusion, we give an advise on algorithm selection for typical real-world tasks.

  12. A Comparative Evaluation of Unsupervised Anomaly Detection Algorithms for Multivariate Data.

    Directory of Open Access Journals (Sweden)

    Markus Goldstein

    Full Text Available Anomaly detection is the process of identifying unexpected items or events in datasets, which differ from the norm. In contrast to standard classification tasks, anomaly detection is often applied on unlabeled data, taking only the internal structure of the dataset into account. This challenge is known as unsupervised anomaly detection and is addressed in many practical applications, for example in network intrusion detection, fraud detection as well as in the life science and medical domain. Dozens of algorithms have been proposed in this area, but unfortunately the research community still lacks a comparative universal evaluation as well as common publicly available datasets. These shortcomings are addressed in this study, where 19 different unsupervised anomaly detection algorithms are evaluated on 10 different datasets from multiple application domains. By publishing the source code and the datasets, this paper aims to be a new well-funded basis for unsupervised anomaly detection research. Additionally, this evaluation reveals the strengths and weaknesses of the different approaches for the first time. Besides the anomaly detection performance, computational effort, the impact of parameter settings as well as the global/local anomaly detection behavior is outlined. As a conclusion, we give an advise on algorithm selection for typical real-world tasks.

  13. Detection and Analysis of Twitter Trending Topics via LinkAnomaly Detection

    Directory of Open Access Journals (Sweden)

    Chandan M G

    2015-04-01

    Full Text Available This paper involves two approaches for finding the trending topics in social networks that is key-based approach and link-based approach. In conventional key-based approach for topics detection have mainly focus on frequencies of (textual words. We propose a link-based approach which focuses on posts reflected in the mentioning behavior of hundreds users. The anomaly detection in the twitter data set is carried out by retrieving the trend topics from the twitter in a sequential manner by using some API and corresponding user for training, then computed anomaly score is aggregated from different users. Further the aggregated anomaly score will be feed into change-point analysis or burst detection at the pinpoint, in order to detect the emerging topics. We have used the real time twitter account, so results are vary according to the tweet trends made. The experiment shows that proposed link-based approach performs even better than the keyword-based approach.

  14. Detecting Distributed Network Traffic Anomaly with Network-Wide Correlation Analysis

    Directory of Open Access Journals (Sweden)

    Yang Dan

    2008-12-01

    Full Text Available Distributed network traffic anomaly refers to a traffic abnormal behavior involving many links of a network and caused by the same source (e.g., DDoS attack, worm propagation. The anomaly transiting in a single link might be unnoticeable and hard to detect, while the anomalous aggregation from many links can be prevailing, and does more harm to the networks. Aiming at the similar features of distributed traffic anomaly on many links, this paper proposes a network-wide detection method by performing anomalous correlation analysis of traffic signals' instantaneous parameters. In our method, traffic signals' instantaneous parameters are firstly computed, and their network-wide anomalous space is then extracted via traffic prediction. Finally, an anomaly is detected by a global correlation coefficient of anomalous space. Our evaluation using Abilene traffic traces demonstrates the excellent performance of this approach for distributed traffic anomaly detection.

  15. A first approach on fault detection and isolation for cardiovascular anomalies detection

    KAUST Repository

    Ledezma, Fernando

    2015-07-01

    In this paper, we use an extended version of the cardiovascular system\\'s state space model presented by [1] and propose a fault detection and isolation methodology to study the problem of detecting cardiovascular anomalies that can originate from variations in physiological parameters and deviations in the performance of the heart\\'s mitral and aortic valves. An observer-based approach is discussed as the basis of the method. The approach contemplates a bank of Extended Kalman Filters to achieve joint estimation of the model\\'s states and parameters and to detect malfunctions in the valves\\' performance. © 2015 American Automatic Control Council.

  16. A robust background regression based score estimation algorithm for hyperspectral anomaly detection

    Science.gov (United States)

    Zhao, Rui; Du, Bo; Zhang, Liangpei; Zhang, Lefei

    2016-12-01

    Anomaly detection has become a hot topic in the hyperspectral image analysis and processing fields in recent years. The most important issue for hyperspectral anomaly detection is the background estimation and suppression. Unreasonable or non-robust background estimation usually leads to unsatisfactory anomaly detection results. Furthermore, the inherent nonlinearity of hyperspectral images may cover up the intrinsic data structure in the anomaly detection. In order to implement robust background estimation, as well as to explore the intrinsic data structure of the hyperspectral image, we propose a robust background regression based score estimation algorithm (RBRSE) for hyperspectral anomaly detection. The Robust Background Regression (RBR) is actually a label assignment procedure which segments the hyperspectral data into a robust background dataset and a potential anomaly dataset with an intersection boundary. In the RBR, a kernel expansion technique, which explores the nonlinear structure of the hyperspectral data in a reproducing kernel Hilbert space, is utilized to formulate the data as a density feature representation. A minimum squared loss relationship is constructed between the data density feature and the corresponding assigned labels of the hyperspectral data, to formulate the foundation of the regression. Furthermore, a manifold regularization term which explores the manifold smoothness of the hyperspectral data, and a maximization term of the robust background average density, which suppresses the bias caused by the potential anomalies, are jointly appended in the RBR procedure. After this, a paired-dataset based k-nn score estimation method is undertaken on the robust background and potential anomaly datasets, to implement the detection output. The experimental results show that RBRSE achieves superior ROC curves, AUC values, and background-anomaly separation than some of the other state-of-the-art anomaly detection methods, and is easy to implement

  17. Aircraft Anomaly Detection Using Performance Models Trained on Fleet Data

    Science.gov (United States)

    Gorinevsky, Dimitry; Matthews, Bryan L.; Martin, Rodney

    2012-01-01

    This paper describes an application of data mining technology called Distributed Fleet Monitoring (DFM) to Flight Operational Quality Assurance (FOQA) data collected from a fleet of commercial aircraft. DFM transforms the data into aircraft performance models, flight-to-flight trends, and individual flight anomalies by fitting a multi-level regression model to the data. The model represents aircraft flight performance and takes into account fixed effects: flight-to-flight and vehicle-to-vehicle variability. The regression parameters include aerodynamic coefficients and other aircraft performance parameters that are usually identified by aircraft manufacturers in flight tests. Using DFM, the multi-terabyte FOQA data set with half-million flights was processed in a few hours. The anomalies found include wrong values of competed variables, (e.g., aircraft weight), sensor failures and baises, failures, biases, and trends in flight actuators. These anomalies were missed by the existing airline monitoring of FOQA data exceedances.

  18. Detecting Anomaly Regions in Satellite Image Time Series Based on Sesaonal Autocorrelation Analysis

    Science.gov (United States)

    Zhou, Z.-G.; Tang, P.; Zhou, M.

    2016-06-01

    Anomaly regions in satellite images can reflect unexpected changes of land cover caused by flood, fire, landslide, etc. Detecting anomaly regions in satellite image time series is important for studying the dynamic processes of land cover changes as well as for disaster monitoring. Although several methods have been developed to detect land cover changes using satellite image time series, they are generally designed for detecting inter-annual or abrupt land cover changes, but are not focusing on detecting spatial-temporal changes in continuous images. In order to identify spatial-temporal dynamic processes of unexpected changes of land cover, this study proposes a method for detecting anomaly regions in each image of satellite image time series based on seasonal autocorrelation analysis. The method was validated with a case study to detect spatial-temporal processes of a severe flooding using Terra/MODIS image time series. Experiments demonstrated the advantages of the method that (1) it can effectively detect anomaly regions in each of satellite image time series, showing spatial-temporal varying process of anomaly regions, (2) it is flexible to meet some requirement (e.g., z-value or significance level) of detection accuracies with overall accuracy being up to 89% and precision above than 90%, and (3) it does not need time series smoothing and can detect anomaly regions in noisy satellite images with a high reliability.

  19. DETECTING ANOMALY REGIONS IN SATELLITE IMAGE TIME SERIES BASED ON SESAONAL AUTOCORRELATION ANALYSIS

    Directory of Open Access Journals (Sweden)

    Z.-G. Zhou

    2016-06-01

    Full Text Available Anomaly regions in satellite images can reflect unexpected changes of land cover caused by flood, fire, landslide, etc. Detecting anomaly regions in satellite image time series is important for studying the dynamic processes of land cover changes as well as for disaster monitoring. Although several methods have been developed to detect land cover changes using satellite image time series, they are generally designed for detecting inter-annual or abrupt land cover changes, but are not focusing on detecting spatial-temporal changes in continuous images. In order to identify spatial-temporal dynamic processes of unexpected changes of land cover, this study proposes a method for detecting anomaly regions in each image of satellite image time series based on seasonal autocorrelation analysis. The method was validated with a case study to detect spatial-temporal processes of a severe flooding using Terra/MODIS image time series. Experiments demonstrated the advantages of the method that (1 it can effectively detect anomaly regions in each of satellite image time series, showing spatial-temporal varying process of anomaly regions, (2 it is flexible to meet some requirement (e.g., z-value or significance level of detection accuracies with overall accuracy being up to 89% and precision above than 90%, and (3 it does not need time series smoothing and can detect anomaly regions in noisy satellite images with a high reliability.

  20. Unfolding the procedure of characterizing recorded ultra low frequency, kHZ and MHz electromagetic anomalies prior to the L'Aquila earthquake as pre-seismic ones. Part I

    CERN Document Server

    Eftaxias, K; Balasis, G; Kalimeri, M; Nikolopoulos, S; Contoyiannis, Y; Kopanas, J; Antonopoulos, G; Nomicos, C

    2009-01-01

    Ultra low frequency, kHz and MHz electromagnetic anomalies were recorded prior to the L'Aquila catastrophic earthquake that occurred on April 6, 2009. The main aims of this contribution are: (i) To suggest a procedure for the designation of detected EM anomalies as seismogenic ones. We do not expect to be possible to provide a succinct and solid definition of a pre-seismic EM emission. Instead, we attempt, through a multidisciplinary analysis, to provide elements of a definition. (ii) To link the detected MHz and kHz EM anomalies with equivalent last stages of the L'Aquila earthquake preparation process. (iii) To put forward physically meaningful arguments to support a way of quantifying the time to global failure and the identification of distinguishing features beyond which the evolution towards global failure becomes irreversible. The whole effort is unfolded in two consecutive parts. We clarify we try to specify not only whether or not a single EM anomaly is pre-seismic in itself, but mainly whether a com...

  1. NADIR (Network Anomaly Detection and Intrusion Reporter): A prototype network intrusion detection system

    Energy Technology Data Exchange (ETDEWEB)

    Jackson, K.A.; DuBois, D.H.; Stallings, C.A.

    1990-01-01

    The Network Anomaly Detection and Intrusion Reporter (NADIR) is an expert system which is intended to provide real-time security auditing for intrusion and misuse detection at Los Alamos National Laboratory's Integrated Computing Network (ICN). It is based on three basic assumptions: that statistical analysis of computer system and user activities may be used to characterize normal system and user behavior, and that given the resulting statistical profiles, behavior which deviates beyond certain bounds can be detected, that expert system techniques can be applied to security auditing and intrusion detection, and that successful intrusion detection may take place while monitoring a limited set of network activities such as user authentication and access control, file movement and storage, and job scheduling. NADIR has been developed to employ these basic concepts while monitoring the audited activities of more than 8000 ICN users.

  2. nu-Anomica: A Fast Support Vector Based Anomaly Detection Technique

    Data.gov (United States)

    National Aeronautics and Space Administration — In this paper we propose $nu$-Anomica, a novel anomaly detection technique that can be trained on huge data sets with much reduced running time compared to the...

  3. Improved Principal Component Analysis for Anomaly Detection: Application to an Emergency Department

    KAUST Repository

    Harrou, Fouzi

    2015-07-03

    Monitoring of production systems, such as those in hospitals, is primordial for ensuring the best management and maintenance desired product quality. Detection of emergent abnormalities allows preemptive actions that can prevent more serious consequences. Principal component analysis (PCA)-based anomaly-detection approach has been used successfully for monitoring systems with highly correlated variables. However, conventional PCA-based detection indices, such as the Hotelling’s T2T2 and the Q statistics, are ill suited to detect small abnormalities because they use only information from the most recent observations. Other multivariate statistical metrics, such as the multivariate cumulative sum (MCUSUM) control scheme, are more suitable for detection small anomalies. In this paper, a generic anomaly detection scheme based on PCA is proposed to monitor demands to an emergency department. In such a framework, the MCUSUM control chart is applied to the uncorrelated residuals obtained from the PCA model. The proposed PCA-based MCUSUM anomaly detection strategy is successfully applied to the practical data collected from the database of the pediatric emergency department in the Lille Regional Hospital Centre, France. The detection results evidence that the proposed method is more effective than the conventional PCA-based anomaly-detection methods.

  4. Multi-Level Anomaly Detection on Time-Varying Graph Data

    Energy Technology Data Exchange (ETDEWEB)

    Bridges, Robert A [ORNL; Collins, John P [ORNL; Ferragut, Erik M [ORNL; Laska, Jason A [ORNL; Sullivan, Blair D [ORNL

    2015-01-01

    This work presents a novel modeling and analysis framework for graph sequences which addresses the challenge of detecting and contextualizing anomalies in labelled, streaming graph data. We introduce a generalization of the BTER model of Seshadhri et al. by adding flexibility to community structure, and use this model to perform multi-scale graph anomaly detection. Specifically, probability models describing coarse subgraphs are built by aggregating probabilities at finer levels, and these closely related hierarchical models simultaneously detect deviations from expectation. This technique provides insight into a graph's structure and internal context that may shed light on a detected event. Additionally, this multi-scale analysis facilitates intuitive visualizations by allowing users to narrow focus from an anomalous graph to particular subgraphs or nodes causing the anomaly. For evaluation, two hierarchical anomaly detectors are tested against a baseline Gaussian method on a series of sampled graphs. We demonstrate that our graph statistics-based approach outperforms both a distribution-based detector and the baseline in a labeled setting with community structure, and it accurately detects anomalies in synthetic and real-world datasets at the node, subgraph, and graph levels. To illustrate the accessibility of information made possible via this technique, the anomaly detector and an associated interactive visualization tool are tested on NCAA football data, where teams and conferences that moved within the league are identified with perfect recall, and precision greater than 0.786.

  5. Overlapping image segmentation for context-dependent anomaly detection

    Science.gov (United States)

    Theiler, James; Prasad, Lakshman

    2011-06-01

    The challenge of finding small targets in big images lies in the characterization of the background clutter. The more homogeneous the background, the more distinguishable a typical target will be from its background. One way to homogenize the background is to segment the image into distinct regions, each of which is individually homogeneous, and then to treat each region separately. In this paper we will report on experiments in which the target is unspecified (it is an anomaly), and various segmentation strategies are employed, including an adaptive hierarchical tree-based scheme. We find that segmentations that employ overlap achieve better performance in the low false alarm rate regime.

  6. The Anomaly Detection in SMTP Traffic Based on Leaky Integrate-and-Fire Model

    Institute of Scientific and Technical Information of China (English)

    LUO Hao; FANG Bin-xing; YUN Xiao-chun

    2006-01-01

    This paper investigated an effective and robust mechanism for detecting simple mail transfer protocol(SMTP) traffic anomaly. The detection method cumulates the deviation of current delivering status from history behavior based on a weighted sum method called the leaky integrate-and-fire model to detect anomaly. The simplicity of the detection method is that the method need not store history profile and low computation overhead, which makes the detection method itself immunes to attacks. The performance is investigated in terms of detection probability, the false alarm ratio, and the detection delay. The results show that leaky integrate-and-fire method is quite effective at detecting constant intensity attacks and increasing intensity attacks. Compared with the non-parametric cumulative sum method, the evaluation results show that the proposed detection method has shorter detection latency and higher detection probability.

  7. Effective Sensor Selection and Data Anomaly Detection for Condition Monitoring of Aircraft Engines.

    Science.gov (United States)

    Liu, Liansheng; Liu, Datong; Zhang, Yujie; Peng, Yu

    2016-04-29

    In a complex system, condition monitoring (CM) can collect the system working status. The condition is mainly sensed by the pre-deployed sensors in/on the system. Most existing works study how to utilize the condition information to predict the upcoming anomalies, faults, or failures. There is also some research which focuses on the faults or anomalies of the sensing element (i.e., sensor) to enhance the system reliability. However, existing approaches ignore the correlation between sensor selecting strategy and data anomaly detection, which can also improve the system reliability. To address this issue, we study a new scheme which includes sensor selection strategy and data anomaly detection by utilizing information theory and Gaussian Process Regression (GPR). The sensors that are more appropriate for the system CM are first selected. Then, mutual information is utilized to weight the correlation among different sensors. The anomaly detection is carried out by using the correlation of sensor data. The sensor data sets that are utilized to carry out the evaluation are provided by National Aeronautics and Space Administration (NASA) Ames Research Center and have been used as Prognostics and Health Management (PHM) challenge data in 2008. By comparing the two different sensor selection strategies, the effectiveness of selection method on data anomaly detection is proved.

  8. Effective Sensor Selection and Data Anomaly Detection for Condition Monitoring of Aircraft Engines

    Directory of Open Access Journals (Sweden)

    Liansheng Liu

    2016-04-01

    Full Text Available In a complex system, condition monitoring (CM can collect the system working status. The condition is mainly sensed by the pre-deployed sensors in/on the system. Most existing works study how to utilize the condition information to predict the upcoming anomalies, faults, or failures. There is also some research which focuses on the faults or anomalies of the sensing element (i.e., sensor to enhance the system reliability. However, existing approaches ignore the correlation between sensor selecting strategy and data anomaly detection, which can also improve the system reliability. To address this issue, we study a new scheme which includes sensor selection strategy and data anomaly detection by utilizing information theory and Gaussian Process Regression (GPR. The sensors that are more appropriate for the system CM are first selected. Then, mutual information is utilized to weight the correlation among different sensors. The anomaly detection is carried out by using the correlation of sensor data. The sensor data sets that are utilized to carry out the evaluation are provided by National Aeronautics and Space Administration (NASA Ames Research Center and have been used as Prognostics and Health Management (PHM challenge data in 2008. By comparing the two different sensor selection strategies, the effectiveness of selection method on data anomaly detection is proved.

  9. Combining Priors, Appearance, and Context for Road Detection

    NARCIS (Netherlands)

    J.M. Álvarez; A.M. López; T. Gevers; F. Lumbreras

    2014-01-01

    Detecting the free road surface ahead of a moving vehicle is an important research topic in different areas of computer vision, such as autonomous driving or car collision warning. Current vision-based road detection methods are usually based solely on low-level features. Furthermore, they generally

  10. Security inspection in ports by anomaly detection using hyperspectral imaging technology

    Science.gov (United States)

    Rivera, Javier; Valverde, Fernando; Saldaña, Manuel; Manian, Vidya

    2013-05-01

    Applying hyperspectral imaging technology in port security is crucial for the detection of possible threats or illegal activities. One of the most common problems that cargo suffers is tampering. This represents a danger to society because it creates a channel to smuggle illegal and hazardous products. If a cargo is altered, security inspections on that cargo should contain anomalies that reveal the nature of the tampering. Hyperspectral images can detect anomalies by gathering information through multiple electromagnetic bands. The spectrums extracted from these bands can be used to detect surface anomalies from different materials. Based on this technology, a scenario was built in which a hyperspectral camera was used to inspect the cargo for any surface anomalies and a user interface shows the results. The spectrum of items, altered by different materials that can be used to conceal illegal products, is analyzed and classified in order to provide information about the tampered cargo. The image is analyzed with a variety of techniques such as multiple features extracting algorithms, autonomous anomaly detection, and target spectrum detection. The results will be exported to a workstation or mobile device in order to show them in an easy -to-use interface. This process could enhance the current capabilities of security systems that are already implemented, providing a more complete approach to detect threats and illegal cargo.

  11. Advancements of Data Anomaly Detection Research in Wireless Sensor Networks: A Survey and Open Issues

    Directory of Open Access Journals (Sweden)

    Mohd Aizaini Maarof

    2013-08-01

    Full Text Available Wireless Sensor Networks (WSNs are important and necessary platforms for the future as the concept “Internet of Things” has emerged lately. They are used for monitoring, tracking, or controlling of many applications in industry, health care, habitat, and military. However, the quality of data collected by sensor nodes is affected by anomalies that occur due to various reasons, such as node failures, reading errors, unusual events, and malicious attacks. Therefore, anomaly detection is a necessary process to ensure the quality of sensor data before it is utilized for making decisions. In this review, we present the challenges of anomaly detection in WSNs and state the requirements to design efficient and effective anomaly detection models. We then review the latest advancements of data anomaly detection research in WSNs and classify current detection approaches in five main classes based on the detection methods used to design these approaches. Varieties of the state-of-the-art models for each class are covered and their limitations are highlighted to provide ideas for potential future works. Furthermore, the reviewed approaches are compared and evaluated based on how well they meet the stated requirements. Finally, the general limitations of current approaches are mentioned and further research opportunities are suggested and discussed.

  12. Unfolding the procedure of characterizing recorded ultra low frequency, kHZ and MHz electromagetic anomalies prior to the L'Aquila earthquake as pre-seismic ones – Part 1

    Directory of Open Access Journals (Sweden)

    K. Eftaxias

    2009-11-01

    Full Text Available Ultra low frequency, kHz and MHz electromagnetic (EM anomalies were recorded prior to the L'Aquila catastrophic earthquake that occurred on 6 April 2009. The main aims of this paper are threefold: (i suggest a procedure for the designation of detected EM anomalies as seismogenic ones. We do not expect to be able to provide a succinct and solid definition of a pre-seismic EM emission. Instead, we aim, through a multidisciplinary analysis, to provide the elements of a definition. (ii Link the detected MHz and kHz EM anomalies with equivalent last stages of the earthquake preparation process. (iii Put forward physically meaningful arguments for quantifying the time to global failure and the identification of distinguishing features beyond which the evolution towards global failure becomes irreversible. We emphasize that we try to specify not only whether a single EM anomaly is pre-seismic in itself, but also whether a combination of kHz, MHz, and ULF EM anomalies can be characterized as pre-seismic. The entire procedure unfolds in two consecutive parts. Here in Part 1 we focus on the detected kHz EM anomaly, which play a crucial role in our approach to these challenges. We try to discriminate clearly this anomaly from background noise. For this purpose, we analyze the data successively in terms of various concepts of entropy and information theory including, Shannon n-block entropy, conditional entropy, entropy of the source, Kolmogorov-Sinai entropy, T-entropy, approximate entropy, fractal spectral analysis, R/S analysis and detrended fluctuation analysis. We argue that this analysis reliably distinguishes the candidate kHz EM precursor from the noise: the launch of anomalies from the normal state is combined by a simultaneous appearance of a significantly higher level of organization, and persistency. This finding indicates that the process in which the anomalies are rooted is governed by a positive feedback mechanism. This

  13. Handling Web and Database Requests Using Fuzzy Rules for Anomaly Intrusion Detection

    Directory of Open Access Journals (Sweden)

    Selvamani Kadirvelu

    2011-01-01

    Full Text Available Problem statement: It is necessary to propose suitable detection and prevention mechanisms to provide security for the information contents used by the web application. Many prevention mechanisms which are currently available are not able to classify anomalous, random and normal request. This leads to the problem of false positives which is classifying a normal request as anomalous and denying access to information. Approach: In this study, we propose an anomaly detection system which will act as a Web based anomaly detector called intelligent SQL Anomaly detector and it uses decision tree algorithm and a feedback mechanism for effective classification. Results: This newly proposed and implemented technique has higher probability for reducing false positives which are the drawbacks in the earlier systems. Hence, our system proves that it detects all anomalies and shows better results when compared with the existing system. Conclusion: A refreshing technique to improve the detection rate of web-based intrusion detection systems by serially framing a web request anomaly detector using fuzzy rules has been proposed and implemented and this system proves to be more efficient then the existing earlier system when compared with the obtained results.

  14. Improving Cyber-Security of Smart Grid Systems via Anomaly Detection and Linguistic Domain Knowledge

    Energy Technology Data Exchange (ETDEWEB)

    Ondrej Linda; Todd Vollmer; Milos Manic

    2012-08-01

    The planned large scale deployment of smart grid network devices will generate a large amount of information exchanged over various types of communication networks. The implementation of these critical systems will require appropriate cyber-security measures. A network anomaly detection solution is considered in this work. In common network architectures multiple communications streams are simultaneously present, making it difficult to build an anomaly detection solution for the entire system. In addition, common anomaly detection algorithms require specification of a sensitivity threshold, which inevitably leads to a tradeoff between false positives and false negatives rates. In order to alleviate these issues, this paper proposes a novel anomaly detection architecture. The designed system applies the previously developed network security cyber-sensor method to individual selected communication streams allowing for learning accurate normal network behavior models. Furthermore, the developed system dynamically adjusts the sensitivity threshold of each anomaly detection algorithm based on domain knowledge about the specific network system. It is proposed to model this domain knowledge using Interval Type-2 Fuzzy Logic rules, which linguistically describe the relationship between various features of the network communication and the possibility of a cyber attack. The proposed method was tested on experimental smart grid system demonstrating enhanced cyber-security.

  15. GLRT Based Anomaly Detection for Sensor Network Monitoring

    KAUST Repository

    Harrou, Fouzi

    2015-12-07

    Proper operation of antenna arrays requires continuously monitoring their performances. When a fault occurs in an antenna array, the radiation pattern changes and can significantly deviate from the desired design performance specifications. In this paper, the problem of fault detection in linear antenna arrays is addressed within a statistical framework. Specifically, a statistical fault detection method based on the generalized likelihood ratio (GLR) principle is utilized for detecting potential faults in linear antenna arrays. The proposed method relies on detecting deviations in the radiation pattern of the monitored array with respect to a reference (fault-free) one. To assess the abilities of the GLR based fault detection method, three case studies involving different types of faults have been performed. The simulation results clearly illustrate the effectiveness of the GLR-based fault detection method in monitoring the performance of linear antenna arrays.

  16. Comparison of Ultrasound and MRI in Detecting Fetal Anomalies

    Directory of Open Access Journals (Sweden)

    R. Abdi

    2005-08-01

    Full Text Available Introduction & Background: Ultrasound (US and MRI are considered complementary technologies, and MRI is utilized as an adjunct to US in the evaluation of fetal anomalies. Overall ultrasound remains the prime mo-dality for evaluating disorders of the fetus and pregnancy. Ultrasound continues to have several obvious advan-tages over MRI. It is safe and relatively inexpensive and is widely available It also allows for real-time imaging. However, US does have important limitations. First, it is uniquely operator-and interpreter-dependent. In ad-dition, compared to MRI, US provides a smaller field-of-view, and the resolution of US images is restricted by penetration through soft tissues and bone. Thus, the sensitivity of US in evaluating the fetus is reduced in obese patients and in women whose pregnancies are complicated by low amniotic fluid volume. There is a growing body of literature on the use of MRI and has documented its usefulness in confirming or expanding upon US findings. On the contrary, MRI visualization of the fetus is not significantly limited by maternal obe-sity, fetal position, or oligohydramnios, and visualization of the brain is not restricted by the ossified skull. It provides superior soft-tissue contrast resolution and the ability to distinguish individual structures such as lung, liver, kidney, bowel, and gray and white matter. Patients & Methods: In this study, patients in the second and third trimesters of pregnancy were recruited on the basis of abnormal fetal US results within 2 days of MR imaging by another radiologist. Results: In some cases such as anencephaly which is associated with polyhydraminous or in multicystic dys-plastic kidney disease, MRI added no more information to ultrasonography; but in the following cases MRI had more data. In a fetus with bilateral hydronephrosis, MRI could differentiate PUV from UPJ stenosis by visualizing distention of the ureters. MRI allowed better depiction of complex anomalies

  17. Poseidon: a 2-tier Anomaly-based Network Intrusion Detection System

    NARCIS (Netherlands)

    Bolzoni, Damiano; Zambon, Emmanuele; Etalle, Sandro; Hartel, Pieter

    2006-01-01

    We present Poseidon, a new anomaly based intrusion detection system. Poseidon is payload-based, and presents a two-tier architecture: the first stage consists of a Self-Organizing Map, while the second one is a modified PAYL system. Our benchmarks on the 1999 DARPA data set show a higher detection r

  18. Anomaly Event Detection Method Based on Compressive Sensing and Iteration in Wireless Sensor Networks

    Directory of Open Access Journals (Sweden)

    Shihua Cao

    2014-03-01

    Full Text Available Anomaly event detection is one of the research hotspots in wireless sensor networks. Aiming at the disadvantages of current detection solutions, a novel anomaly event detection algorithm based on compressed sensing and iteration is proposed. Firstly, a measured value can be sensed in each node, based on the compressed sensing. Then the problem of anomaly event detection is modeled as the minimization problem of weighted l1 norm, and OMP algorithm is adopted for solving the problem iteratively. And then the result of problem solving is judged according to detection functions. Finally, in the light of the judgment results, the weight value is updated for beginning a new round iteration. The loop won't stop until all the anomaly events are detected in wireless sensor networks. Simulation experimental results show the proposed algorithm has a better omission detection rate and false alarm rate in different noisy environments. In addition, the detection quality of this algorithm is higher than those of the traditional ones.

  19. Enhanced Object Detection via Fusion With Prior Beliefs from Image Classification

    OpenAIRE

    Cao, Yilun; Lee, Hyungtae; Kwon, Heesung

    2016-01-01

    In this paper, we introduce a novel fusion method that can enhance object detection performance by fusing decisions from two different types of computer vision tasks: object detection and image classification. In the proposed work, the class label of an image obtained from image classification is viewed as prior knowledge about existence or non-existence of certain objects. The prior knowledge is then fused with the decisions of object detection to improve detection accuracy by mitigating fal...

  20. Revisiting anomaly-based network intrusion detection systems

    NARCIS (Netherlands)

    Bolzoni, Damiano

    2009-01-01

    Intrusion detection systems (IDSs) are well-known and widely-deployed security tools to detect cyber-attacks and malicious activities in computer systems and networks. A signature-based IDS works similar to anti-virus software. It employs a signature database of known attacks, and a successful match

  1. Least Square Support Vector Machine for Detection of - Ionospheric Anomalies Associated with the Powerful Nepal Earthquake (Mw = 7.5) of 25 April 2015

    Science.gov (United States)

    Akhoondzadeh, M.

    2016-06-01

    Due to the irrepalable devastations of strong earthquakes, accurate anomaly detection in time series of different precursors for creating a trustworthy early warning system has brought new challenges. In this paper the predictability of Least Square Support Vector Machine (LSSVM) has been investigated by forecasting the GPS-TEC (Total Electron Content) variations around the time and location of Nepal earthquake. In 77 km NW of Kathmandu in Nepal (28.147° N, 84.708° E, depth = 15.0 km) a powerful earthquake of Mw = 7.8 took place at 06:11:26 UTC on April 25, 2015. For comparing purpose, other two methods including Median and ANN (Artificial Neural Network) have been implemented. All implemented algorithms indicate on striking TEC anomalies 2 days prior to the main shock. Results reveal that LSSVM method is promising for TEC sesimo-ionospheric anomalies detection.

  2. Anomaly detection in random heterogeneous media Feynman-Kac formulae, stochastic homogenization and statistical inversion

    CERN Document Server

    Simon, Martin

    2015-01-01

    This monograph is concerned with the analysis and numerical solution of a stochastic inverse anomaly detection problem in electrical impedance tomography (EIT). Martin Simon studies the problem of detecting a parameterized anomaly in an isotropic, stationary and ergodic conductivity random field whose realizations are rapidly oscillating. For this purpose, he derives Feynman-Kac formulae to rigorously justify stochastic homogenization in the case of the underlying stochastic boundary value problem. The author combines techniques from the theory of partial differential equations and functional analysis with probabilistic ideas, paving the way to new mathematical theorems which may be fruitfully used in the treatment of the problem at hand. Moreover, the author proposes an efficient numerical method in the framework of Bayesian inversion for the practical solution of the stochastic inverse anomaly detection problem.   Contents Feynman-Kac formulae Stochastic homogenization Statistical inverse problems  Targe...

  3. Anomaly Detection System Based on Principal Component Analysis and Support Vector Machine

    Institute of Scientific and Technical Information of China (English)

    LI Zhanchun; LI Zhitang; LIU Bin

    2006-01-01

    This article presents an anomaly detection system based on principal component analysis (PCA) and support vector machine (SVM). The system first creates a profile defining a normal behavior by frequency-based scheme, and then compares the similarity of a current behavior with the created profile to decide whether the input instance is normal or anomaly. In order to avoid overfitting and reduce the computational burden, normal behavior principal features are extracted by the PCA method. SVM is used to distinguish normal or anomaly for user behavior after training procedure has been completed by learning. In the experiments for performance evaluation the system achieved a correct detection rate equal to 92.2% and a false detection rate equal to 2.8%.

  4. Robust and accurate anomaly detection in ECG artifacts using time series motif discovery.

    Science.gov (United States)

    Sivaraks, Haemwaan; Ratanamahatana, Chotirat Ann

    2015-01-01

    Electrocardiogram (ECG) anomaly detection is an important technique for detecting dissimilar heartbeats which helps identify abnormal ECGs before the diagnosis process. Currently available ECG anomaly detection methods, ranging from academic research to commercial ECG machines, still suffer from a high false alarm rate because these methods are not able to differentiate ECG artifacts from real ECG signal, especially, in ECG artifacts that are similar to ECG signals in terms of shape and/or frequency. The problem leads to high vigilance for physicians and misinterpretation risk for nonspecialists. Therefore, this work proposes a novel anomaly detection technique that is highly robust and accurate in the presence of ECG artifacts which can effectively reduce the false alarm rate. Expert knowledge from cardiologists and motif discovery technique is utilized in our design. In addition, every step of the algorithm conforms to the interpretation of cardiologists. Our method can be utilized to both single-lead ECGs and multilead ECGs. Our experiment results on real ECG datasets are interpreted and evaluated by cardiologists. Our proposed algorithm can mostly achieve 100% of accuracy on detection (AoD), sensitivity, specificity, and positive predictive value with 0% false alarm rate. The results demonstrate that our proposed method is highly accurate and robust to artifacts, compared with competitive anomaly detection methods.

  5. A measurement-based technique for incipient anomaly detection

    KAUST Repository

    Harrou, Fouzi

    2016-06-13

    Fault detection is essential for safe operation of various engineering systems. Principal component analysis (PCA) has been widely used in monitoring highly correlated process variables. Conventional PCA-based methods, nevertheless, often fail to detect small or incipient faults. In this paper, we develop new PCA-based monitoring charts, combining PCA with multivariate memory control charts, such as the multivariate cumulative sum (MCUSUM) and multivariate exponentially weighted moving average (MEWMA) monitoring schemes. The multivariate control charts with memory are sensitive to small and moderate faults in the process mean, which significantly improves the performance of PCA methods and widen their applicability in practice. Using simulated data, we demonstrate that the proposed PCA-based MEWMA and MCUSUM control charts are more effective in detecting small shifts in the mean of the multivariate process variables, and outperform the conventional PCA-based monitoring charts. © 2015 IEEE.

  6. Kullback-Leibler distance-based enhanced detection of incipient anomalies

    KAUST Repository

    Harrou, Fouzi

    2016-09-09

    Accurate and effective anomaly detection and diagnosis of modern engineering systems by monitoring processes ensure reliability and safety of a product while maintaining desired quality. In this paper, an innovative method based on Kullback-Leibler divergence for detecting incipient anomalies in highly correlated multivariate data is presented. We use a partial least square (PLS) method as a modeling framework and a symmetrized Kullback-Leibler distance (KLD) as an anomaly indicator, where it is used to quantify the dissimilarity between current PLS-based residual and reference probability distributions obtained using fault-free data. Furthermore, this paper reports the development of two monitoring charts based on the KLD. The first approach is a KLD-Shewhart chart, where the Shewhart monitoring chart with a three sigma rule is used to monitor the KLD of the response variables residuals from the PLS model. The second approach integrates the KLD statistic into the exponentially weighted moving average monitoring chart. The performance of the PLS-based KLD anomaly-detection methods is illustrated and compared to that of conventional PLS-based anomaly detection methods. Using synthetic data and simulated distillation column data, we demonstrate the greater sensitivity and effectiveness of the developed method over the conventional PLS-based methods, especially when data are highly correlated and small anomalies are of interest. Results indicate that the proposed chart is a very promising KLD-based method because KLD-based charts are, in practice, designed to detect small shifts in process parameters. © 2016 Elsevier Ltd

  7. Rapid Anomaly Detection and Tracking via Compressive Time-Spectra Measurement

    Science.gov (United States)

    2016-02-12

    strategy-- can be used for anomaly detection and have the advantage of requiring many fewer measurements than required for imaging, enabling high...detection and have the advantage of requiring many fewer measurements than required for imaging. Compressed sensing approaches for rapid detection... measurements are arranged in sequency blocks based on the signature tiles indicated in the graph; (b) Image, x. Consider the image x in Figure 2-5

  8. IMPROVEMENT OF ANOMALY DETECTION ALGORITHMS IN HYPERSPECTRAL IMAGES USING DISCRETE WAVELET TRANSFORM

    OpenAIRE

    Kamal Jamshidi; Mohsen Zare Baghbidi; Ahmad Reza Naghsh Nilchi; Saeid Homayouni

    2012-01-01

    Recently anomaly detection (AD) has become an important application for target detection in hyperspectral remotely sensed images. In many applications, in addition to high accuracy of detection we need a fast and reliable algorithm as well. This paper presents a novel method to improve the performance of current AD algorithms. The proposed method first calculates Discrete Wavelet Transform (DWT) of every pixel vector of image using Daubechies4 wavelet. Then, AD algorithm performs on four band...

  9. Quality Control of Temperature and Salinity from CTD based on Anomaly Detection

    CERN Document Server

    Castelão, Guilherme P

    2015-01-01

    The CTD is a set of sensors used by oceanographers to measure fundamental hydrographic properties of the oceans. It is characterized by a high precision product, only achieved if a quality control procedure identifies and removes the bad samples. Such procedure has been traditionally done by a sequence of independent tests that minimize false negatives. It is here proposed a novel approach to identify the bad samples as anomalies in respect to the typical behavior of good data. Several tests are combined into a single multidimensional evaluation to provide a more flexible classification criterion. The traditional approach is reproduced with an error of 0.04%, otherwise, the Anomaly Detection technique surpasses the reference if calibrated by visual inspection. CoTeDe is a Python package developed to apply the traditional and the Anomaly Detection quality control of temperature and salinity data from CTD, and can be extended to XBT, ARGO and other sensors.

  10. An Automatic Approach to Detect Software Anomalies in Cloud Computing Using Pragmatic Bayes Approach

    Directory of Open Access Journals (Sweden)

    Nethaji V

    2014-06-01

    Full Text Available Software detection of anomalies is a vital element of operations in data centers and service clouds. Statistical Process Control (SPC cloud charts sense routine anomalies and their root causes are identified based on the differential profiling strategy. By automating the tasks, most of the manual overhead incurred in detecting the software anomalies and the analysis time are reduced to a larger extent but detailed analysis of profiling data are not performed in most of the cases. On the other hand, the cloud scheduler judges both the requirements of the user and the available infrastructure to equivalent their requirements. OpenStack prototype works on cloud trust management which provides the scheduler but complexity occurs when hosting the cloud system. At the same time, Trusted Computing Base (TCB of a computing node does not achieve the scalability measure. This unique paradigm brings about many software anomalies, which have not been well studied. This work, a Pragmatic Bayes approach studies the problem of detecting software anomalies and ensures scalability by comparing information at the current time to historical data. In particular, PB approach uses the two component Gaussian mixture to deviations at current time in cloud environment. The introduction of Gaussian mixture in PB approach achieves higher scalability measure which involves supervising massive number of cells and fast enough to be potentially useful in many streaming scenarios. Wherein previous works has been ensured for scheduling often lacks of scalability, this paper shows the superiority of the method using a Bayes per section error rate procedure through simulation, and provides the detailed analysis of profiling data in the marginal distributions using the Amazon EC2 dataset. Extensive performance analysis shows that the PB approach is highly efficient in terms of runtime, scalability, software anomaly detection ratio, CPU utilization, density rate, and computational

  11. Critical features in electromagnetic anomalies detected prior to the L'Aquila earthquake

    CERN Document Server

    Contoyiannis, Y F; Kopanas, J; Antonopoulos, G; Contoyianni, L; Eftaxias, K

    2009-01-01

    Electromagnetic (EM) emissions in a wide frequency spectrum ranging from kHz to MHz are produced by opening cracks, which can be considered as the so-called precursors of general fracture. We emphasize that the MHz radiation appears earlier than the kHz in both laboratory and geophysical scale. An important challenge in this field of research is to distinguish characteristic epochs in the evolution of precursory EM activity and identify them with the equivalent last stages in the earthquake (EQ) preparation process. Recently, we proposed the following two epochs/stages model: (i) The second epoch, which includes the finally emerged strong impulsive kHz EM emission is due to the fracture of the high strength large asperities that are distributed along the activated fault sustaining the system. (ii) The first epoch, which includes the initially emerged MHz EM radiation is thought to be due to the fracture of a highly heterogeneous system that surrounds the family of asperities. A catastrophic EQ of magnitude Mw...

  12. Dynamic analysis methods for detecting anomalies in asynchronously interacting systems

    Energy Technology Data Exchange (ETDEWEB)

    Kumar, Akshat; Solis, John Hector; Matschke, Benjamin

    2014-01-01

    Detecting modifications to digital system designs, whether malicious or benign, is problematic due to the complexity of the systems being analyzed. Moreover, static analysis techniques and tools can only be used during the initial design and implementation phases to verify safety and liveness properties. It is computationally intractable to guarantee that any previously verified properties still hold after a system, or even a single component, has been produced by a third-party manufacturer. In this paper we explore new approaches for creating a robust system design by investigating highly-structured computational models that simplify verification and analysis. Our approach avoids the need to fully reconstruct the implemented system by incorporating a small verification component that dynamically detects for deviations from the design specification at run-time. The first approach encodes information extracted from the original system design algebraically into a verification component. During run-time this component randomly queries the implementation for trace information and verifies that no design-level properties have been violated. If any deviation is detected then a pre-specified fail-safe or notification behavior is triggered. Our second approach utilizes a partitioning methodology to view liveness and safety properties as a distributed decision task and the implementation as a proposed protocol that solves this task. Thus the problem of verifying safety and liveness properties is translated to that of verifying that the implementation solves the associated decision task. We develop upon results from distributed systems and algebraic topology to construct a learning mechanism for verifying safety and liveness properties from samples of run-time executions.

  13. Anomaly Detection for Internet of Vehicles: A Trust Management Scheme with Affinity Propagation

    Directory of Open Access Journals (Sweden)

    Shu Yang

    2016-01-01

    Full Text Available Anomaly detection is critical for intelligent vehicle (IV collaboration. Forming clusters/platoons, IVs can work together to accomplish complex jobs that they are unable to perform individually. To improve security and efficiency of Internet of Vehicles, IVs’ anomaly detection has been extensively studied and a number of trust-based approaches have been proposed. However, most of these proposals either pay little attention to leader-based detection algorithm or ignore the utility of networked Roadside-Units (RSUs. In this paper, we introduce a trust-based anomaly detection scheme for IVs, where some malicious or incapable vehicles are existing on roads. The proposed scheme works by allowing IVs to detect abnormal vehicles, communicate with each other, and finally converge to some trustworthy cluster heads (CHs. Periodically, the CHs take responsibility for intracluster trust management. Moreover, the scheme is enhanced with a distributed supervising mechanism and a central reputation arbitrator to assure robustness and fairness in detecting process. The simulation results show that our scheme can achieve a low detection failure rate below 1%, demonstrating its ability to detect and filter the abnormal vehicles.

  14. A smartphone based method to enhance road pavement anomaly detection by analyzing the driver behavior

    NARCIS (Netherlands)

    Seraj, Fatjon; Zhang, Kui; Türkes, Okan; Meratnia, Nirvana; Havinga, Paul J.M.

    2015-01-01

    This paper introduces a method to detect road anomalies by analyzing driver behaviours. The analysis is based on the data and the features extracted from smartphone inertial sensors to calculate the angle of swerving and also based on distinctive states of a driver behaviour event. A novel approach

  15. One Class Classification for Anomaly Detection: Support Vector Data Description Revisited

    NARCIS (Netherlands)

    Pauwels, E.J.; Ambekar, O.; Perner, P.

    2011-01-01

    The Support Vector Data Description (SVDD) has been introduced to address the problem of anomaly (or outlier) detection. It essentially fits the smallest possible sphere around the given data points, allowing some points to be excluded as outliers. Whether or not a point is excluded, is governed by

  16. Setup Instructions for the Applied Anomaly Detection Tool (AADT) Web Server

    Science.gov (United States)

    2016-09-01

    Washington Headquarters Services , Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington...Microsoft Windows. 15. SUBJECT TERMS Applied Anomaly Detection Tool, AADT, Windows, server, web service , installation 16. SECURITY CLASSIFICATION OF: 17...Web Platform Installer at the Products page..........................................8 Fig. 8 Web Platform Installer search results for PHP

  17. Using Machine Learning for Advanced Anomaly Detection and Classification

    Science.gov (United States)

    Lane, B.; Poole, M.; Camp, M.; Murray-Krezan, J.

    2016-09-01

    Machine Learning (ML) techniques have successfully been used in a wide variety of applications to automatically detect and potentially classify changes in activity, or a series of activities by utilizing large amounts data, sometimes even seemingly-unrelated data. The amount of data being collected, processed, and stored in the Space Situational Awareness (SSA) domain has grown at an exponential rate and is now better suited for ML. This paper describes development of advanced algorithms to deliver significant improvements in characterization of deep space objects and indication and warning (I&W) using a global network of telescopes that are collecting photometric data on a multitude of space-based objects. The Phase II Air Force Research Laboratory (AFRL) Small Business Innovative Research (SBIR) project Autonomous Characterization Algorithms for Change Detection and Characterization (ACDC), contracted to ExoAnalytic Solutions Inc. is providing the ability to detect and identify photometric signature changes due to potential space object changes (e.g. stability, tumble rate, aspect ratio), and correlate observed changes to potential behavioral changes using a variety of techniques, including supervised learning. Furthermore, these algorithms run in real-time on data being collected and processed by the ExoAnalytic Space Operations Center (EspOC), providing timely alerts and warnings while dynamically creating collection requirements to the EspOC for the algorithms that generate higher fidelity I&W. This paper will discuss the recently implemented ACDC algorithms, including the general design approach and results to date. The usage of supervised algorithms, such as Support Vector Machines, Neural Networks, k-Nearest Neighbors, etc., and unsupervised algorithms, for example k-means, Principle Component Analysis, Hierarchical Clustering, etc., and the implementations of these algorithms is explored. Results of applying these algorithms to EspOC data both in an off

  18. Detection of elastic and electric conductivity anomalies in Potassium Sulphamate single crystal

    Energy Technology Data Exchange (ETDEWEB)

    Varughese, George, E-mail: gvushakoppara@yahoo.co.i [Department of Physics, Catholicate College, Pathanamthitta, Kerala 689645 (India); Santhosh Kumar, A. [SPAP, Mahatma Gandhi University, Kottayam, Kerala 686 560 (India); Louis, Godfrey [Department of Physics, Cochin University of Science and Technology, Cochin 22 (India)

    2010-04-01

    Elastic anomalies in Potassium Sulphamate, (KNH{sub 2}SO{sub 3}), above room temperature were detected from temperature variation of elastic constants measured by ultrasonic Pulse Echo Overlap technique. Potassium Sulphamate has been reported to be a ferroelectric and piezo electric material. The elastic constants C{sub 11}, C{sub 44}, C{sub 55} and C{sub 66} have exhibited weak anomalies around 350 K. The DC conductivity measurement along a, b, and c axes also supports this conclusion.

  19. Magnetic anomaly detection (MAD) of ferromagnetic pipelines using principal component analysis (PCA)

    Science.gov (United States)

    Sheinker, Arie; Moldwin, Mark B.

    2016-04-01

    The magnetic anomaly detection (MAD) method is used for detection of visually obscured ferromagnetic objects. The method exploits the magnetic field originating from the ferromagnetic object, which constitutes an anomaly in the ambient earth’s magnetic field. Traditionally, MAD is used to detect objects with a magnetic field of a dipole structure, where far from the object it can be considered as a point source. In the present work, we expand MAD to the case of a non-dipole source, i.e. a ferromagnetic pipeline. We use principal component analysis (PCA) to calculate the principal components, which are then employed to construct an effective detector. Experiments conducted in our lab with real-world data validate the above analysis. The simplicity, low computational complexity, and the high detection rate make the proposed detector attractive for real-time, low power applications.

  20. HPNAIDM: The High-Performance Network Anomaly/Intrusion Detection and Mitigation System

    Energy Technology Data Exchange (ETDEWEB)

    Chen, Yan [Northwesten University

    2013-12-05

    Identifying traffic anomalies and attacks rapidly and accurately is critical for large network operators. With the rapid growth of network bandwidth, such as the next generation DOE UltraScience Network, and fast emergence of new attacks/virus/worms, existing network intrusion detection systems (IDS) are insufficient because they: • Are mostly host-based and not scalable to high-performance networks; • Are mostly signature-based and unable to adaptively recognize flow-level unknown attacks; • Cannot differentiate malicious events from the unintentional anomalies. To address these challenges, we proposed and developed a new paradigm called high-performance network anomaly/intrustion detection and mitigation (HPNAIDM) system. The new paradigm is significantly different from existing IDSes with the following features (research thrusts). • Online traffic recording and analysis on high-speed networks; • Online adaptive flow-level anomaly/intrusion detection and mitigation; • Integrated approach for false positive reduction. Our research prototype and evaluation demonstrate that the HPNAIDM system is highly effective and economically feasible. Beyond satisfying the pre-set goals, we even exceed that significantly (see more details in the next section). Overall, our project harvested 23 publications (2 book chapters, 6 journal papers and 15 peer-reviewed conference/workshop papers). Besides, we built a website for technique dissemination, which hosts two system prototype release to the research community. We also filed a patent application and developed strong international and domestic collaborations which span both academia and industry.

  1. Towards spatial localisation of harmful algal blooms; statistics-based spatial anomaly detection

    Science.gov (United States)

    Shutler, J. D.; Grant, M. G.; Miller, P. I.

    2005-10-01

    Harmful algal blooms are believed to be increasing in occurrence and their toxins can be concentrated by filter-feeding shellfish and cause amnesia or paralysis when ingested. As a result fisheries and beaches in the vicinity of blooms may need to be closed and the local population informed. For this avoidance planning timely information on the existence of a bloom, its species and an accurate map of its extent would be prudent. Current research to detect these blooms from space has mainly concentrated on spectral approaches towards determining species. We present a novel statistics-based background-subtraction technique that produces improved descriptions of an anomaly's extent from remotely-sensed ocean colour data. This is achieved by extracting bulk information from a background model; this is complemented by a computer vision ramp filtering technique to specifically detect the perimeter of the anomaly. The complete extraction technique uses temporal-variance estimates which control the subtraction of the scene of interest from the time-weighted background estimate, producing confidence maps of anomaly extent. Through the variance estimates the method learns the associated noise present in the data sequence, providing robustness, and allowing generic application. Further, the use of the median for the background model reduces the effects of anomalies that appear within the time sequence used to generate it, allowing seasonal variations in the background levels to be closely followed. To illustrate the detection algorithm's application, it has been applied to two spectrally different oceanic regions.

  2. Contextual anomaly detection for cyber-physical security in Smart Grids based on an artificial neural network model

    DEFF Research Database (Denmark)

    Kosek, Anna Magdalena

    2016-01-01

    This paper presents a contextual anomaly detection method and its use in the discovery of malicious voltage control actions in the low voltage distribution grid. The model-based anomaly detection uses an artificial neural network model to identify a distributed energy resource’s behaviour under...

  3. Contextual anomaly detection for cyber-physical security in Smart Grids based on an artificial neural network model

    DEFF Research Database (Denmark)

    Kosek, Anna Magdalena

    2016-01-01

    This paper presents a contextual anomaly detection method and its use in the discovery of malicious voltage control actions in the low voltage distribution grid. The model-based anomaly detection uses an artificial neural network model to identify a distributed energy resource’s behaviour under c...

  4. A scalable architecture for online anomaly detection of WLCG batch jobs

    Science.gov (United States)

    Kuehn, E.; Fischer, M.; Giffels, M.; Jung, C.; Petzold, A.

    2016-10-01

    For data centres it is increasingly important to monitor the network usage, and learn from network usage patterns. Especially configuration issues or misbehaving batch jobs preventing a smooth operation need to be detected as early as possible. At the GridKa data and computing centre we therefore operate a tool BPNetMon for monitoring traffic data and characteristics of WLCG batch jobs and pilots locally on different worker nodes. On the one hand local information itself are not sufficient to detect anomalies for several reasons, e.g. the underlying job distribution on a single worker node might change or there might be a local misconfiguration. On the other hand a centralised anomaly detection approach does not scale regarding network communication as well as computational costs. We therefore propose a scalable architecture based on concepts of a super-peer network.

  5. Road Traffic Anomaly Detection via Collaborative Path Inference from GPS Snippets

    Directory of Open Access Journals (Sweden)

    Hongtao Wang

    2017-03-01

    Full Text Available Road traffic anomaly denotes a road segment that is anomalous in terms of traffic flow of vehicles. Detecting road traffic anomalies from GPS (Global Position System snippets data is becoming critical in urban computing since they often suggest underlying events. However, the noisy ands parse nature of GPS snippets data have ushered multiple problems, which have prompted the detection of road traffic anomalies to be very challenging. To address these issues, we propose a two-stage solution which consists of two components: a Collaborative Path Inference (CPI model and a Road Anomaly Test (RAT model. CPI model performs path inference incorporating both static and dynamic features into a Conditional Random Field (CRF. Dynamic context features are learned collaboratively from large GPS snippets via a tensor decomposition technique. Then RAT calculates the anomalous degree for each road segment from the inferred fine-grained trajectories in given time intervals. We evaluated our method using a large scale real world dataset, which includes one-month GPS location data from more than eight thousand taxi cabs in Beijing. The evaluation results show the advantages of our method beyond other baseline techniques.

  6. [Multi-DSP parallel processing technique of hyperspectral RX anomaly detection].

    Science.gov (United States)

    Guo, Wen-Ji; Zeng, Xiao-Ru; Zhao, Bao-Wei; Ming, Xing; Zhang, Gui-Feng; Lü, Qun-Bo

    2014-05-01

    To satisfy the requirement of high speed, real-time and mass data storage etc. for RX anomaly detection of hyperspectral image data, the present paper proposes a solution of multi-DSP parallel processing system for hyperspectral image based on CPCI Express standard bus architecture. Hardware topological architecture of the system combines the tight coupling of four DSPs sharing data bus and memory unit with the interconnection of Link ports. On this hardware platform, by assigning parallel processing task for each DSP in consideration of the spectrum RX anomaly detection algorithm and the feature of 3D data in the spectral image, a 4DSP parallel processing technique which computes and solves the mean matrix and covariance matrix of the whole image by spatially partitioning the image is proposed. The experiment result shows that, in the case of equivalent detective effect, it can reach the time efficiency 4 times higher than single DSP process with the 4-DSP parallel processing technique of RX anomaly detection algorithm proposed by this paper, which makes a breakthrough in the constraints to the huge data image processing of DSP's internal storage capacity, meanwhile well meeting the demands of the spectral data in real-time processing.

  7. Incorporating Prior Shape into Geometric Active Contours for Face Contour Detection

    Institute of Scientific and Technical Information of China (English)

    HUANGFuzhen; SUJianbo; XIYugeng

    2004-01-01

    In this paper a new method that incorporates prior shape information into geometric active contours for face contour detection is proposed. As in general a human face can be treated as an ellipse with a little shape variation, the prior face shape is represented as an elliptical curve. By combining the prior face shape with the powerful geometric active model proposed by Chan and Vese, the improved geometric active model can retain all the advantage of the Chan-Vese model and can detect face contours in images with complex backgrounds accurately even if the image is noisy. Moreover, by implementing the new model in a variational level set framework, automatic topological changes of the model can be achieved naturally and the transformation parameters that map the face boundary to the prior shape can be roughly estimated simultaneously. The experimental results show our procedure to be eiTicient.

  8. GraphPrints: Towards a Graph Analytic Method for Network Anomaly Detection

    Energy Technology Data Exchange (ETDEWEB)

    Harshaw, Chris R [ORNL; Bridges, Robert A [ORNL; Iannacone, Michael D [ORNL; Reed, Joel W [ORNL; Goodall, John R [ORNL

    2016-01-01

    This paper introduces a novel graph-analytic approach for detecting anomalies in network flow data called \\textit{GraphPrints}. Building on foundational network-mining techniques, our method represents time slices of traffic as a graph, then counts graphlets\\textemdash small induced subgraphs that describe local topology. By performing outlier detection on the sequence of graphlet counts, anomalous intervals of traffic are identified, and furthermore, individual IPs experiencing abnormal behavior are singled-out. Initial testing of GraphPrints is performed on real network data with an implanted anomaly. Evaluation shows false positive rates bounded by 2.84\\% at the time-interval level, and 0.05\\% at the IP-level with 100\\% true positive rates at both.

  9. Capacitance probe for detection of anomalies in non-metallic plastic pipe

    Science.gov (United States)

    Mathur, Mahendra P.; Spenik, James L.; Condon, Christopher M.; Anderson, Rodney; Driscoll, Daniel J.; Fincham, Jr., William L.; Monazam, Esmail R.

    2010-11-23

    The disclosure relates to analysis of materials using a capacitive sensor to detect anomalies through comparison of measured capacitances. The capacitive sensor is used in conjunction with a capacitance measurement device, a location device, and a processor in order to generate a capacitance versus location output which may be inspected for the detection and localization of anomalies within the material under test. The components may be carried as payload on an inspection vehicle which may traverse through a pipe interior, allowing evaluation of nonmetallic or plastic pipes when the piping exterior is not accessible. In an embodiment, supporting components are solid-state devices powered by a low voltage on-board power supply, providing for use in environments where voltage levels may be restricted.

  10. Anomaly Detection for Data Reduction in an Unattended Ground Sensor (UGS) Field

    Science.gov (United States)

    2014-09-01

    algorithm applied to tracks generated by analyzing full-motion video data from a live sensor feed. The anomaly algorithm could also be applied to other data...than FPSS track data from streaming video . It could be integrated into a tripwire sensor detecting the number of trips within a specified time frame...report describes the design and implementation of a data reduction technique for video sensors that are part of a larger unattended ground sensor (UGS

  11. Fetal Central Nervous System Anomalies Detected by Magnetic Resonance Imaging: A Two-Year Experience

    Directory of Open Access Journals (Sweden)

    Sepideh Sefidbakht

    2016-06-01

    Full Text Available Background Magnetic resonance imaging (MRI is gradually becoming more common for thorough visualization of the fetus than ultrasound (US, especially for neurological anomalies, which are the most common indications for fetal MRI and are a matter of concern for both families and society. Objectives We investigated fetal MRIs carried out in our center for frequency of central nervous system anomalies. This is the first such report in southern Iran. Materials and Methods One hundred and seven (107 pregnant women with suspicious fetal anomalies in prenatal ultrasound entered a cross-sectional retrospective study from 2011 to 2013. A 1.5 T Siemens Avanto scanner was employed for sequences, including T2 HASTE and Trufisp images in axial, coronal, and sagittal planes to mother’s body, T2 HASTE and Trufisp relative to the specific fetal body part being evaluated, and T1 flash images in at least one plane based on clinical indication. We investigated any abnormality in the central nervous system and performed descriptive analysis to achieve index of frequency. Results Mean gestational age ± standard deviation (SD for fetuses was 25.54 ± 5.22 weeks, and mean maternal age ± SD was 28.38 ± 5.80 years Eighty out of 107 (74.7% patients who were referred with initial impression of borderline ventriculomegaly. A total of 18 out of 107 (16.82% patients were found to have fetuses with CNS anomalies and the remainder were neurologically normal. Detected anomalies were as follow: 3 (16.6% fetuses each had the Dandy-Walker variant and Arnold-Chiari II (with myelomeningocele. Complete agenesis of corpus callosum, partial agenesis of corpus callosum, and aqueductal stenosis were each seen in 2 (11.1% fetuses. Arnold-Chiari II without myelomeningocele, anterior spina bifida associated with neurenteric cyst, arachnoid cyst, lissencephaly, and isolated enlarged cisterna magna each presented in one (5.5% fetus. One fetus had concomitant schizencephaly and complete

  12. Accurate Anomaly Detection using Adaptive Monitoring and Fast Switching in SDN

    Directory of Open Access Journals (Sweden)

    Gagandeep Garg

    2015-10-01

    Full Text Available —Software defined networking (SDN is rapidly evolving technology which provides a suitable environment for easily applying efficient monitoring policies on the networks. SDN provides a centralized control of the whole network from which monitoring of network traffic and resources can be done with ease. SDN promises to drastically simplify network monitoring and management and also enable rapid innovation of networks through network programmability. SDN architecture separates the control of the network from the forwarding devices. With the higher innovation provided by the SDN, security threats at open interfaces of SDN also increases significantly as an attacker can target the single centralized point i.e. controller, to attack the network. Hence, efficient adaptive monitoring and measurement is required to detect and prevent malicious activities inside the network. Various such techniques have already been proposed by many researchers. This paper describes a work of applying efficient adaptive monitoring on the network while maintaining the performance of the network considering monitoring overhead over the controller. This work represents effective bandwidth utilization for calculation of threshold range while applying anomaly detection rules for monitoring of the network. Accurate detection of anomalies is implemented and also allows valid users and applications to transfer the data without any restrictions inside the network which otherwise were considered as anomalies in previous technique due to fluctuation of data and narrow threshold window. The concept of fast switching also used to improve the processing speed and performance of the networks.

  13. Clusters versus GPUs for Parallel Target and Anomaly Detection in Hyperspectral Images

    Directory of Open Access Journals (Sweden)

    Paz Abel

    2010-01-01

    Full Text Available Abstract Remotely sensed hyperspectral sensors provide image data containing rich information in both the spatial and the spectral domain, and this information can be used to address detection tasks in many applications. In many surveillance applications, the size of the objects (targets searched for constitutes a very small fraction of the total search area and the spectral signatures associated to the targets are generally different from those of the background, hence the targets can be seen as anomalies. In hyperspectral imaging, many algorithms have been proposed for automatic target and anomaly detection. Given the dimensionality of hyperspectral scenes, these techniques can be time-consuming and difficult to apply in applications requiring real-time performance. In this paper, we develop several new parallel implementations of automatic target and anomaly detection algorithms. The proposed parallel algorithms are quantitatively evaluated using hyperspectral data collected by the NASA's Airborne Visible Infra-Red Imaging Spectrometer (AVIRIS system over theWorld Trade Center (WTC in New York, five days after the terrorist attacks that collapsed the two main towers in theWTC complex.

  14. A Model-Based Anomaly Detection Approach for Analyzing Streaming Aircraft Engine Measurement Data

    Science.gov (United States)

    Simon, Donald L.; Rinehart, Aidan Walker

    2015-01-01

    This paper presents a model-based anomaly detection architecture designed for analyzing streaming transient aircraft engine measurement data. The technique calculates and monitors residuals between sensed engine outputs and model predicted outputs for anomaly detection purposes. Pivotal to the performance of this technique is the ability to construct a model that accurately reflects the nominal operating performance of the engine. The dynamic model applied in the architecture is a piecewise linear design comprising steady-state trim points and dynamic state space matrices. A simple curve-fitting technique for updating the model trim point information based on steadystate information extracted from available nominal engine measurement data is presented. Results from the application of the model-based approach for processing actual engine test data are shown. These include both nominal fault-free test case data and seeded fault test case data. The results indicate that the updates applied to improve the model trim point information also improve anomaly detection performance. Recommendations for follow-on enhancements to the technique are also presented and discussed.

  15. A Method for Anomaly Detection of User Behaviors Based on Machine Learning

    Institute of Scientific and Technical Information of China (English)

    TIAN Xin-guang; GAO Li-zhi; SUN Chun-lai; DUAN Mi-yi; ZHANG Er-yang

    2006-01-01

    This paper presents a new anomaly detection method based on machine learning. Applicable to host-based intrusion detection systems, this method uses shell commands as audit data. The method employs shell command sequences of different lengths to characterize behavioral patterns of a network user, and constructs multiple sequence libraries to represent the user's normal behavior profile. In the detection stage, the behavioral patterns in the audit data are mined by a sequence-matching algorithm, and the similarities between the mined patterns and the historical profile are evaluated. These similarities are then smoothed with sliding windows, and the smoothed similarities are used to determine whether the monitored user's behaviors are normal or anomalous. The results of our experience show the method can achieve higher detection accuracy and shorter detection time than the instance-based method presented by Lane T. The method has been successfully applied in practical host-based intrusion detection systems.

  16. Boosting multi-features with prior knowledge for mini unmanned helicopter landmark detection

    Institute of Scientific and Technical Information of China (English)

    2008-01-01

    Without sufficient real training data, the data driven classification algorithms based on boosting method cannot solely be utilized to applications such as the mini unmanned helicopter landmark image detection. In this paper, we propose an approach which uses a boosting algorithm with the prior knowledge for the mini unmanned helicopter landmark image detection. The stage forward stagewise additive model of boosting is analyzed, and the approach how to combine it with the prior knowledge model is presented. The approach is then applied to landmark image detection, where the multi-features are boosted to solve a series of problems, such as rotation, noises affected, etc. Results of real flight experiments demonstrate that for small training examples the boosted learning system using prior knowledge is dramatically better than the one driven by data only.

  17. Detection and Origin of Hydrocarbon Seepage Anomalies in the Barents Sea

    Science.gov (United States)

    Polteau, Stephane; Planke, Sverre; Stolze, Lina; Kjølhamar, Bent E.; Myklebust, Reidun

    2016-04-01

    We have collected more than 450 gravity cores in the Barents Sea to detect hydrocarbon seepage anomalies and for seismic-stratigraphic tie. The cores are from the Hoop Area (125 samples) and from the Barents Sea SE (293 samples). In addition, we have collected cores near seven exploration wells. The samples were analyzed using three different analytical methods; (1) the standard organic geochemical analyzes of Applied Petroleum Technologies (APT), (2) the Amplified Geochemical Imaging (AGI) method, and (3) the Microbial Prospecting for Oil and Gas (MPOG) method. These analytical approaches can detect trace amounts of thermogenic hydrocarbons in the sediment samples, and may provide additional information about the fluid phases and the depositional environment, maturation, and age of the source rocks. However, hydrocarbon anomalies in seabed sediments may also be related to shallow sources, such as biogenic gas or reworked source rocks in the sediments. To better understand the origin of the hydrocarbon anomalies in the Barents Sea we have studied 35 samples collected approximately 200 m away from seven exploration wells. The wells included three boreholes associated with oil discoveries, two with gas discoveries, one dry well with gas shows, and one dry well. In general, the results of this case study reveal that the oil wells have an oil signature, gas wells show a gas signature, and dry wells have a background signature. However, differences in results from the three methods may occur and have largely been explained in terms of analytical measurement ranges, method sensitivities, and bio-geochemical processes in the seabed sediments. The standard geochemical method applied by APT relies on measuring the abundance of compounds between C1 to C5 in the headspace gas and between C11 to C36 in the sediment extracts. The anomalies detected in the sediment samples from this study were in the C16 to C30 range. Since the organic matter yields were mostly very low, the

  18. Improving Anomaly Detection for Text-Based Protocols by Exploiting Message Structures

    Directory of Open Access Journals (Sweden)

    Christian M. Mueller

    2010-12-01

    Full Text Available Service platforms using text-based protocols need to be protected against attacks. Machine-learning algorithms with pattern matching can be used to detect even previously unknown attacks. In this paper, we present an extension to known Support Vector Machine (SVM based anomaly detection algorithms for the Session Initiation Protocol (SIP. Our contribution is to extend the amount of different features used for classification (feature space by exploiting the structure of SIP messages, which reduces the false positive rate. Additionally, we show how combining our approach with attribute reduction significantly improves throughput.

  19. OPAD through 1991 - Status report no. 2. [Optical Plume Anomaly Detection

    Science.gov (United States)

    Powers, W. T.; Cooper, A. E.; Wallace, T. L.

    1991-01-01

    The Optical Plume Anomaly Detection (OPAD) experimental program has attempted to develop a rocket engine health monitor for the detection, and if possible the quantification, of anomalous atomic and molecular species in exhaust plumes. The test program has formulated instrument designs allowing both wide spectral range and high spectral resolution. Attention is presently given to OPAD data collected for the SSME at NASA-Marshall's technology test stand, with a view to spectral emissions at startup and variations in baseline plume emissions due to changes in rated power level.

  20. Cosaliency Detection Based on Intrasaliency Prior Transfer and Deep Intersaliency Mining.

    Science.gov (United States)

    Zhang, Dingwen; Han, Junwei; Han, Jungong; Shao, Ling

    2016-06-01

    As an interesting and emerging topic, cosaliency detection aims at simultaneously extracting common salient objects in multiple related images. It differs from the conventional saliency detection paradigm in which saliency detection for each image is determined one by one independently without taking advantage of the homogeneity in the data pool of multiple related images. In this paper, we propose a novel cosaliency detection approach using deep learning models. Two new concepts, called intrasaliency prior transfer and deep intersaliency mining, are introduced and explored in the proposed work. For the intrasaliency prior transfer, we build a stacked denoising autoencoder (SDAE) to learn the saliency prior knowledge from auxiliary annotated data sets and then transfer the learned knowledge to estimate the intrasaliency for each image in cosaliency data sets. For the deep intersaliency mining, we formulate it by using the deep reconstruction residual obtained in the highest hidden layer of a self-trained SDAE. The obtained deep intersaliency can extract more intrinsic and general hidden patterns to discover the homogeneity of cosalient objects in terms of some higher level concepts. Finally, the cosaliency maps are generated by weighted integration of the proposed intrasaliency prior, deep intersaliency, and traditional shallow intersaliency. Comprehensive experiments over diverse publicly available benchmark data sets demonstrate consistent performance gains of the proposed method over the state-of-the-art cosaliency detection methods.

  1. Sequential anomaly detection in the presence of noise and limited feedback

    CERN Document Server

    Raginsky, Maxim; Silva, Jorge; Willett, Rebecca

    2009-01-01

    This paper describes a method for detecting anomalies from sequentially observed and potentially noisy data. The proposed approach consists of two main elements: (1) filtering, or assigning a belief or likelihood to each successive measurement based upon our ability to predict it from previous noisy observations, and (2) hedging, or flagging potential anomalies by comparing the current belief against a time-varying and data-adaptive threshold. The threshold is adjusted based on the available feedback from an end user. Our algorithms, inspired by recent work on online convex programming, do not require computing posterior distributions given all current observations and involve simple primal-dual parameter updates. At the heart of the proposed approach lie exponential-family models which can be used in a wide variety of contexts and applications, and which yield methods that achieve sublinear per-round regret against both static and slowly varying product distributions with marginals drawn from the same expone...

  2. Anomaly Detection Rudiments for the Application of Hyperspectral Sensors in Aerospace Remote Sensing

    Energy Technology Data Exchange (ETDEWEB)

    Wong, Gerald, E-mail: gw25@hw.ac.u, E-mail: gerald.wong@selexgalileo.co [Heriot-Watt University, Riccarton Campus, Edinburgh, EH14 4AS (United Kingdom)

    2009-07-01

    Hyperspectral imaging differs from conventional techniques by exploiting the spectral dimensionality of remote scenes. This additional information promotes discrimination of image elements, especially anomalies that are dissimilar with respect to global features. Algorithms for anomaly detection are designed to overcome the inherent difficulty of analysing hypercubes, which are the higher-dimensional analogues of conventional broadband images. Such algorithms are prolific in their variety and design, which could become an obstacle in choice or application for the neophyte researcher in this field. This paper seeks to consolidate this plethora of algorithms into succinct categories for clarity of rudimentary decision making. A duplicate of article 012048 Snapshot hyperspectral imaging and practical applications was originally published here, in error, as article 012051. The present article replaced the duplicate and was published on 18 August 2009.

  3. Radiation anomaly detection algorithms for field-acquired gamma energy spectra

    Science.gov (United States)

    Mukhopadhyay, Sanjoy; Maurer, Richard; Wolff, Ron; Guss, Paul; Mitchell, Stephen

    2015-08-01

    The Remote Sensing Laboratory (RSL) is developing a tactical, networked radiation detection system that will be agile, reconfigurable, and capable of rapid threat assessment with high degree of fidelity and certainty. Our design is driven by the needs of users such as law enforcement personnel who must make decisions by evaluating threat signatures in urban settings. The most efficient tool available to identify the nature of the threat object is real-time gamma spectroscopic analysis, as it is fast and has a very low probability of producing false positive alarm conditions. Urban radiological searches are inherently challenged by the rapid and large spatial variation of background gamma radiation, the presence of benign radioactive materials in terms of the normally occurring radioactive materials (NORM), and shielded and/or masked threat sources. Multiple spectral anomaly detection algorithms have been developed by national laboratories and commercial vendors. For example, the Gamma Detector Response and Analysis Software (GADRAS) a one-dimensional deterministic radiation transport software capable of calculating gamma ray spectra using physics-based detector response functions was developed at Sandia National Laboratories. The nuisance-rejection spectral comparison ratio anomaly detection algorithm (or NSCRAD), developed at Pacific Northwest National Laboratory, uses spectral comparison ratios to detect deviation from benign medical and NORM radiation source and can work in spite of strong presence of NORM and or medical sources. RSL has developed its own wavelet-based gamma energy spectral anomaly detection algorithm called WAVRAD. Test results and relative merits of these different algorithms will be discussed and demonstrated.

  4. Seasonal ARMA-based SPC charts for anomaly detection: Application to emergency department systems

    KAUST Repository

    Kadri, Farid

    2015-10-22

    Monitoring complex production systems is primordial to ensure management, reliability and safety as well as maintaining the desired product quality. Early detection of emergent abnormal behaviour in monitored systems allows pre-emptive action to prevent more serious consequences, to improve system operations and to reduce manufacturing and/or service costs. This study reports the design of a new methodology for the detection of abnormal situations based on the integration of time-series analysis models and statistical process control (SPC) tools for the joint development of a monitoring system to help supervising of the behaviour of emergency department services (EDs). The monitoring system developed is able to provide early alerts in the event of abnormal situations. The seasonal autoregressive moving average (SARMA)-based exponentially weighted moving average (EWMA) anomaly detection scheme proposed was successfully applied to the practical data collected from the database of the paediatric emergency department (PED) at Lille regional hospital centre, France. The method developed utilizes SARMA as a modelling framework and EWMA for anomaly detection. The EWMA control chart is applied to the uncorrelated residuals obtained from the SARMA model. The detection results of the EWMA chart are compared with two other commonly applied residual-based tests: a Shewhart individuals chart and a Cumulative Sum (CUSUM) control chart.

  5. Smartphone-Based Pedestrian’s Avoidance Behavior Recognition towards Opportunistic Road Anomaly Detection

    Directory of Open Access Journals (Sweden)

    Tsuyoshi Ishikawa

    2016-10-01

    Full Text Available Road anomalies, such as cracks, pits and puddles, have generally been identified by citizen reports made by e-mail or telephone; however, it is difficult for administrative entities to locate the anomaly for repair. An advanced smartphone-based solution that sends text and/or image reports with location information is not a long-lasting solution, because it depends on people’s active reporting. In this article, we show an opportunistic sensing-based system that uses a smartphone for road anomaly detection without any active user involvement. To detect road anomalies, we focus on pedestrians’ avoidance behaviors, which are characterized by changing azimuth patterns. Three typical avoidance behaviors are defined, and random forest is chosen as the classifier. Twenty-nine features are defined, in which features calculated by splitting a segment into the first half and the second half and considering the monotonicity of change were proven to be effective in recognition. Experiments were carried out under an ideal and controlled environment. Ten-fold cross-validation shows an average classification performance with an F-measure of 0.89 for six activities. The proposed recognition method was proven to be robust against the size of obstacles, and the dependency on the storing position of a smartphone can be handled by an appropriate classifier per storing position. Furthermore, an analysis implies that the classification of data from an “unknown” person can be improved by taking into account the compatibility of a classifier.

  6. PROBABILITY CALIBRATION BY THE MINIMUM AND MAXIMUM PROBABILITY SCORES IN ONE-CLASS BAYES LEARNING FOR ANOMALY DETECTION

    Data.gov (United States)

    National Aeronautics and Space Administration — PROBABILITY CALIBRATION BY THE MINIMUM AND MAXIMUM PROBABILITY SCORES IN ONE-CLASS BAYES LEARNING FOR ANOMALY DETECTION GUICHONG LI, NATHALIE JAPKOWICZ, IAN HOFFMAN,...

  7. Confabulation Based Real-time Anomaly Detection for Wide-area Surveillance Using Heterogeneous High Performance Computing Architecture

    Science.gov (United States)

    2015-06-01

    by interactions among vehicles must be detectable . Such events have not been considered in previous research. 4. The overall system must have a...different types of anomalies. For example, a high anomaly score in the neighbor pair lexicon indicated a tailgating event or some other unusual relation...tailgating that were caused by interactions among vehicles were detected . Such events were not considered in previous research. 4. The overall system

  8. Advanced Unsupervised Classification Methods to Detect Anomalies on Earthen Levees Using Polarimetric SAR Imagery.

    Science.gov (United States)

    Marapareddy, Ramakalavathi; Aanstoos, James V; Younan, Nicolas H

    2016-06-16

    Fully polarimetric Synthetic Aperture Radar (polSAR) data analysis has wide applications for terrain and ground cover classification. The dynamics of surface and subsurface water events can lead to slope instability resulting in slough slides on earthen levees. Early detection of these anomalies by a remote sensing approach could save time versus direct assessment. We used L-band Synthetic Aperture Radar (SAR) to screen levees for anomalies. SAR technology, due to its high spatial resolution and soil penetration capability, is a good choice for identifying problematic areas on earthen levees. Using the parameters entropy (H), anisotropy (A), alpha (α), and eigenvalues (λ, λ₁, λ₂, and λ₃), we implemented several unsupervised classification algorithms for the identification of anomalies on the levee. The classification techniques applied are H/α, H/A, A/α, Wishart H/α, Wishart H/A/α, and H/α/λ classification algorithms. In this work, the effectiveness of the algorithms was demonstrated using quad-polarimetric L-band SAR imagery from the NASA Jet Propulsion Laboratory's (JPL's) Uninhabited Aerial Vehicle Synthetic Aperture Radar (UAVSAR). The study area is a section of the lower Mississippi River valley in the Southern USA, where earthen flood control levees are maintained by the US Army Corps of Engineers.

  9. Advanced Unsupervised Classification Methods to Detect Anomalies on Earthen Levees Using Polarimetric SAR Imagery

    Directory of Open Access Journals (Sweden)

    Ramakalavathi Marapareddy

    2016-06-01

    Full Text Available Fully polarimetric Synthetic Aperture Radar (polSAR data analysis has wide applications for terrain and ground cover classification. The dynamics of surface and subsurface water events can lead to slope instability resulting in slough slides on earthen levees. Early detection of these anomalies by a remote sensing approach could save time versus direct assessment. We used L-band Synthetic Aperture Radar (SAR to screen levees for anomalies. SAR technology, due to its high spatial resolution and soil penetration capability, is a good choice for identifying problematic areas on earthen levees. Using the parameters entropy (H, anisotropy (A, alpha (α, and eigenvalues (λ, λ1, λ2, and λ3, we implemented several unsupervised classification algorithms for the identification of anomalies on the levee. The classification techniques applied are H/α, H/A, A/α, Wishart H/α, Wishart H/A/α, and H/α/λ classification algorithms. In this work, the effectiveness of the algorithms was demonstrated using quad-polarimetric L-band SAR imagery from the NASA Jet Propulsion Laboratory’s (JPL’s Uninhabited Aerial Vehicle Synthetic Aperture Radar (UAVSAR. The study area is a section of the lower Mississippi River valley in the Southern USA, where earthen flood control levees are maintained by the US Army Corps of Engineers.

  10. Anomaly detection for network traffic flow%网络流量异常检测

    Institute of Scientific and Technical Information of China (English)

    单蓉胜; 李建华; 王明政

    2004-01-01

    提出了一种新颖的网络洪流攻击的异常检测机制.这种检测机制的无状态维护、低计算代价的特性保证了自身具有抗洪流攻击的能力.本文以检测SYN洪流攻击为实例详细阐述了异常检测机制.这个机制应用EWMA方法检测网络流的突变, 并运用对称性分析方法检测网络流的异常活动.测试结果表明本文所提出的检测机制具有很好的检测洪流攻击的准确度, 并具有低延时特性.%This paper presents a novel mechanism for detecting flooding-attacks. The simplicity of the mechanism lies in its statelessness and low computation overhead, which makes the detection mechanism itself immune to flooding-attacks. In this paper, SYN-flooding, as an instance of flooding-attack, is used to illustrate the anomaly detection mechanism. The mechanism applies an exponentially weighted moving average (EWMA) method to detect the abrupt net flow and applies a symmetry analysis method to detect the anomaly activity of the network flow. Experiment shows that the mechanism has high detection accuracy and low detection latency.

  11. Building robust neighborhoods for manifold learning-based image classification and anomaly detection

    Science.gov (United States)

    Doster, Timothy; Olson, Colin C.

    2016-05-01

    We exploit manifold learning algorithms to perform image classification and anomaly detection in complex scenes involving hyperspectral land cover and broadband IR maritime data. The results of standard manifold learning techniques are improved by including spatial information. This is accomplished by creating super-pixels which are robust to affine transformations inherent in natural scenes. We utilize techniques from harmonic analysis and image processing, namely, rotation, skew, flip, and shift operators to develop a more representational graph structure which defines the data-dependent manifold.

  12. Anomaly detection in homogenous populations: A sparse multiple kernel-based regularization method

    DEFF Research Database (Denmark)

    Chen, Tianshi; Andersen, Martin S.; Chiuso, Alessandro;

    2014-01-01

    A problem of anomaly detection in homogenous populations consisting of linear stable systems is studied. The recently introduced sparse multiple kernel based regularization method is applied to solve the problem. A common problem with the existing regularization methods is that there lacks...... an efficient and systematic way to tune the involved regularization parameters. In contrast, the hyper-parameters (some of them can be interpreted as regularization parameters) involved in the proposed method are tuned in an automatic way, and in fact estimated by using the empirical Bayes method. What's more...

  13. Multi-level anomaly detection: Relevance of big data analytics in networks

    Indian Academy of Sciences (India)

    Saad Y Sait; Akshay Bhandari; Shreya Khare; Cyriac James; Hema A Murthy

    2015-09-01

    The Internet has become a vital source of information; internal and external attacks threaten the integrity of the LAN connected to the Internet. In this work, several techniques have been described for detection of such threats. We have focussed on anomaly-based intrusion detection in the campus environment at the network edge. A campus LAN consisting of more than 9000 users with a 90 Mbps internet access link is a large network. Therefore, efficient techniques are required to handle such big data and to model user behaviour. Proxy server logs of a campus LAN and edge router traces have been used for anomalies like abusive Internet access, systematic downloading (internal threats) and DDoS attacks (external threat); our techniques involve machine learning and time series analysis applied at different layers in TCP/IP stack. Accuracy of our techniques has been demonstrated through extensive experimentation on huge and varied datasets. All the techniques are applicable at the edge and can be integrated into a Network Intrusion Detection System.

  14. Multiple Kernel Learning for Heterogeneous Anomaly Detection: Algorithm and Aviation Safety Case Study

    Science.gov (United States)

    Das, Santanu; Srivastava, Ashok N.; Matthews, Bryan L.; Oza, Nikunj C.

    2010-01-01

    The world-wide aviation system is one of the most complex dynamical systems ever developed and is generating data at an extremely rapid rate. Most modern commercial aircraft record several hundred flight parameters including information from the guidance, navigation, and control systems, the avionics and propulsion systems, and the pilot inputs into the aircraft. These parameters may be continuous measurements or binary or categorical measurements recorded in one second intervals for the duration of the flight. Currently, most approaches to aviation safety are reactive, meaning that they are designed to react to an aviation safety incident or accident. In this paper, we discuss a novel approach based on the theory of multiple kernel learning to detect potential safety anomalies in very large data bases of discrete and continuous data from world-wide operations of commercial fleets. We pose a general anomaly detection problem which includes both discrete and continuous data streams, where we assume that the discrete streams have a causal influence on the continuous streams. We also assume that atypical sequence of events in the discrete streams can lead to off-nominal system performance. We discuss the application domain, novel algorithms, and also discuss results on real-world data sets. Our algorithm uncovers operationally significant events in high dimensional data streams in the aviation industry which are not detectable using state of the art methods

  15. IMPROVEMENT OF ANOMALY DETECTION ALGORITHMS IN HYPERSPECTRAL IMAGES USING DISCRETE WAVELET TRANSFORM

    Directory of Open Access Journals (Sweden)

    Kamal Jamshidi

    2012-01-01

    Full Text Available Recently anomaly detection (AD has become an important application for target detection in hyperspectralremotely sensed images. In many applications, in addition to high accuracy of detection we need a fast andreliable algorithm as well. This paper presents a novel method to improve the performance of current ADalgorithms. The proposed method first calculates Discrete Wavelet Transform (DWT of every pixel vectorof image using Daubechies4 wavelet. Then, AD algorithm performs on four bands of “Wavelet transform”matrix which are the approximation of main image. In this research some benchmark AD algorithmsincluding Local RX, DWRX and DWEST have been implemented on Airborne Visible/Infrared ImagingSpectrometer (AVIRIS hyperspectral datasets. Experimental results demonstrate significant improvementof runtime in proposed method. In addition, this method improves the accuracy of AD algorithms becauseof DWT’s power in extracting approximation coefficients of signal, which contain the main behaviour ofsignal, and abandon the redundant information in hyperspectral image data.

  16. Temporal Data-Driven Sleep Scheduling and Spatial Data-Driven Anomaly Detection for Clustered Wireless Sensor Networks

    Directory of Open Access Journals (Sweden)

    Gang Li

    2016-09-01

    Full Text Available The spatial–temporal correlation is an important feature of sensor data in wireless sensor networks (WSNs. Most of the existing works based on the spatial–temporal correlation can be divided into two parts: redundancy reduction and anomaly detection. These two parts are pursued separately in existing works. In this work, the combination of temporal data-driven sleep scheduling (TDSS and spatial data-driven anomaly detection is proposed, where TDSS can reduce data redundancy. The TDSS model is inspired by transmission control protocol (TCP congestion control. Based on long and linear cluster structure in the tunnel monitoring system, cooperative TDSS and spatial data-driven anomaly detection are then proposed. To realize synchronous acquisition in the same ring for analyzing the situation of every ring, TDSS is implemented in a cooperative way in the cluster. To keep the precision of sensor data, spatial data-driven anomaly detection based on the spatial correlation and Kriging method is realized to generate an anomaly indicator. The experiment results show that cooperative TDSS can realize non-uniform sensing effectively to reduce the energy consumption. In addition, spatial data-driven anomaly detection is quite significant for maintaining and improving the precision of sensor data.

  17. Anomalous Signals Prior to Wenchuan Earthquake Detected by Superconducting Gravimeter and Broadband Seismometers Records

    Institute of Scientific and Technical Information of China (English)

    Wenbin Shen; Dijin Wang; Cheinway Hwang

    2011-01-01

    Using 1 Hz sampling records at one superconducting gravimeter (SG) station and 11 broadband seismometer stations,we found anomalous signals prior to the 2008 Wenchuan(汶川)earthquake event.The tides are removed from the original SG records to obtain the gravity residuals.Applying the Hilbert-Huang transform (HHT) and the wavelet analysis to the SG gravity residuals leads to time-frequency spectra,which suggests that there is an anomalous signal series around 39 h prior to the event.The period and the magnitude of the anomalous signal series are about 8 s and 3×10-8 m/s2 (3 μGal),respectively.In another aspect,applying HHT analysis technique to 11 records at broadband seismometer stations shows that most of them contain anomalous signals prior to the Wenchuan event,and the marginal spectra of 8 inland stations show an apparent characteristic of double peaks in anomalous days compared to the only one peak of the marginal spectra in quiet days.Preliminary investigations suggest that the anomalous signals prior to the earthquake are closely related to the low-frequency earthquake (LFE).We concluded that the SG data as well as the broadband seismometers records might be significant information sources in detecting the anomalous signals prior to large earthquakes.

  18. Temperature anomaly detection and estimation using microwave radiometry and anatomical information

    Science.gov (United States)

    Kelly, Patrick; Sobers, Tamara; St. Peter, Benjamin; Siqueira, Paul; Capraro, Geoffrey

    2011-03-01

    Many medically significant conditions (e.g., ischemia, carcinoma and inflammation) involve localized anomalies in physiological parameters such as the metabolic and blood perfusion rates. These in turn lead to deviations from normal tissue temperature patterns. Microwave radiometry is a passive system for sensing the radiation that objects emit naturally in the microwave frequency band. Since the emitted power depends on temperature, and since radiation at low microwave frequencies can propagate through several centimeters of tissue, microwave radiometry has the potential to provide valuable information about subcutaneous anomalies. The radiometric temperature measurement for a tissue region can be modeled as the inner product of the temperature pattern and a weighting function that depends on tissue properties and the radiometer's antenna. In the absence of knowledge of the weighting functions, it can be difficult to extract specific information about tissue temperature patterns (or the underlying physiological parameters) from the measurements. In this paper, we consider a scenario in which microwave radiometry works in conjunction with another imaging modality (e.g., 3D-CT or MRI) that provides detailed anatomical information. This information is used along with sensor properties in electromagnetic simulation software to generate weighting functions. It also is used in bio-heat equations to generate nominal tissue temperature patterns. We then develop a hypothesis testing framework that makes use of the weighting functions, nominal temperature patterns, and maximum likelihood estimates to detect anomalies. Simulation results are presented to illustrate the proposed detection procedures. The design and performance of an S-band (2-4 GHz) radiometer, and some of the challenges in using such a radiometer for temperature measurements deep in tissue, are also discussed.

  19. Accuracy of Ultrasound in Detection of Gross Prenatal Central Nervous System Anomalies after the Eighteenth Week of Gestation

    Directory of Open Access Journals (Sweden)

    M. Tahmasebi

    2007-10-01

    Full Text Available Background/Objective: Ultrasound (US detection of prenatal central nervous system (CNS anatomic anomalies is very important in making decision about therapeutic termination. In the present study, the accuracy of US in detection of gross prenatal CNS anatomic anomalies has been investigated."nPatients and Methods: 3012 pregnant women were scanned after 18 weeks of gestation by an expert operator in a referring center. All delivered fetuses were followed after birth through clinical examination and sonography."nResults: In this study, the accuracy of US in detection of gross CNS anatomic anomalies of fetuses after 18 weeks gestation was found to be 100%. The sensitivity, specificity, positive and negative predictive values of US were 100%. In sonographic examination of these 3012 pregnant women, 36 fetuses were detected with CNS anomalies, some of whom had more than one anomaly. Gross CNS anomalies observed included microcephaly, hydrocephaly, anencephaly, holoprosencephaly, ventriculomegaly, meningocele, encephalocele, lissencephaly, agenesis of corpus callosum, bilateral choroid plexus cysts and hypoplastic cerebellum."nConclusion: US is highly operator dependent and operator experience may be the most determinant affecting the results. Sonographic scanning after 18 weeks of gestation is associated with the best results.

  20. Implementing Operational Analytics using Big Data Technologies to Detect and Predict Sensor Anomalies

    Science.gov (United States)

    Coughlin, J.; Mital, R.; Nittur, S.; SanNicolas, B.; Wolf, C.; Jusufi, R.

    2016-09-01

    Operational analytics when combined with Big Data technologies and predictive techniques have been shown to be valuable in detecting mission critical sensor anomalies that might be missed by conventional analytical techniques. Our approach helps analysts and leaders make informed and rapid decisions by analyzing large volumes of complex data in near real-time and presenting it in a manner that facilitates decision making. It provides cost savings by being able to alert and predict when sensor degradations pass a critical threshold and impact mission operations. Operational analytics, which uses Big Data tools and technologies, can process very large data sets containing a variety of data types to uncover hidden patterns, unknown correlations, and other relevant information. When combined with predictive techniques, it provides a mechanism to monitor and visualize these data sets and provide insight into degradations encountered in large sensor systems such as the space surveillance network. In this study, data from a notional sensor is simulated and we use big data technologies, predictive algorithms and operational analytics to process the data and predict sensor degradations. This study uses data products that would commonly be analyzed at a site. This study builds on a big data architecture that has previously been proven valuable in detecting anomalies. This paper outlines our methodology of implementing an operational analytic solution through data discovery, learning and training of data modeling and predictive techniques, and deployment. Through this methodology, we implement a functional architecture focused on exploring available big data sets and determine practical analytic, visualization, and predictive technologies.

  1. Euclidean commute time distance embedding and its application to spectral anomaly detection

    Science.gov (United States)

    Albano, James A.; Messinger, David W.

    2012-06-01

    Spectral image analysis problems often begin by performing a preprocessing step composed of applying a transformation that generates an alternative representation of the spectral data. In this paper, a transformation based on a Markov-chain model of a random walk on a graph is introduced. More precisely, we quantify the random walk using a quantity known as the average commute time distance and find a nonlinear transformation that embeds the nodes of a graph in a Euclidean space where the separation between them is equal to the square root of this quantity. This has been referred to as the Commute Time Distance (CTD) transformation and it has the important characteristic of increasing when the number of paths between two nodes decreases and/or the lengths of those paths increase. Remarkably, a closed form solution exists for computing the average commute time distance that avoids running an iterative process and is found by simply performing an eigendecomposition on the graph Laplacian matrix. Contained in this paper is a discussion of the particular graph constructed on the spectral data for which the commute time distance is then calculated from, an introduction of some important properties of the graph Laplacian matrix, and a subspace projection that approximately preserves the maximal variance of the square root commute time distance. Finally, RX anomaly detection and Topological Anomaly Detection (TAD) algorithms will be applied to the CTD subspace followed by a discussion of their results.

  2. Assessing the impact of background spectral graph construction techniques on the topological anomaly detection algorithm

    Science.gov (United States)

    Ziemann, Amanda K.; Messinger, David W.; Albano, James A.; Basener, William F.

    2012-06-01

    Anomaly detection algorithms have historically been applied to hyperspectral imagery in order to identify pixels whose material content is incongruous with the background material in the scene. Typically, the application involves extracting man-made objects from natural and agricultural surroundings. A large challenge in designing these algorithms is determining which pixels initially constitute the background material within an image. The topological anomaly detection (TAD) algorithm constructs a graph theory-based, fully non-parametric topological model of the background in the image scene, and uses codensity to measure deviation from this background. In TAD, the initial graph theory structure of the image data is created by connecting an edge between any two pixel vertices x and y if the Euclidean distance between them is less than some resolution r. While this type of proximity graph is among the most well-known approaches to building a geometric graph based on a given set of data, there is a wide variety of dierent geometrically-based techniques. In this paper, we present a comparative test of the performance of TAD across four dierent constructs of the initial graph: mutual k-nearest neighbor graph, sigma-local graph for two different values of σ > 1, and the proximity graph originally implemented in TAD.

  3. Model-based temperature noise monitoring methods for LMFBR core anomaly detection

    Energy Technology Data Exchange (ETDEWEB)

    Tamaoki, Tetsuo; Sonoda, Yukio; Sato, Masuo (Toshiba Corp., Kawasaki, Kanagawa (Japan)); Takahashi, Ryoichi

    1994-03-01

    Temperature noise, measured by thermocouples mounted at each core fuel subassembly, is considered to be the most useful signal for detecting and locating local cooling anomalies in an LMFBR core. However, the core outlet temperature noise contains background noise due to fluctuations in the operating parameters including reactor power. It is therefore necessary to reduce this background noise for highly sensitive anomaly detection by subtracting predictable components from the measured signal. In the present study, both a physical model and an autoregressive model were applied to noise data measured in the experimental fast reactor JOYO. The results indicate that the autoregressive model has a higher precision than the physical model in background noise prediction. Based on these results, an 'autoregressive model modification method' is proposed, in which a temporary autoregressive model is generated by interpolation or extrapolation of reference models identified under a small number of different operating conditions. The generated autoregressive model has shown sufficient precision over a wide range of reactor power in applications to artificial noise data produced by an LMFBR noise simulator even when the coolant flow rate was changed to keep a constant power-to-flow ratio. (author).

  4. Based on Wide Area Environment Abnormal Behavior Analysis and Anomaly Detection Research

    Directory of Open Access Journals (Sweden)

    Zhang Lin

    2016-01-01

    Full Text Available Group anomaly identification and location is an important issue in the field of artificial intelligence. Capture of the accident source and rapid prediction of mass incidents in public places are difficult problems in intelligent video identification and processing, but the traditional group anomaly detection research has many limitations when it comes to accident source detection and intelligent recognition. We are to research on the algorithms of accident source location and abnormal group identification based on behavior analysis in the condition of dramatically changing group geometry appearance, including: 1 to propose a logic model of image density based on the social force model, and to build the crowd density trend prediction model integrating “fast and fuzzy matching at front-end” and “accurate and classified training at back-end”; 2 to design a fast abnormal source flagging algorithm based on support vector machine, and to realize intelligent and automatic marking of abnormal source point; 3 to construct a multi-view human body skeleton invariant moment model and a motion trajectory model based on linear parametric equations. The expected results of the research will help prevent abnormal events effectively, capture the first scene of incidents and the abnormal source point quickly, and play a decision support role in the proactive national security strategy.

  5. Anomaly Detection Algorithm for Stay Cable Monitoring Data Based on Data Fusion

    Institute of Scientific and Technical Information of China (English)

    Xiaoling Liu,Qiao Huang∗; Yuan Ren

    2016-01-01

    In order to improve the accuracy and consistency of data in health monitoring system, an anomaly detection algorithm for stay cables based on data fusion is proposed. The monitoring data of Nanjing No. 3 Yangtze River Bridge is used as the basis of study. Firstly, an adaptive processing framework with feedback control is established based on the concept of data fusion. The data processing contains four steps: data specification, data cleaning, data conversion and data fusion. Data processing information offers feedback to the original data system, which further gives guidance for the sensor maintenance or replacement. Subsequently, the algorithm steps based on the continuous data distortion is investigated,which integrates the inspection data and the distribution test method. Finally, a group of cable force data is utilized as an example to verify the established framework and algorithm. Experimental results show that the proposed algorithm can achieve high detection accuracy, providing a valuable reference for other monitoring data processing.

  6. Data mining method for anomaly detection in the supercomputer task flow

    Science.gov (United States)

    Voevodin, Vadim; Voevodin, Vladimir; Shaikhislamov, Denis; Nikitenko, Dmitry

    2016-10-01

    The efficiency of most supercomputer applications is extremely low. At the same time, the user rarely even suspects that their applications may be wasting computing resources. Software tools need to be developed to help detect inefficient applications and report them to the users. We suggest an algorithm for detecting anomalies in the supercomputer's task flow, based on a data mining methods. System monitoring is used to calculate integral characteristics for every job executed, and the data is used as input for our classification method based on the Random Forest algorithm. The proposed approach can currently classify the application as one of three classes - normal, suspicious and definitely anomalous. The proposed approach has been demonstrated on actual applications running on the "Lomonosov" supercomputer.

  7. ADAPTIVE SUBSYSTEM FOR DETECTING AND PREVENTING ANOMALIES AS A PROTECTION MEANS AGAINST NETWORK ATTACKS

    Directory of Open Access Journals (Sweden)

    Simankov V. S.

    2015-06-01

    Full Text Available This article describes the results of networks anomalies detection system based on modular adaptive approach practical implementation. The list of specific modules used in the practical implementation of IPS, their architecture, algorithms, software, organizational and technical support determined at technical working design based on the results of the audit, evaluation and risk analysis. In the general list of modules (subsystems we may include: intrusion detection and prevention (IPS / IDS subsystems; monitoring, data collection, and event correlation, administration and management subsystem and others. We have demonstrated the specificity of formation requirements for the basic mechanisms of the subsystems in terms of development and implementation of specific architecture with some examples, plus practically implemented structure of system modules, as well as organizational and technical support system functioning

  8. Improved K-means Algorithm for Manufacturing Process Anomaly Detection and Recognition

    Institute of Scientific and Technical Information of China (English)

    ZHOU Xiaomin; PENG Wei; SHI Haibo

    2006-01-01

    Anomaly detection and recognition are of prime importance in process industries. Faults are usually rare, and, therefore, predicting them is difficult. In this paper, a new greedy initialization method for the K-means algorithm is proposed to improve traditional K-means clustering techniques. The new initialization method tries to choose suitable initial points, which are well separated and have the potential to form high-quality clusters. Based on the clustering result of historical disqualification product data in manufacturing process which generated by the Improved-K-means algorithm, a prediction model which is used to detect and recognize the abnormal trend of the quality problems is constructed. This simple and robust alarm-system architecture for predicting incoming faults realizes the transition of quality problems from diagnosis afterward to prevention beforehand indeed. In the end, the alarm model was applied for prediction and avoidance of gear-wheel assembly faults at a gear-plant.

  9. System and method for the detection of anomalies in an image

    Science.gov (United States)

    Prasad, Lakshman; Swaminarayan, Sriram

    2013-09-03

    Preferred aspects of the present invention can include receiving a digital image at a processor; segmenting the digital image into a hierarchy of feature layers comprising one or more fine-scale features defining a foreground object embedded in one or more coarser-scale features defining a background to the one or more fine-scale features in the segmentation hierarchy; detecting a first fine-scale foreground feature as an anomaly with respect to a first background feature within which it is embedded; and constructing an anomalous feature layer by synthesizing spatially contiguous anomalous fine-scale features. Additional preferred aspects of the present invention can include detecting non-pervasive changes between sets of images in response at least in part to one or more difference images between the sets of images.

  10. Artificially Augmented Training for Anomaly-based Network Intrusion Detection Systems

    Directory of Open Access Journals (Sweden)

    Chockalingam Karuppanchetty

    2015-09-01

    Full Text Available Attacks on web servers are becoming increasingly prevalent; the resulting social and economic impact of successful attacks is also exacerbated by our dependency on web-based applications. There are many existing attack detection and prevention schemes, which must be carefully configured to ensure their efficacy. In this paper, we present a study challenges that arise in training network payload anomaly detection schemes that utilize collected network traffic for tuning and configuration. The advantage of anomaly-based intrusion detection is in its potential for detecting zero day attacks. These types of schemes, however, require extensive training to properly model the normal characteristics of the system being protected. Usually, training is done through the use of real data collected by monitoring the activity of the system. In practice, network operators or administrators may run into cases where they have limited availability of such data. This issue can arise due to the system being newly deployed (or heavily modified or due to the content or behavior that leads to normal characterization having been changed. We show that artificially generated packet payloads can be used to effectively augment the training and tuning. We evaluate the method using real network traffic collected at a server site; We illustrate the problem at first (use of highly variable and unsuitable training data resulting in high false positives of 3.6∼10%, then show improvements using the augmented training method (false positives as low as 0.2%. We also measure the impact on network performance, and present a lookup based optimization that can be used to improve latency and throughput.

  11. Detection of architectural distortion in mammograms acquired prior to the detection of breast cancer using texture and fractal analysis

    Science.gov (United States)

    Prajna, Shormistha; Rangayyan, Rangaraj M.; Ayres, Fábio J.; Desautels, J. E. Leo

    2008-03-01

    Mammography is a widely used screening tool for the early detection of breast cancer. One of the commonly missed signs of breast cancer is architectural distortion. The purpose of this study is to explore the application of fractal analysis and texture measures for the detection of architectural distortion in screening mammograms taken prior to the detection of breast cancer. A method based on Gabor filters and phase portrait analysis was used to detect initial candidates of sites of architectural distortion. A total of 386 regions of interest (ROIs) were automatically obtained from 14 "prior mammograms", including 21 ROIs related to architectural distortion. The fractal dimension of the ROIs was calculated using the circular average power spectrum technique. The average fractal dimension of the normal (false-positive) ROIs was higher than that of the ROIs with architectural distortion. For the "prior mammograms", the best receiver operating characteristics (ROC) performance achieved was 0.74 with the fractal dimension and 0.70 with fourteen texture features, in terms of the area under the ROC curve.

  12. Unsupervised, low latency anomaly detection of algorithmically generated domain names by generative probabilistic modeling.

    Science.gov (United States)

    Raghuram, Jayaram; Miller, David J; Kesidis, George

    2014-07-01

    We propose a method for detecting anomalous domain names, with focus on algorithmically generated domain names which are frequently associated with malicious activities such as fast flux service networks, particularly for bot networks (or botnets), malware, and phishing. Our method is based on learning a (null hypothesis) probability model based on a large set of domain names that have been white listed by some reliable authority. Since these names are mostly assigned by humans, they are pronounceable, and tend to have a distribution of characters, words, word lengths, and number of words that are typical of some language (mostly English), and often consist of words drawn from a known lexicon. On the other hand, in the present day scenario, algorithmically generated domain names typically have distributions that are quite different from that of human-created domain names. We propose a fully generative model for the probability distribution of benign (white listed) domain names which can be used in an anomaly detection setting for identifying putative algorithmically generated domain names. Unlike other methods, our approach can make detections without considering any additional (latency producing) information sources, often used to detect fast flux activity. Experiments on a publicly available, large data set of domain names associated with fast flux service networks show encouraging results, relative to several baseline methods, with higher detection rates and low false positive rates.

  13. Detection of submicron scale cracks and other surface anomalies using positron emission tomography

    Energy Technology Data Exchange (ETDEWEB)

    Cowan, Thomas E.; Howell, Richard H.; Colmenares, Carlos A.

    2004-02-17

    Detection of submicron scale cracks and other mechanical and chemical surface anomalies using PET. This surface technique has sufficient sensitivity to detect single voids or pits of sub-millimeter size and single cracks or fissures of millimeter size; and single cracks or fissures of millimeter-scale length, micrometer-scale depth, and nanometer-scale length, micrometer-scale depth, and nanometer-scale width. This technique can also be applied to detect surface regions of differing chemical reactivity. It may be utilized in a scanning or survey mode to simultaneously detect such mechanical or chemical features over large interior or exterior surface areas of parts as large as about 50 cm in diameter. The technique involves exposing a surface to short-lived radioactive gas for a time period, removing the excess gas to leave a partial monolayer, determining the location and shape of the cracks, voids, porous regions, etc., and calculating the width, depth, and length thereof. Detection of 0.01 mm deep cracks using a 3 mm detector resolution has been accomplished using this technique.

  14. Detection of Anomalies in Citrus Leaves Using Laser-Induced Breakdown Spectroscopy (LIBS).

    Science.gov (United States)

    Sankaran, Sindhuja; Ehsani, Reza; Morgan, Kelly T

    2015-08-01

    Nutrient assessment and management are important to maintain productivity in citrus orchards. In this study, laser-induced breakdown spectroscopy (LIBS) was applied for rapid and real-time detection of citrus anomalies. Laser-induced breakdown spectroscopy spectra were collected from citrus leaves with anomalies such as diseases (Huanglongbing, citrus canker) and nutrient deficiencies (iron, manganese, magnesium, zinc), and compared with those of healthy leaves. Baseline correction, wavelet multivariate denoising, and normalization techniques were applied to the LIBS spectra before analysis. After spectral pre-processing, features were extracted using principal component analysis and classified using two models, quadratic discriminant analysis and support vector machine (SVM). The SVM resulted in a high average classification accuracy of 97.5%, with high average canker classification accuracy (96.5%). LIBS peak analysis indicated that high intensities at 229.7, 247.9, 280.3, 393.5, 397.0, and 769.8 nm were observed of 11 peaks found in all the samples. Future studies using controlled experiments with variable nutrient applications are required for quantification of foliar nutrients by using LIBS-based sensing.

  15. Detection of Seismic Anomalies Linked to Emanations of Hydrocarbons in the Cuban Northwest Coast

    Directory of Open Access Journals (Sweden)

    Guillermo Miró Pagés

    2014-11-01

    Full Text Available The exploration of hydrocarbons to international scale constitutes a very complex and expensive task. Traditionally in the coast areas like the ones in the present work, the location of the exploration wells has been based on derived structural and stratigraphic information of geophysical data, mainly seismic; however it is well-known that in several regions similar of the world, the detection of superficial seeps of hydrocarbons confirm the existence of oil systems, has contributed to achieve a bigger dependability of the carried out prospectings, what has great importance considering the millionaire character of the financial expenditures who demands. For that reason, the main objective was to try to identify seismic anomalies typically associate with existences of hydrocarbons in Cuban coastareas. The main conclusion of this article is that the identification of seismic anomalies similar to those observed in the course of the present work can constitute a valuable additional informative element for the prospecting of hydrocarbons in areas of the Cuban coast.

  16. Improved detection of incipient anomalies via multivariate memory monitoring charts: Application to an air flow heating system

    KAUST Repository

    Harrou, Fouzi

    2016-08-11

    Detecting anomalies is important for reliable operation of several engineering systems. Multivariate statistical monitoring charts are an efficient tool for checking the quality of a process by identifying abnormalities. Principal component analysis (PCA) was shown effective in monitoring processes with highly correlated data. Traditional PCA-based methods, nevertheless, often are relatively inefficient at detecting incipient anomalies. Here, we propose a statistical approach that exploits the advantages of PCA and those of multivariate memory monitoring schemes, like the multivariate cumulative sum (MCUSUM) and multivariate exponentially weighted moving average (MEWMA) monitoring schemes to better detect incipient anomalies. Memory monitoring charts are sensitive to incipient anomalies in process mean, which significantly improve the performance of PCA method and enlarge its profitability, and to utilize these improvements in various applications. The performance of PCA-based MEWMA and MCUSUM control techniques are demonstrated and compared with traditional PCA-based monitoring methods. Using practical data gathered from a heating air-flow system, we demonstrate the greater sensitivity and efficiency of the developed method over the traditional PCA-based methods. Results indicate that the proposed techniques have potential for detecting incipient anomalies in multivariate data. © 2016 Elsevier Ltd

  17. Characterization of normality of chaotic systems including prediction and detection of anomalies

    Science.gov (United States)

    Engler, Joseph John

    Accurate prediction and control pervades domains such as engineering, physics, chemistry, and biology. Often, it is discovered that the systems under consideration cannot be well represented by linear, periodic nor random data. It has been shown that these systems exhibit deterministic chaos behavior. Deterministic chaos describes systems which are governed by deterministic rules but whose data appear to be random or quasi-periodic distributions. Deterministically chaotic systems characteristically exhibit sensitive dependence upon initial conditions manifested through rapid divergence of states initially close to one another. Due to this characterization, it has been deemed impossible to accurately predict future states of these systems for longer time scales. Fortunately, the deterministic nature of these systems allows for accurate short term predictions, given the dynamics of the system are well understood. This fact has been exploited in the research community and has resulted in various algorithms for short term predictions. Detection of normality in deterministically chaotic systems is critical in understanding the system sufficiently to able to predict future states. Due to the sensitivity to initial conditions, the detection of normal operational states for a deterministically chaotic system can be challenging. The addition of small perturbations to the system, which may result in bifurcation of the normal states, further complicates the problem. The detection of anomalies and prediction of future states of the chaotic system allows for greater understanding of these systems. The goal of this research is to produce methodologies for determining states of normality for deterministically chaotic systems, detection of anomalous behavior, and the more accurate prediction of future states of the system. Additionally, the ability to detect subtle system state changes is discussed. The dissertation addresses these goals by proposing new representational

  18. Automated Anomaly Detection in Distribution Grids Using $\\mu$PMU Measurements

    CERN Document Server

    Jamei, Mahdi; Roberts, Ciaran; Stewart, Emma; Peisert, Sean; McParland, Chuck; McEachern, Alex

    2016-01-01

    The impact of Phasor Measurement Units (PMUs) for providing situational awareness to transmission system operators has been widely documented. Micro-PMUs ($\\mu$PMUs) are an emerging sensing technology that can provide similar benefits to Distribution System Operators (DSOs), enabling a level of visibility into the distribution grid that was previously unattainable. In order to support the deployment of these high resolution sensors, the automation of data analysis and prioritizing communication to the DSO becomes crucial. In this paper, we explore the use of $\\mu$PMUs to detect anomalies on the distribution grid. Our methodology is motivated by growing concern about failures and attacks to distribution automation equipment. The effectiveness of our approach is demonstrated through both real and simulated data.

  19. Stochastic anomaly detection in eye-tracking data for quantification of motor symptoms in Parkinson's disease.

    Science.gov (United States)

    Jansson, Daniel; Medvedev, Alexander; Axelson, Hans; Nyholm, Dag

    2015-01-01

    Two methods for distinguishing between healthy controls and patients diagnosed with Parkinson's disease by means of recorded smooth pursuit eye movements are presented and evaluated. Both methods are based on the principles of stochastic anomaly detection and make use of orthogonal series approximation for probability distribution estimation. The first method relies on the identification of a Wiener model of the smooth pursuit system and attempts to find statistically significant differences between the estimated parameters in healthy controls and patients with Parkinson's disease. The second method applies the same statistical method to distinguish between the gaze trajectories of healthy and Parkinson subjects tracking visual stimuli. Both methods show promising results, where healthy controls and patients with Parkinson's disease are effectively separated in terms of the considered metric. The results are preliminary because of the small number of participating test subjects, but they are indicative of the potential of the presented methods as diagnosing or staging tools for Parkinson's disease.

  20. Clustering and Support Vector Regression for Water Demand Forecasting and Anomaly Detection

    Directory of Open Access Journals (Sweden)

    Antonio Candelieri

    2017-03-01

    Full Text Available This paper presents a completely data-driven and machine-learning-based approach, in two stages, to first characterize and then forecast hourly water demand in the short term with applications of two different data sources: urban water demand (SCADA data and individual customer water consumption (AMR data. In the first case, reliable forecasting can be used to optimize operations, particularly the pumping schedule, in order to reduce energy-related costs, while in the second case, the comparison between forecast and actual values may support the online detection of anomalies, such as smart meter faults, fraud or possible cyber-physical attacks. Results are presented for a real case: the water distribution network in Milan.

  1. Real-time progressive hyperspectral image processing endmember finding and anomaly detection

    CERN Document Server

    Chang, Chein-I

    2016-01-01

    The book covers the most crucial parts of real-time hyperspectral image processing: causality and real-time capability. Recently, two new concepts of real time hyperspectral image processing, Progressive Hyperspectral Imaging (PHSI) and Recursive Hyperspectral Imaging (RHSI). Both of these can be used to design algorithms and also form an integral part of real time hyperpsectral image processing. This book focuses on progressive nature in algorithms on their real-time and causal processing implementation in two major applications, endmember finding and anomaly detection, both of which are fundamental tasks in hyperspectral imaging but generally not encountered in multispectral imaging. This book is written to particularly address PHSI in real time processing, while a book, Recursive Hyperspectral Sample and Band Processing: Algorithm Architecture and Implementation (Springer 2016) can be considered as its companion book. Includes preliminary background which is essential to those who work in hyperspectral ima...

  2. Scalable Algorithms for Unsupervised Classification and Anomaly Detection in Large Geospatiotemporal Data Sets

    Science.gov (United States)

    Mills, R. T.; Hoffman, F. M.; Kumar, J.

    2015-12-01

    The increasing availability of high-resolution geospatiotemporal datasets from sources such as observatory networks, remote sensing platforms, and computational Earth system models has opened new possibilities for knowledge discovery and mining of ecological data sets fused from disparate sources. Traditional algorithms and computing platforms are impractical for the analysis and synthesis of data sets of this size; however, new algorithmic approaches that can effectively utilize the complex memory hierarchies and the extremely high levels of available parallelism in state-of-the-art high-performance computing platforms can enable such analysis. We describe some unsupervised knowledge discovery and anomaly detection approaches based on highly scalable parallel algorithms for k-means clustering and singular value decomposition, consider a few practical applications thereof to the analysis of climatic and remotely-sensed vegetation phenology data sets, and speculate on some of the new applications that such scalable analysis methods may enable.

  3. Multiscale spatial density smoothing: an application to large-scale radiological survey and anomaly detection

    CERN Document Server

    Tansey, Wesley; Reinhart, Alex; Scott, James G

    2015-01-01

    We consider the problem of estimating a spatially varying density function, motivated by problems that arise in large-scale radiological survey and anomaly detection. In this context, the density functions to be estimated are the background gamma-ray energy spectra at sites spread across a large geographical area, such as nuclear production and waste-storage sites, military bases, medical facilities, university campuses, or the downtown of a city. Several challenges combine to make this a difficult problem. First, the spectral density at any given spatial location may have both smooth and non-smooth features. Second, the spatial correlation in these density functions is neither stationary nor locally isotropic. Third, the spatial correlation decays at different length scales at different locations in the support of the underlying density. Finally, at some spatial locations, there is very little data. We present a method called multiscale spatial density smoothing that successfully addresses these challenges. ...

  4. Evaluation of Anomaly Detection Capability for Ground-Based Pre-Launch Shuttle Operations. Chapter 8

    Science.gov (United States)

    Martin, Rodney Alexander

    2010-01-01

    This chapter will provide a thorough end-to-end description of the process for evaluation of three different data-driven algorithms for anomaly detection to select the best candidate for deployment as part of a suite of IVHM (Integrated Vehicle Health Management) technologies. These algorithms were deemed to be sufficiently mature enough to be considered viable candidates for deployment in support of the maiden launch of Ares I-X, the successor to the Space Shuttle for NASA's Constellation program. Data-driven algorithms are just one of three different types being deployed. The other two types of algorithms being deployed include a "nile-based" expert system, and a "model-based" system. Within these two categories, the deployable candidates have already been selected based upon qualitative factors such as flight heritage. For the rule-based system, SHINE (Spacecraft High-speed Inference Engine) has been selected for deployment, which is a component of BEAM (Beacon-based Exception Analysis for Multimissions), a patented technology developed at NASA's JPL (Jet Propulsion Laboratory) and serves to aid in the management and identification of operational modes. For the "model-based" system, a commercially available package developed by QSI (Qualtech Systems, Inc.), TEAMS (Testability Engineering and Maintenance System) has been selected for deployment to aid in diagnosis. In the context of this particular deployment, distinctions among the use of the terms "data-driven," "rule-based," and "model-based," can be found in. Although there are three different categories of algorithms that have been selected for deployment, our main focus in this chapter will be on the evaluation of three candidates for data-driven anomaly detection. These algorithms will be evaluated upon their capability for robustly detecting incipient faults or failures in the ground-based phase of pre-launch space shuttle operations, rather than based oil heritage as performed in previous studies. Robust

  5. RFID-Based Human Behavior Modeling and Anomaly Detection for Elderly Care

    Directory of Open Access Journals (Sweden)

    Hui-Huang Hsu

    2010-01-01

    Full Text Available This research aimed at building an intelligent system that can detect abnormal behavior for the elderly at home. Active RFID tags can be deployed at home to help collect daily movement data of the elderly who carries an RFID reader. When the reader detects the signals from the tags, RSSI values that represent signal strength are obtained. The RSSI values are reversely related to the distance between the tags and the reader and they are recorded following the movement of the user. The movement patterns, not the exact locations, of the user are the major concern. With the movement data (RSSI values, the clustering technique is then used to build a personalized model of normal behavior. After the model is built, any incoming datum outside the model can be viewed as abnormal and an alarm can be raised by the system. In this paper, we present the system architecture for RFID data collection and preprocessing, clustering for anomaly detection, and experimental results. The results show that this novel approach is promising.

  6. A parametric study of unsupervised anomaly detection performance in maritime imagery using manifold learning techniques

    Science.gov (United States)

    Olson, C. C.; Doster, T.

    2016-05-01

    We investigate the parameters that govern an unsupervised anomaly detection framework that uses nonlinear techniques to learn a better model of the non-anomalous data. A manifold or kernel-based model is learned from a small, uniformly sampled subset in order to reduce computational burden and under the assumption that anomalous data will have little effect on the learned model because their rarity reduces the likelihood of their inclusion in the subset. The remaining data are then projected into the learned space and their projection errors used as detection statistics. Here, kernel principal component analysis is considered for learning the background model. We consider spectral data from an 8-band multispectral sensor as well as panchromatic infrared images treated by building a data set composed of overlapping image patches. We consider detection performance as a function of patch neighborhood size as well as embedding parameters such as kernel bandwidth and dimension. ROC curves are generated over a range of parameters and compared to RX performance.

  7. Detection of architectural distortion in prior mammograms using fractal analysis and angular spread of power

    Science.gov (United States)

    Banik, Shantanu; Rangayyan, Rangaraj M.; Desautels, J. E. L.

    2010-03-01

    This paper presents methods for the detection of architectural distortion in mammograms of interval-cancer cases taken prior to the diagnosis of breast cancer, using Gabor filters, phase portrait analysis, fractal dimension (FD), and analysis of the angular spread of power in the Fourier spectrum. In the estimation of FD using the Fourier power spectrum, only the distribution of power over radial frequency is considered; the information regarding the angular spread of power is ignored. In this study, the angular spread of power in the Fourier spectrum is used to generate features for the detection of spiculated patterns related to architectural distortion. Using Gabor filters and phase portrait analysis, a total of 4224 regions of interest (ROIs) were automatically obtained from 106 prior mammograms of 56 interval-cancer cases, including 301 ROIs related to architectural distortion, and from 52 mammograms of 13 normal cases. For each ROI, the FD and measures of the angular spread of power were computed. Feature selection was performed using stepwise logistic regression. The best result achieved, in terms of the area under the receiver operating characteristic curve, is 0.75 +/- 0.02 with an artificial neural network including radial basis functions. Analysis of the performance of the methods with free-response receiver operating characteristics indicated a sensitivity of 0.82 at 7.7 false positives per image.

  8. Detection of an outburst one year prior to the explosion of SN 2011ht

    CERN Document Server

    Fraser, M; Kotak, R; Smartt, S J; Smith, K W; Polshaw, J; Drake, A J; Boles, T; Lee, C -H; Burgett, W S; Chambers, K C; Draper, P W; Flewelling, H; Hodapp, K W; Kaiser, N; Kudritzki, R -P; Magnier, E A; Price, P A; Tonry, J L; Wainscoat, R J; Waters, C

    2013-01-01

    Using imaging from the Pan-STARRS1 survey, we identify a precursor outburst at epochs 287 and 170 days prior to the reported explosion of the purported Type IIn supernova (SN) 2011ht. In the Pan-STARRS data, a source coincident with SN 2011ht is detected exclusively in the \\zps\\ and \\yps-bands. An absolute magnitude of M$_z\\simeq$-11.8 suggests that this was an outburst of the progenitor star. Unfiltered, archival Catalina Real Time Transient survey images also reveal a coincident source from at least 258 to 138 days before the main event. We suggest that the outburst is likely to be an intrinsically red eruption, although we cannot conclusively exclude a series of erratic outbursts which were observed only in the redder bands by chance. This is only the fourth detection of an outburst prior to a claimed SN, and lends credence to the possibility that many more interacting transients have pre-explosion outbursts, which have been missed by current surveys.

  9. GNSS reflectometry aboard the International Space Station: phase-altimetry simulation to detect ocean topography anomalies

    Science.gov (United States)

    Semmling, Maximilian; Leister, Vera; Saynisch, Jan; Zus, Florian; Wickert, Jens

    2016-04-01

    An ocean altimetry experiment using Earth reflected GNSS signals has been proposed to the European Space Agency (ESA). It is part of the GNSS Reflectometry Radio Occultation Scatterometry (GEROS) mission that is planned aboard the International Space Station (ISS). Altimetric simulations are presented that examine the detection of ocean topography anomalies assuming GNSS phase delay observations. Such delay measurements are well established for positioning and are possible due to a sufficient synchronization of GNSS receiver and transmitter. For altimetric purpose delays of Earth reflected GNSS signals can be observed similar to radar altimeter signals. The advantage of GNSS is the synchronized separation of transmitter and receiver that allow a significantly increased number of observation per receiver due to more than 70 GNSS transmitters currently in orbit. The altimetric concept has already been applied successfully to flight data recorded over the Mediterranean Sea. The presented altimetric simulation considers anomalies in the Agulhas current region which are obtained from the Region Ocean Model System (ROMS). Suitable reflection events in an elevation range between 3° and 30° last about 10min with ground track's length >3000km. Typical along-track footprints (1s signal integration time) have a length of about 5km. The reflection's Fresnel zone limits the footprint of coherent observations to a major axis extention between 1 to 6km dependent on the elevation. The altimetric performance depends on the signal-to-noise ratio (SNR) of the reflection. Simulation results show that precision is better than 10cm for SNR of 30dB. Whereas, it is worse than 0.5m if SNR goes down to 10dB. Precision, in general, improves towards higher elevation angles. Critical biases are introduced by atmospheric and ionospheric refraction. Corresponding correction strategies are still under investigation.

  10. A Novel Network Traffic Anomaly Detection Model Based on Superstatistics Theory

    Directory of Open Access Journals (Sweden)

    Yue Yang

    2011-02-01

    Full Text Available With the development of network technology and growing enlargement of network size, the network structure is becoming more and more complicated. Mutual interactions of different network equipment, topology configurations, transmission protocols and cooperation and competition among the network users inevitably cause the network traffic flow which is controlled by several driving factors to appear non-stationary and complicated behavior. Because of its non-stationary property it can not easily use traditional way to analyze the complicated network traffic. A new detection method of non-stationary network traffic based on superstatistics theory is discussed in the paper. According to the superstatistics theory, the complex dynamic system may have a large fluctuation of intensive quantities on large time scales which cause the system to behave as non-stationary which is also the characteristic of network traffic. This new idea provides us a novel method to partition the non-stationary traffic time series into small stationary segments which can be modeled by discrete Generalized Pareto(GP distribution. Different segments follow GP distribution with different distribution parameters which are named slow parameters. We use this slow parameters of the segments as a key determinant factor of the system to describe the network characteristic and analyze the slow parameters with time series theory to detect network anomaly. The result of experiments indicates that this method can be effective.

  11. Hypergraph-based anomaly detection of high-dimensional co-occurrences.

    Science.gov (United States)

    Silva, Jorge; Willett, Rebecca

    2009-03-01

    This paper addresses the problem of detecting anomalous multivariate co-occurrences using a limited number of unlabeled training observations. A novel method based on using a hypergraph representation of the data is proposed to deal with this very high-dimensional problem. Hypergraphs constitute an important extension of graphs which allow edges to connect more than two vertices simultaneously. A variational Expectation-Maximization algorithm for detecting anomalies directly on the hypergraph domain without any feature selection or dimensionality reduction is presented. The resulting estimate can be used to calculate a measure of anomalousness based on the False Discovery Rate. The algorithm has O(np) computational complexity, where n is the number of training observations and p is the number of potential participants in each co-occurrence event. This efficiency makes the method ideally suited for very high-dimensional settings, and requires no tuning, bandwidth or regularization parameters. The proposed approach is validated on both high-dimensional synthetic data and the Enron email database, where p > 75,000, and it is shown that it can outperform other state-of-the-art methods.

  12. Application of Distributed Optical Fiber Sensing Technology in the Anomaly Detection of Shaft Lining in Grouting

    Directory of Open Access Journals (Sweden)

    Chunde Piao

    2015-01-01

    Full Text Available The rupture of the shaft lining caused by grouting has seriously undermined the safety in coal mining. Based on BOTDR distributed optical fiber sensing technology, this paper studied the layout method of optical fiber sensors and the anomaly detection method of the deformation and obtained the evolution law of shaft deformation triggered by grouting. The research results showed that the bonding problem of optical fiber sensors in damp environment could be effectively solved, by applying the binder consisting of sodium silicate and cement. Through BOTDR-based deformation detection, the real-time deformation of the shaft lining caused by grouting was immediately spotted. By comparing the respective strain of shaft lining deformation and concrete deformation, the risk range of shaft lining grouting was identified. With the additional strain increment of the shaft lining triggered by each process of grouting, the saturated condition of grouting volume in strata was analyzed, providing an important technical insight into the field construction and the safety of the shaft lining.

  13. Para-GMRF: parallel algorithm for anomaly detection of hyperspectral image

    Science.gov (United States)

    Dong, Chao; Zhao, Huijie; Li, Na; Wang, Wei

    2007-12-01

    The hyperspectral imager is capable of collecting hundreds of images corresponding to different wavelength channels for the observed area simultaneously, which make it possible to discriminate man-made objects from natural background. However, the price paid for the wealthy information is the enormous amounts of data, usually hundreds of Gigabytes per day. Turning the huge volume data into useful information and knowledge in real time is critical for geoscientists. In this paper, the proposed parallel Gaussian-Markov random field (Para-GMRF) anomaly detection algorithm is an attempt of applying parallel computing technology to solve the problem. Based on the locality of GMRF algorithm, we partition the 3-D hyperspectral image cube in spatial domain and distribute data blocks to multiple computers for concurrent detection. Meanwhile, to achieve load balance, a work pool scheduler is designed for task assignment. The Para-GMRF algorithm is organized in master-slave architecture, coded in C programming language using message passing interface (MPI) library and tested on a Beowulf cluster. Experimental results show that Para-GMRF algorithm successfully conquers the challenge and can be used in time sensitive areas, such as environmental monitoring and battlefield reconnaissance.

  14. Brain Stroke Detection by Microwaves Using Prior Information from Clinical Databases

    Directory of Open Access Journals (Sweden)

    Natalia Irishina

    2013-01-01

    Full Text Available Microwave tomographic imaging is an inexpensive, noninvasive modality of media dielectric properties reconstruction which can be utilized as a screening method in clinical applications such as breast cancer and brain stroke detection. For breast cancer detection, the iterative algorithm of structural inversion with level sets provides well-defined boundaries and incorporates an intrinsic regularization, which permits to discover small lesions. However, in case of brain lesion, the inverse problem is much more difficult due to the skull, which causes low microwave penetration and highly noisy data. In addition, cerebral liquid has dielectric properties similar to those of blood, which makes the inversion more complicated. Nevertheless, the contrast in the conductivity and permittivity values in this situation is significant due to blood high dielectric values compared to those of surrounding grey and white matter tissues. We show that using brain MRI images as prior information about brain's configuration, along with known brain dielectric properties, and the intrinsic regularization by structural inversion, allows successful and rapid stroke detection even in difficult cases. The method has been applied to 2D slices created from a database of 3D real MRI phantom images to effectively detect lesions larger than 2.5 × 10−2 m diameter.

  15. A Prior-based Transfer Learning Method for the Phishing Detection

    Directory of Open Access Journals (Sweden)

    Jianyi Zhang

    2012-08-01

    Full Text Available In this paper, we introduce a prior-based transfer  learning method for our statistical machine learning  classifier which based on the logistic regression to detect the  phishing sites that relies on our selected features of the  URLs. Because of the mismatched distributions of the  features in different phishing domains, we employ multiple  models for different regions. Since it is impossible for us to  collect enough data from a new region to rebuild the  detection model, we adjust the existing models by the  transfer learning algorithm to solve these problems. The  proposed algorithm was evaluated on a real-world task of  detecting the phishing websites. After a number of  experiments, our proposed transfer learning algorithm  achieves more than 97% accuracy. The result demonstrates  the use of this algorithm in the anti-phishing scenario is  feasible and ready for our large scale detection engine. 

  16. A data driven approach for detection and isolation of anomalies in a group of UAVs

    Directory of Open Access Journals (Sweden)

    Wang Yin

    2015-02-01

    Full Text Available The use of groups of unmanned aerial vehicles (UAVs has greatly expanded UAV’s capabilities in a variety of applications, such as surveillance, searching and mapping. As the UAVs are operated as a team, it is important to detect and isolate the occurrence of anomalous aircraft in order to avoid collisions and other risks that would affect the safety of the team. In this paper, we present a data-driven approach to detect and isolate abnormal aircraft within a team of formatted flying aerial vehicles, which removes the requirements for the prior knowledge of the underlying dynamic model in conventional model-based fault detection algorithms. Based on the assumption that normal behaviored UAVs should share similar (dynamic model parameters, we propose to firstly identify the model parameters for each aircraft of the team based on a sequence of input and output data pairs, and this is achieved by a novel sparse optimization technique. The fault states of the UAVs would be detected and isolated in the second step by identifying the change of model parameters. Simulation results have demonstrated the efficiency and flexibility of the proposed approach.

  17. A data driven approach for detection and isolation of anomalies in a group of UAVs

    Institute of Scientific and Technical Information of China (English)

    Wang Yin; Wang Daobo; Wang Jianhong

    2015-01-01

    The use of groups of unmanned aerial vehicles (UAVs) has greatly expanded UAV’s capa-bilities in a variety of applications, such as surveillance, searching and mapping. As the UAVs are operated as a team, it is important to detect and isolate the occurrence of anomalous aircraft in order to avoid collisions and other risks that would affect the safety of the team. In this paper, we present a data-driven approach to detect and isolate abnormal aircraft within a team of formatted flying aerial vehicles, which removes the requirements for the prior knowledge of the underlying dynamic model in conventional model-based fault detection algorithms. Based on the assumption that normal behaviored UAVs should share similar (dynamic) model parameters, we propose to firstly identify the model parameters for each aircraft of the team based on a sequence of input and output data pairs, and this is achieved by a novel sparse optimization technique. The fault states of the UAVs would be detected and isolated in the second step by identifying the change of model parameters. Simulation results have demonstrated the efficiency and flexibility of the proposed approach.

  18. A Comparative Study of Anomaly Detection Techniques for Smart City Wireless Sensor Networks.

    Science.gov (United States)

    Garcia-Font, Victor; Garrigues, Carles; Rifà-Pous, Helena

    2016-06-13

    In many countries around the world, smart cities are becoming a reality. These cities contribute to improving citizens' quality of life by providing services that are normally based on data extracted from wireless sensor networks (WSN) and other elements of the Internet of Things. Additionally, public administration uses these smart city data to increase its efficiency, to reduce costs and to provide additional services. However, the information received at smart city data centers is not always accurate, because WSNs are sometimes prone to error and are exposed to physical and computer attacks. In this article, we use real data from the smart city of Barcelona to simulate WSNs and implement typical attacks. Then, we compare frequently used anomaly detection techniques to disclose these attacks. We evaluate the algorithms under different requirements on the available network status information. As a result of this study, we conclude that one-class Support Vector Machines is the most appropriate technique. We achieve a true positive rate at least 56% higher than the rates achieved with the other compared techniques in a scenario with a maximum false positive rate of 5% and a 26% higher in a scenario with a false positive rate of 15%.

  19. ANOMALY IDENTIFICATION FROM SUPER-LOW FREQUENCY ELECTROMAGNETIC DATA FOR THE COALBED METHANE DETECTION

    Directory of Open Access Journals (Sweden)

    S. S. Zhao

    2016-06-01

    Full Text Available Natural source Super Low Frequency(SLF electromagnetic prospecting methods have become an increasingly promising way in the resource detection. The capacity estimation of the reservoirs is of great importance to evaluate their exploitation potency. In this paper, we built a signal-estimate model for SLF electromagnetic signal and processed the monitored data with adaptive filter. The non-normal distribution test showed that the distribution of the signal was obviously different from Gaussian probability distribution, and Class B instantaneous amplitude probability model can well describe the statistical properties of SLF electromagnetic data. The Class B model parameter estimation is very complicated because its kernel function is confluent hypergeometric function. The parameters of the model were estimated based on property spectral function using Least Square Gradient Method(LSGM. The simulation of this estimation method was carried out, and the results of simulation demonstrated that the LGSM estimation method can reflect important information of the Class B signal model, of which the Gaussian component was considered to be the systematic noise and random noise, and the Intermediate Event Component was considered to be the background ground and human activity noise. Then the observation data was processed using adaptive noise cancellation filter. With the noise components subtracted out adaptively, the remaining part is the signal of interest, i.e., the anomaly information. It was considered to be relevant to the reservoir position of the coalbed methane stratum.

  20. A Comparative Study of Anomaly Detection Techniques for Smart City Wireless Sensor Networks

    Directory of Open Access Journals (Sweden)

    Victor Garcia-Font

    2016-06-01

    Full Text Available In many countries around the world, smart cities are becoming a reality. These cities contribute to improving citizens’ quality of life by providing services that are normally based on data extracted from wireless sensor networks (WSN and other elements of the Internet of Things. Additionally, public administration uses these smart city data to increase its efficiency, to reduce costs and to provide additional services. However, the information received at smart city data centers is not always accurate, because WSNs are sometimes prone to error and are exposed to physical and computer attacks. In this article, we use real data from the smart city of Barcelona to simulate WSNs and implement typical attacks. Then, we compare frequently used anomaly detection techniques to disclose these attacks. We evaluate the algorithms under different requirements on the available network status information. As a result of this study, we conclude that one-class Support Vector Machines is the most appropriate technique. We achieve a true positive rate at least 56% higher than the rates achieved with the other compared techniques in a scenario with a maximum false positive rate of 5% and a 26% higher in a scenario with a false positive rate of 15%.

  1. Novel ST-MUSIC-based spectral analysis for detection of ULF geomagnetic signals anomalies associated with seismic events in Mexico

    Directory of Open Access Journals (Sweden)

    Omar Chavez

    2016-05-01

    Full Text Available Recently, the analysis of ultra-low-frequency (ULF geomagnetic signals in order to detect seismic anomalies has been reported in several works. Yet, they, although having promising results, present problems for their detection since these anomalies are generally too much weak and embedded in high noise levels. In this work, a short-time multiple signal classification (ST-MUSIC, which is a technique with high-frequency resolution and noise immunity, is proposed for the detection of seismic anomalies in the ULF geomagnetic signals. Besides, the energy (E of geomagnetic signals processed by ST-MUSIC is also presented as a complementary parameter to measure the fluctuations between seismic activity and seismic calm period. The usefulness and effectiveness of the proposal are demonstrated through the analysis of a synthetic signal and five real signals with earthquakes. The analysed ULF geomagnetic signals have been obtained using a tri-axial fluxgate magnetometer at the Juriquilla station, which is localized in Queretaro, Mexico (geographic coordinates: longitude 100.45° E and latitude 20.70° N. The results obtained show the detection of seismic perturbations before, during, and after the main shock, making the proposal a suitable tool for detecting seismic precursors.

  2. Towards real-time topical detection and characterization of FDG dose infiltration prior to PET imaging

    Energy Technology Data Exchange (ETDEWEB)

    Williams, Jason M.; Arlinghaus, Lori R. [Vanderbilt University Institute of Imaging Science, Vanderbilt University Medical Center, Nashville, TN (United States); Rani, Sudheer D. [Vanderbilt University Institute of Imaging Science, Vanderbilt University Medical Center, Nashville, TN (United States); Vanderbilt University Medical Center, Department of Radiology and Radiological Sciences, Nashville, TN (United States); Shone, Martha D. [Vanderbilt University Medical Center, Department of Radiology and Radiological Sciences, Nashville, TN (United States); Abramson, Vandana G. [Vanderbilt University Medical Center, Department of Medicine, Nashville, TN (United States); Vanderbilt-Ingram Cancer Center, Nashville, TN (United States); Pendyala, Praveen [Vanderbilt University Medical Center, Department of Radiation Oncology, Nashville, TN (United States); Chakravarthy, A.B. [Vanderbilt-Ingram Cancer Center, Nashville, TN (United States); Vanderbilt University Medical Center, Department of Radiation Oncology, Nashville, TN (United States); Gorge, William J.; Knowland, Joshua G.; Lattanze, Ronald K.; Perrin, Steven R. [Lucerno Dynamics, LLC, Morrisville, NC (United States); Scarantino, Charles W. [Lucerno Dynamics, LLC, Morrisville, NC (United States); University of North Carolina, Department of Radiation Oncology, Chapel Hill, NC (United States); Townsend, David W. [Lucerno Dynamics, LLC, Morrisville, NC (United States); Technology and Research-National University of Singapore, Clinical Imaging Research Centre, Agency for Science, Singapore (Singapore); Abramson, Richard G. [Vanderbilt University Institute of Imaging Science, Vanderbilt University Medical Center, Nashville, TN (United States); Vanderbilt University Medical Center, Department of Radiology and Radiological Sciences, Nashville, TN (United States); Vanderbilt-Ingram Cancer Center, Nashville, TN (United States); Yankeelov, Thomas E. [The University of Texas at Austin, Institute for Computational and Engineering Sciences, and Departments of Biomedical Engineering and Internal Medicine, Austin, TX (United States)

    2016-12-15

    To dynamically detect and characterize {sup 18}F-fluorodeoxyglucose (FDG) dose infiltrations and evaluate their effects on positron emission tomography (PET) standardized uptake values (SUV) at the injection site and in control tissue. Investigational gamma scintillation sensors were topically applied to patients with locally advanced breast cancer scheduled to undergo limited whole-body FDG-PET as part of an ongoing clinical study. Relative to the affected breast, sensors were placed on the contralateral injection arm and ipsilateral control arm during the resting uptake phase prior to each patient's PET scan. Time-activity curves (TACs) from the sensors were integrated at varying intervals (0-10, 0-20, 0-30, 0-40, and 30-40 min) post-FDG and the resulting areas under the curve (AUCs) were compared to SUVs obtained from PET. In cases of infiltration, observed in three sensor recordings (30 %), the injection arm TAC shape varied depending on the extent and severity of infiltration. In two of these cases, TAC characteristics suggested the infiltration was partially resolving prior to image acquisition, although it was still apparent on subsequent PET. Areas under the TAC 0-10 and 0-20 min post-FDG were significantly different in infiltrated versus non-infiltrated cases (Mann-Whitney, p < 0.05). When normalized to control, all TAC integration intervals from the injection arm were significantly correlated with SUV{sub peak} and SUV{sub max} measured over the infiltration site (Spearman ρ ≥ 0.77, p < 0.05). Receiver operating characteristic (ROC) analyses, testing the ability of the first 10 min of post-FDG sensor data to predict infiltration visibility on the ensuing PET, yielded an area under the ROC curve of 0.92. Topical sensors applied near the injection site provide dynamic information from the time of FDG administration through the uptake period and may be useful in detecting infiltrations regardless of PET image field of view. This dynamic information

  3. Discrete shearlet transform on GPU with applications in anomaly detection and denoising

    Science.gov (United States)

    Gibert, Xavier; Patel, Vishal M.; Labate, Demetrio; Chellappa, Rama

    2014-12-01

    Shearlets have emerged in recent years as one of the most successful methods for the multiscale analysis of multidimensional signals. Unlike wavelets, shearlets form a pyramid of well-localized functions defined not only over a range of scales and locations, but also over a range of orientations and with highly anisotropic supports. As a result, shearlets are much more effective than traditional wavelets in handling the geometry of multidimensional data, and this was exploited in a wide range of applications from image and signal processing. However, despite their desirable properties, the wider applicability of shearlets is limited by the computational complexity of current software implementations. For example, denoising a single 512 × 512 image using a current implementation of the shearlet-based shrinkage algorithm can take between 10 s and 2 min, depending on the number of CPU cores, and much longer processing times are required for video denoising. On the other hand, due to the parallel nature of the shearlet transform, it is possible to use graphics processing units (GPU) to accelerate its implementation. In this paper, we present an open source stand-alone implementation of the 2D discrete shearlet transform using CUDA C++ as well as GPU-accelerated MATLAB implementations of the 2D and 3D shearlet transforms. We have instrumented the code so that we can analyze the running time of each kernel under different GPU hardware. In addition to denoising, we describe a novel application of shearlets for detecting anomalies in textured images. In this application, computation times can be reduced by a factor of 50 or more, compared to multicore CPU implementations.

  4. Validity and reliability of an IMU-based method to detect APAs prior to gait initiation.

    Science.gov (United States)

    Mancini, Martina; Chiari, Lorenzo; Holmstrom, Lars; Salarian, Arash; Horak, Fay B

    2016-01-01

    Anticipatory postural adjustments (APAs) prior to gait initiation have been largely studied in traditional, laboratory settings using force plates under the feet to characterize the displacement of the center of pressure. However clinical trials and clinical practice would benefit from a portable, inexpensive method for characterizing APAs. Therefore, the main objectives of this study were (1) to develop a novel, automatic IMU-based method to detect and characterize APAs during gait initiation and (2) to measure its test-retest reliability. Experiment I was carried out in the laboratory to determine the validity of the IMU-based method in 10 subjects with PD (OFF medication) and 12 control subjects. Experiment II was carried out in the clinic, to determine test-retest reliability of the IMU-based method in a different set of 17 early-to-moderate, treated subjects with PD (tested ON medication) and 17 age-matched control subjects. Results showed that gait initiation characteristics (both APAs and 1st step) detected with our novel method were significantly correlated to the characteristics calculated with a force plate and motion analysis system. The size of APAs measured with either inertial sensors or force plate was significantly smaller in subjects with PD than in control subjects (p<0.05). Test-retest reliability for the gait initiation characteristics measured with inertial sensors was moderate-to-excellent (0.56

  5. Research on Healthy Anomaly Detection Model Based on Deep Learning from Multiple Time-Series Physiological Signals

    Directory of Open Access Journals (Sweden)

    Kai Wang

    2016-01-01

    Full Text Available Health is vital to every human being. To further improve its already respectable medical technology, the medical community is transitioning towards a proactive approach which anticipates and mitigates risks before getting ill. This approach requires measuring the physiological signals of human and analyzes these data at regular intervals. In this paper, we present a novel approach to apply deep learning in physiological signals analysis that allows doctor to identify latent risks. However, extracting high level information from physiological time-series data is a hard problem faced by the machine learning communities. Therefore, in this approach, we apply model based on convolutional neural network that can automatically learn features from raw physiological signals in an unsupervised manner and then based on the learned features use multivariate Gauss distribution anomaly detection method to detect anomaly data. Our experiment is shown to have a significant performance in physiological signals anomaly detection. So it is a promising tool for doctor to identify early signs of illness even if the criteria are unknown a priori.

  6. Research on Anomaly Detection Method in Android Application%Android应用异常检测方法研究

    Institute of Scientific and Technical Information of China (English)

    刘晓明

    2015-01-01

    目前面向Android系统的攻击越来越多,因此,分析与检测Android恶意应用已经成为了一个非常重要的研究课题.本文主要从恶意应用类型,国内外主流检测技术等方面分析了Android恶意应用的检测方法研究现状,并基于当前的检测技术,提出仅将良性样本作为训练集来实现对未知Android应用进行异常检测的方法,取得了良好的实验结果.最后,本文分析了Android应用异常检测方法的发展趋势及未来主要研究方向.%Attacks targeting on Android system have become more and more frequently. Analyzing and detecting Android malicious applications thus has become an important issue. In this work, we analyze the research status of Android malicious application detection methods based on different types of malware and domestic and international mainstream detection technology. Based on the current detection technology, we propose an anomaly detection approach for malapps based on benign Android apps only and achieved good results. Finally, this paper analyzes the development trend of Android application anomaly detection methods and future research direction.

  7. Using Generalized Entropies and OC-SVM with Mahalanobis Kernel for Detection and Classification of Anomalies in Network Traffic

    Directory of Open Access Journals (Sweden)

    Jayro Santiago-Paz

    2015-09-01

    Full Text Available Network anomaly detection and classification is an important open issue in network security. Several approaches and systems based on different mathematical tools have been studied and developed, among them, the Anomaly-Network Intrusion Detection System (A-NIDS, which monitors network traffic and compares it against an established baseline of a “normal” traffic profile. Then, it is necessary to characterize the “normal” Internet traffic. This paper presents an approach for anomaly detection and classification based on Shannon, Rényi and Tsallis entropies of selected features, and the construction of regions from entropy data employing the Mahalanobis distance (MD, and One Class Support Vector Machine (OC-SVM with different kernels (Radial Basis Function (RBF and Mahalanobis Kernel (MK for “normal” and abnormal traffic. Regular and non-regular regions built from “normal” traffic profiles allow anomaly detection, while the classification is performed under the assumption that regions corresponding to the attack classes have been previously characterized. Although this approach allows the use of as many features as required, only four well-known significant features were selected in our case. In order to evaluate our approach, two different data sets were used: one set of real traffic obtained from an Academic Local Area Network (LAN, and the other a subset of the 1998 MIT-DARPA set. For these data sets, a True positive rate up to 99.35%, a True negative rate up to 99.83% and a False negative rate at about 0.16% were yielded. Experimental results show that certain q-values of the generalized entropies and the use of OC-SVM with RBF kernel improve the detection rate in the detection stage, while the novel inclusion of MK kernel in OC-SVM and k-temporal nearest neighbors improve accuracy in classification. In addition, the results show that using the Box-Cox transformation, the Mahalanobis distance yielded high detection rates with

  8. Interpretation of Magnetic Anomalies in Salihli (Turkey) Geothermal Area Using 3-D Inversion and Edge Detection Techniques

    Science.gov (United States)

    Timur, Emre

    2016-04-01

    There are numerous geophysical methods used to investigate geothermal areas. The major purpose of this magnetic survey is to locate the boudaries of active hydrothermal system in the South of Gediz Graben in Salihli (Manisa/Turkey). The presence of the hydrothermal system had already been inferred from surface evidence of hydrothermal activity and drillings. Firstly, 3-D prismatic models were theoretically investigated and edge detection methods were utilized with an iterative inversion method to define the boundaries and the parameters of the structure. In the first step of the application, it was necessary to convert the total field anomaly into a pseudo-gravity anomaly map. Then the geometric boudaries of the structures were determined by applying a MATLAB based software with 3 different edge detection algorithms. The exact location of the structures were obtained by using these boundary coordinates as initial geometric parameters in the inversion process. In addition to these methods, reduction to pole and horizontal gradient methods were applied to the data to achieve more information about the location and shape of the possible reservoir. As a result, the edge detection methods were found to be successful, both in the field and as theoretical data sets for delineating the boundaries of the possible geothermal reservoir structure. The depth of the geothermal reservoir was determined as 2,4 km from 3-D inversion and 2,1 km from power spectrum methods.

  9. Detection of anticipatory postural adjustments prior to gait initiation using inertial wearable sensors

    Directory of Open Access Journals (Sweden)

    Sekine Masaki

    2011-04-01

    Full Text Available Abstract Background The present study was performed to evaluate and characterize the potential of accelerometers and angular velocity sensors to detect and assess anticipatory postural adjustments (APAs generated by the first step at the beginning of the gait. This paper proposes an algorithm to automatically detect certain parameters of APAs using only inertial sensors. Methods Ten young healthy subjects participated in this study. The subjects wore an inertial unit containing a triaxial accelerometer and a triaxial angular velocity sensor attached to the lower back and one footswitch on the dominant leg to detect the beginning of the step. The subjects were standing upright on a stabilometer to detect the center of pressure displacement (CoP generated by the anticipatory adjustments. The subjects were asked to take a step forward at their own speed and stride length. The duration and amplitude of the APAs detected by the accelerometer and angular velocity sensors were measured and compared with the results obtained from the stabilometer. The different phases of gait initiation were identified and compared using inertial sensors. Results The APAs were detected by all of the sensors. Angular velocity sensors proved to be adequate to detect the beginning of the step in a manner similar to the footswitch by using a simple algorithm, which is easy to implement in low computational power devices. The amplitude and duration of APAs detected using only inertial sensors were similar to those detected by the stabilometer. An automatic algorithm to detect APA duration using triaxial inertial sensors was proposed. Conclusions These results suggest that the feasibility of accelerometers is improved through the use of angular velocity sensors, which can be used to automatically detect and evaluate APAs. The results presented can be used to develop portable sensors that may potentially be useful for monitoring patients in the home environment, thus

  10. Detection of anomalies in NLO sulphamic acid single crystals by ultrasonic and thermal studies

    Indian Academy of Sciences (India)

    GEORGE VARUGHESE

    2016-09-01

    The ultrasonic pulse echo overlap technique (PEO) has been used to measure the velocities of 10 MHz acoustic waves in sulphamic acid single crystals in the range of 300–400 K. This study evaluated all the elastic stiffnessconstants, compliance constants and Poisson’s ratios of the crystal. The temperature variations of the elastic constants have been determined. The phase transition studies above room temperature were investigated using ultrasonic PEO technique. This study has suggested new weak elastic anomalies for the crystal around 330 K. The transverse elastic constants C44 and C66 have shown clear thermal hysteresis of 2 K. The present differential scanningcalorimetric (DSC) studies carried out at a slow heating rate have also suggested weak phase transition around 331 K. The present elastic and thermal studies have been substantiated by already reported DC electrical conductivitystudies around 330 K.

  11. Fuzzy Logic Based Anomaly Detection for Embedded Network Security Cyber Sensor

    Energy Technology Data Exchange (ETDEWEB)

    Ondrej Linda; Todd Vollmer; Jason Wright; Milos Manic

    2011-04-01

    Resiliency and security in critical infrastructure control systems in the modern world of cyber terrorism constitute a relevant concern. Developing a network security system specifically tailored to the requirements of such critical assets is of a primary importance. This paper proposes a novel learning algorithm for anomaly based network security cyber sensor together with its hardware implementation. The presented learning algorithm constructs a fuzzy logic rule based model of normal network behavior. Individual fuzzy rules are extracted directly from the stream of incoming packets using an online clustering algorithm. This learning algorithm was specifically developed to comply with the constrained computational requirements of low-cost embedded network security cyber sensors. The performance of the system was evaluated on a set of network data recorded from an experimental test-bed mimicking the environment of a critical infrastructure control system.

  12. A MACHINE LEARNING APPROACH TO ANOMALY-BASED DETECTION ON ANDROID PLATFORMS

    Directory of Open Access Journals (Sweden)

    Joshua Abah

    2015-11-01

    Full Text Available The emergence of mobile platforms with increased storage and computing capabilities and the pervasive use of these platforms for sensitive applications such as online banking, e-commerce and the storage of sensitive information on these mobile devices have led to increasing danger associated with malware targeted at these devices. Detecting such malware presents inimitable challenges as signature-based detection techniques available today are becoming inefficient in detecting new and unknown malware. In this research, a machine learning approach for the detection of malware on Android platforms is presented. The detection system monitors and extracts features from the applications while in execution and uses them to perform in-device detection using a trained K-Nearest Neighbour classifier. Results shows high performance in the detection rate of the classifier with accuracy of 93.75%, low error rate of 6.25% and low false positive rate with ability of detecting real Android malware.

  13. Simple hand-held metal detectors are an effective means of detecting cardiac pacemakers in the deceased prior to cremation.

    Science.gov (United States)

    Stone, Jason Lyle; Williams, John; Fearn, Lesley

    2010-05-01

    The hazard of undetected cardiac pacemakers exploding in crematoria is well described. This short report describes the use of an affordable hand-held metal detector to detect cardiac pacemakers. Over the course of a year, the metal detector located 100% of cardiac pacemakers in a district general hospital mortuary. A simple model using pigskin and fat is also used to demonstrate the effectiveness in vitro. Commercially purchased hand-held metal detectors should be used in all mortuaries responsible for detection and removal of cardiac pacemakers prior to cremation.

  14. A Universal Dynamic Threshold Cloud Detection Algorithm (UDTCDA) supported by a prior surface reflectance database

    Science.gov (United States)

    Sun, Lin; Wei, Jing; Wang, Jian; Mi, Xueting; Guo, Yamin; Lv, Yang; Yang, Yikun; Gan, Ping; Zhou, Xueying; Jia, Chen; Tian, Xinpeng

    2016-06-01

    Conventional cloud detection methods are easily affected by mixed pixels, complex surface structures, and atmospheric factors, resulting in poor cloud detection results. To minimize these problems, a new Universal Dynamic Threshold Cloud Detection Algorithm (UDTCDA) supported by a priori surface reflectance database is proposed in this paper. A monthly surface reflectance database is constructed using long-time-sequenced MODerate resolution Imaging Spectroradiometer surface reflectance product (MOD09A1) to provide the surface reflectance of the underlying surfaces. The relationships between the apparent reflectance changes and the surface reflectance are simulated under different observation and atmospheric conditions with the 6S (Second Simulation of the Satellite Signal in the Solar Spectrum) model, and the dynamic threshold cloud detection models are developed. Two typical remote sensing data with important application significance and different sensor parameters, MODIS and Landsat 8, are selected for cloud detection experiments. The results were validated against the visual interpretation of clouds and Cloud-Aerosol Lidar and Infrared Pathfinder Satellite Observation cloud measurements. The results showed that the UDTCDA can obtain a high precision in cloud detection, correctly identifying cloudy pixels and clear-sky pixels at rates greater than 80% with error rate and missing rate of less than 20%. The UDTCDA cloud product overall shows less estimation uncertainty than the current MODIS cloud mask products. Moreover, the UDTCDA can effectively reduce the effects of atmospheric factors and mixed pixels and can be applied to different satellite sensors to realize long-term, large-scale cloud detection operations.

  15. Anomaly Detection and Comparative Analysis of Hydrothermal Alteration Materials Trough Hyperspectral Multisensor Data in the Turrialba Volcano

    Science.gov (United States)

    Rejas, J. G.; Martínez-Frías, J.; Bonatti, J.; Martínez, R.; Marchamalo, M.

    2012-07-01

    The aim of this work is the comparative study of the presence of hydrothermal alteration materials in the Turrialba volcano (Costa Rica) in relation with computed spectral anomalies from multitemporal and multisensor data adquired in spectral ranges of the visible (VIS), short wave infrared (SWIR) and thermal infrared (TIR). We used for this purposes hyperspectral and multispectral images from the HyMAP and MASTER airborne sensors, and ASTER and Hyperion scenes in a period between 2002 and 2010. Field radiometry was applied in order to remove the atmospheric contribution in an empirical line method. HyMAP and MASTER images were georeferenced directly thanks to positioning and orientation data that were measured at the same time in the acquisition campaign from an inertial system based on GPS/IMU. These two important steps were allowed the identification of spectral diagnostic bands of hydrothermal alteration minerals and the accuracy spatial correlation. Enviromental impact of the volcano activity has been studied through different vegetation indexes and soil patterns. Have been mapped hydrothermal materials in the crater of the volcano, in fact currently active, and their surrounding carrying out a principal components analysis differentiated for a high and low absorption bands to characterize accumulations of kaolinite, illite, alunite and kaolinite+smectite, delimitating zones with the presence of these minerals. Spectral anomalies have been calculated on a comparative study of methods pixel and subpixel focused in thermal bands fused with high-resolution images. Results are presented as an approach based on expert whose main interest lies in the automated identification of patterns of hydrothermal altered materials without prior knowledge or poor information on the area.

  16. OGLE‐2008‐BLG‐510: first automated real‐time detection of a weak microlensing anomaly – brown dwarf or stellar binary?★

    DEFF Research Database (Denmark)

    Bozza, V.; Dominik, M.; Rattenbury, N. J.

    2012-01-01

    The microlensing event OGLE‐2008‐BLG‐510 is characterized by an evident asymmetric shape of the peak, promptly detected by the Automated Robotic Terrestrial Exoplanet Microlensing Search (ARTEMiS) system in real time. The skewness of the light curve appears to be compatible both with binary......‐lens and binary‐source models, including the possibility that the lens system consists of an M dwarf orbited by a brown dwarf. The detection of this microlensing anomaly and our analysis demonstrate that: (1) automated real‐time detection of weak microlensing anomalies with immediate feedback is feasible...

  17. COLLABORATIVE ANOMALY-BASED INTRUSION DETECTION IN MOBILE AD HOC NETWORKS

    Directory of Open Access Journals (Sweden)

    SUNIL K. PARYANI,

    2011-05-01

    Full Text Available Intrusion Prevention is first line of defense against attacks in MANET. Intrusion Detection and response presents a second line of defense. New vulnerabilities will continue to invent new attack methods so new technology such as MANET, we focus on developing effective detection approaches In this paper, we present an intrusion detection system for detection of malicious node in mobile ad hoc network. The technique is designed for detection of malicious nodes in a neighborhood in which each pair of nodes are within radio range of each other. Such a neighborhood of nodes is known as a clique. [1] This technique is aimed to reduce the computation and communication costs to select a monitor node and reduces the message passing between the nodes to detect a malicious node from the cluster hence there very less traffic and less chances of a collision.

  18. Bayesian signal processing techniques for the detection of highly localised gravity anomalies using quantum interferometry technology

    Science.gov (United States)

    Brown, Gareth; Ridley, Kevin; Rodgers, Anthony; de Villiers, Geoffrey

    2016-10-01

    Recent advances in the field of quantum technology offer the exciting possibility of gravimeters and gravity gradiometers capable of performing rapid surveys with unprecedented precision and accuracy. Measurements with sub nano-g (a billionth of the acceleration due to gravity) precision should enable the resolution of underground structures on metre length scales. However, deducing the exact dimensions of the structure producing the measured gravity anomaly is known to be an ill-posed inversion problem. Furthermore, the measurement process will be affected by multiple sources of uncertainty that increase the range of plausible solutions that fit the measured data. Bayesian inference is the natural framework for accommodating these uncertainties and providing a fully probabilistic assessment of possible structures producing inhomogeneities in the gravitational field. Previous work introduced the probability of excavation map as a means to convert the high-dimensional space belonging to the posterior distribution to an easily interpretable map. We now report on the development of the inference model to account for spatial correlations in the gravitational field induced by variations in soil density.

  19. A Survey of Visualization Tools Assessed for Anomaly-Based Intrusion Detection Analysis

    Science.gov (United States)

    2014-04-01

    Intrusion Detection Systems: A Taxonomy and Survey; Technical Report No 99- 15, Department of Computer Engineering: Chalmers University of Technology...Göteborg, Sweden, 1999 11. Axelsson, S. Research in Intrusion-Detection Systems: A Survey and Taxonomy, Department of Computer Engineering: Chalmers ...51. 14. Department of Computer Science and Engineering; Chalmers -University of Gothenburg, SE- 412 96 Goteborg, Sweden, December 1998. http

  20. 四川汶川8.0级地震地下流体异常分析%Analysis of Underground Fluid Anomalies Prior to the Wenchuan MS8.0 Earthquake

    Institute of Scientific and Technical Information of China (English)

    王小娟; 李旭升; 牛延平; 田野

    2014-01-01

    .Second,because the fracture surface continued for several hundred kilometers through the town,the earthquake wreaked havoc on the buildings.Third,the earth-quake occurred in the mountains.Fourth,secondary effects aggravated the disaster.Field investi-gation and the precursory data research by previous scholars revealed that the Wenchuan earth-quake included macro-precursor abnormalities and seismic effects.This earthquake had the largest magnitude of those occurring in north-south seismic belt in recent years.Therefore,it is necessa-ry to summarize the Wenchuan earthquake precursor anomaly. In recent years,China’s seismic monitoring network has become denser,and the observation scale has become greater.Data have been accumulated for moderate earthquakes.In addition, many achievements have been in fundamental theories,earthquake prediction methods,and the precursory mechanism.In the history of more than 40 years of earthquake monitoring and fore-casting,20 destructive events have been predicted with varying degrees of success.Despite some progress in the method of forecasting,it is quite difficult to predict earthquakes.Therefore, earthquake prediction is still in the primary stage.Although the Wenchuan earthquake was not predicted,some abnormal fluid phenomena appeared before the earthquake.By summarizing and analyzing data after the earthquake,some scholars detected 28 credible underground fluid anoma-lies within 1000 km in addition to 1 1 suspected abnormalities and 1 94 coseismic abnormalities.A month after the Wenchuan earthquake,the China Earthquake Administration subsurface fluid disciplinary technical coordination group found 39 suspected underground fluid abnormalities within 1,000 km from the epicenter.According to the Sichuan Seismological Bureau of Statistics, nine underground fluid anomalies may be related to the Wenchuan earthquake.Despite an excep-tion,it is certain that subsurface fluid exists before the earthquake anomalies.The following ex-ception is divided into

  1. DEVELOPMENT AND TESTING OF PROCEDURES FOR CARRYING OUT EMERGENCY PHYSICAL INVENTORY TAKING AFTER DETECTING ANOMALY EVENTS CONCERNING NM SECURITY.

    Energy Technology Data Exchange (ETDEWEB)

    VALENTE,J.FISHBONE,L.ET AL.

    2003-07-13

    In the State Scientific Center of Russian Federation - Institute of Physics and Power Engineering (SSC RF-IPPE, Obninsk), which is under Minatom jurisdiction, the procedures for carrying out emergency physical inventory taking (EPIT) were developed and tested in cooperation with the Brookhaven National Laboratory (USA). Here the emergency physical inventory taking means the PIT, which is carried out in case of symptoms indicating a possibility of NM loss (theft). Such PIT often requires a verification of attributes and quantitative characteristics for all the NM items located in a specific Material Balance Area (MBA). In order to carry out the exercise, an MBA was selected where many thousands of NM items containing highly enriched uranium are used. Three clients of the computerized material accounting system (CMAS) are installed in this MBA. Labels with unique (within IPPE site) identification numbers in the form of digit combinations and an appropriate bar code have been applied on the NM items, containers and authorized locations. All the data to be checked during the EPIT are stored in the CMAS database. Five variants of anomalies initiating EPIT and requiring different types of activities on EPIT organization are considered. Automatic working places (AWP) were created on the basis of the client computers in order to carry out a large number of measurements within a reasonable time. In addition to a CMAS client computer, the main components of an AWP include a bar-code reader, an electronic scale and an enrichment meter with NaI--detector--the lMCA Inspector (manufactured by the Canberra Company). All these devices work together with a client computer in the on-line mode. Special computer code (Emergency Inventory Software-EIS) was developed. All the algorithms of interaction between the operator and the system, as well as algorithms of data exchange during the measurements and data comparison, are implemented in this software. Registration of detected

  2. Enhanced Anomaly Detection Via PLS Regression Models and Information Entropy Theory

    KAUST Repository

    Harrou, Fouzi

    2015-12-07

    Accurate and effective fault detection and diagnosis of modern engineering systems is crucial for ensuring reliability, safety and maintaining the desired product quality. In this work, we propose an innovative method for detecting small faults in the highly correlated multivariate data. The developed method utilizes partial least square (PLS) method as a modelling framework, and the symmetrized Kullback-Leibler divergence (KLD) as a monitoring index, where it is used to quantify the dissimilarity between probability distributions of current PLS-based residual and reference one obtained using fault-free data. The performance of the PLS-based KLD fault detection algorithm is illustrated and compared to the conventional PLS-based fault detection methods. Using synthetic data, we have demonstrated the greater sensitivity and effectiveness of the developed method over the conventional methods, especially when data are highly correlated and small faults are of interest.

  3. The Cyborg Astrobiologist: Matching of Prior Textures by Image Compression for Geological Mapping and Novelty Detection

    CERN Document Server

    McGuire, P C; Bruner, K R; Gross, C; Ormö, J; Smosna, R A; Walter, S; Wendt, L

    2013-01-01

    (abridged) We describe an image-comparison technique of Heidemann and Ritter that uses image compression, and is capable of: (i) detecting novel textures in a series of images, as well as of: (ii) alerting the user to the similarity of a new image to a previously-observed texture. This image-comparison technique has been implemented and tested using our Astrobiology Phone-cam system, which employs Bluetooth communication to send images to a local laptop server in the field for the image-compression analysis. We tested the system in a field site displaying a heterogeneous suite of sandstones, limestones, mudstones and coalbeds. Some of the rocks are partly covered with lichen. The image-matching procedure of this system performed very well with data obtained through our field test, grouping all images of yellow lichens together and grouping all images of a coal bed together, and giving a 91% accuracy for similarity detection. Such similarity detection could be employed to make maps of different geological unit...

  4. Detection of linear features in synthetic-aperture radar images by use of the localized Radon transform and prior information.

    Science.gov (United States)

    Onana, Vincent-de-Paul; Trouvé, Emmanuel; Mauris, Gilles; Rudant, Jean-Paul; Tonyé, Emmanuel

    2004-01-10

    A new linear-features detection method is proposed for extracting straight edges and lines in synthetic-aperture radar images. This method is based on the localized Radon transform, which produces geometrical integrals along straight lines. In the transformed domain, linear features have a specific signature: They appear as strongly contrasted structures, which are easier to extract with the conventional ratio edge detector. The proposed method is dedicated to applications such as geographical map updating for which prior information (approximate length and orientation of features) is available. Experimental results show the method's robustness with respect to poor radiometric contrast and hidden parts and its complementarity to conventional pixel-by-pixel approaches.

  5. Detection of mullerian duct anomalies: diagnostic utility of two dimensional ultrasonography as compared to magnetic resonance imaging

    Directory of Open Access Journals (Sweden)

    Krishna Pratap Singh Senger

    2016-12-01

    Full Text Available Background: Mullerian duct anomalies (MDAs are a fascinating group of disorders that have varied clinical presentation from being asymptomatic to primary amenorrhea to inability to reproduce. Correct diagnosis of the condition plays a crucial role in management. Imaging plays a pivotal role in making correct diagnosis. This study aims to find the prevalence of MDAs amongst study population and their relation with infertility and also compares diagnostic utility of pelvic ultrasound with MRI. Methods: A randomized diagnostic test evaluation study was conducted in the Department of Radiodiagnosis and Imaging of a tertiary care teaching hospital over a period of 2 years. The patient first underwent pelvic 2D USG in multiple planes using curvilinear probe of 3MHz to 5 MHz. frequency and then MRI. Results: Most common MDA in total study sample and in primary infertility group is arcuate uterus while in recurrent abortions group it is unicornuate uterus. Out of total study sample of 75 patients 2D USG detected 18 cases of MDA while MRI detected 22 cases of MDA. So, 2D USG failed to detect 04 cases of MDA in total study population bringing overall sensitivity of 2D USG as 81.8%, specificity of 100%, PPV of 100%, NPV of 93.4% and accuracy of 94.6%. Conclusions: 2D USG has a few limitations but in view of relatively simple imaging procedure, ease of availability and cost effectiveness it should be utilized as an initial imaging modality in patients with suspicion of MDAs.

  6. ANOMALY INTRUSION DETECTION DESIGN USING HYBRID OF UNSUPERVISED AND SUPERVISED NEURAL NETWORK

    Directory of Open Access Journals (Sweden)

    M. Bahrololum

    2009-07-01

    Full Text Available This paper proposed a new approach to design the system using a hybrid of misuse and anomalydetection for training of normal and attack packets respectively. The utilized method for attack training isthe combination of unsupervised and supervised Neural Network (NN for Intrusion Detection System. Bythe unsupervised NN based on Self Organizing Map (SOM, attacks will be classified into smallercategories considering their similar features, and then unsupervised NN based on Backpropagation willbe used for clustering. By misuse approach known packets would be identified fast and unknown attackswill be able to detect by this method.

  7. A survey on anomaly and signature based intrusion detection system (IDS

    Directory of Open Access Journals (Sweden)

    Mrs.Anshu Gangwar

    2014-04-01

    Full Text Available Security is considered as one of the most critical parameter for the acceptance of any networking technology. Information in transit must be protected from unauthorized release and modification, and the connection itself must be established and maintained securely malicious users have taken advantage of this to achieve financial gain or accomplish some corporate or personal agenda. Denial of Service (DoS and distributed DoS (DDoS attacks are evolving continuously. These attacks make network resources unavailable for legitimate users which results in massive loss of data, resources and money. Combination of Intrusion detection System and Firewall is used by Business Organizations to detect and p revent Organizations‟ network from these attacks. Signatures to detect them are not available. This paper presents a light-Weight mechanism to detect novel DoS/DDoS (Resource Consumption attacks and automatic signature generation process to represent them in real time. Experimental results are provided to support the proposed mechanism.

  8. Host-Based Multivariate Statistical Computer Operating Process Anomaly Intrusion Detection System (PAIDS)

    Science.gov (United States)

    2009-03-01

    Extraction, Feature Selection, and Identification Techniques That Create a Fast Unsupervised Hyperspectral Target Detection Algorithm. Wright... CLASSIFICATION .................................................................................................................... 30 2.4.1 Discriminant...used correctly (a Trojan is not a virus) but unfortunately many malware programs are combinations that defy simple classification . Malware Type

  9. Development of a Computer-aided Diagnosis System for Early Detection of Masses Using Retrospectively Detected Cancers on Prior Mammograms

    Science.gov (United States)

    2009-06-01

    O’shaughnessy, K. F., Sick les, E. A. , Tabar, L., Vy borny, C. J. and Castellino , R. A., "Potential contribution of com puter-aided d etection to t...F. O’Shaughnessy, E. A. Sickles, L. Tabar, C. J. Vyborny, and R. A. Castellino , “Potential contribution of computer-aided detection to the...Med. Phys. 31, 2313–2330 2004. 52K. F. O’Shaughnessy, R. A. Castellino , S. L. Muller, and K. Benali, “Computer-aided detection CAD on 90 biopsy

  10. Surveillance and control of zoonotic agents prior to disease detection in humans.

    Science.gov (United States)

    Childs, James E; Gordon, Elizabeth R

    2009-10-01

    The majority of newly emerging diseases are zoonoses caused by pathogens transmitted directly or indirectly through arthropod vectors to humans. Transmission chains leading to human infection frequently involve intermediate vertebrate hosts, including wildlife and domestic animals. Animal-based surveillance of domestic and wild animals for zoonotic pathogens is a global challenge. Until recently, there has been no scientific, social, or political consensus that animal-based surveillance for zoonotic pathogens merits significant infrastructural investment, other than the fledgling efforts with avian influenza. National institutions charged with strategic planning for emerging diseases or intentional releases of zoonotic agents emphasize improving diagnostic capabilities for detecting human infections, modifying the immune status of human or domestic animals through vaccines, producing better antiviral or antibacterial drugs, and enhancing human-based surveillance as an early warning system. With the exception of human vaccination, these anthropocentric approaches target post-spillover events, and none of these avenues of research will reduce the risk of additional emergences of pathogens from wildlife. Novel schemes for preventing spillover of human pathogens from animal reservoir hosts can spring only from an understanding of the ecological context and biological interactions that result in zoonotic disease emergence. Although the benefits derived from investments to improve surveillance and knowledge of zoonotic pathogens circulating among wildlife reservoir populations are uncertain, our experience with human immunodeficiency virus and the pandemic influenza inform us of the outcomes that we can expect by relying on detection of post-spillover events among sentinel humans. Mt Sinai J Med 76:421-428, 2009. (c) 2009 Mount Sinai School of Medicine.

  11. Quantum-state anomaly detection for arbitrary errors using a machine-learning technique

    Science.gov (United States)

    Hara, Satoshi; Ono, Takafumi; Okamoto, Ryo; Washio, Takashi; Takeuchi, Shigeki

    2016-10-01

    The accurate detection of small deviations in given density matrice is important for quantum information processing, which is a difficult task because of the intrinsic fluctuation in density matrices reconstructed using a limited number of experiments. We previously proposed a method for decoherence error detection using a machine-learning technique [S. Hara, T. Ono, R. Okamoto, T. Washio, and S. Takeuchi, Phys. Rev. A 89, 022104 (2014), 10.1103/PhysRevA.89.022104]. However, the previous method is not valid when the errors are just changes in phase. Here, we propose a method that is valid for arbitrary errors in density matrices. The performance of the proposed method is verified using both numerical simulation data and real experimental data.

  12. A Framework for Detection of Traffic Anomalies Based on IP Aggregation

    Science.gov (United States)

    Zhanikeev, Marat; Tanaka, Yoshiaki

    Traditional traffic analysis is can be performed online only when detection targets are well specified and are fairly primitive. Local processing at measurement point is discouraged as it would considerably affect major functionality of a network device. When traffic is analyzed at flow level, the notion of flow timeout generates differences in flow lifespan and impedes unbiased monitoring, where only n-top flows ordered by a certain metric are considered. This paper proposes an alternative manner of traffic analysis based on source IP aggregation. The method uses flows as basic building blocks but ignores timeouts, using short monitoring intervals instead. Multidimensional space of metrics obtained through IP aggregation, however, enhances capabilities of traffic analysis by facilitating detection of various anomalous conditions in traffic simultaneously.

  13. Finding Needle in a Million Metrics: Anomaly Detection in a Large-scale Computational Advertising Platform

    OpenAIRE

    Zhou, Bowen; Shariat, Shahriar

    2016-01-01

    Online media offers opportunities to marketers to deliver brand messages to a large audience. Advertising technology platforms enables the advertisers to find the proper group of audiences and deliver ad impressions to them in real time. The recent growth of the real time bidding has posed a significant challenge on monitoring such a complicated system. With so many components we need a reliable system that detects the possible changes in the system and alerts the engineering team. In this pa...

  14. On-line learning and anomaly detection methods : applications to fault assessment

    OpenAIRE

    Martínez Rego, David

    2013-01-01

    [Abstract] This work lays at the intersection of two disciplines, Machine Learning (ML) research and predictive maintenance of machinery. On the one hand, Machine Learning aims at detecting patterns in data gathered from phenomena which can be very different in nature. On the other hand, predictive maintenance of industrial machinery is the discipline which, based on the measurement of physical conditions of its internal components, assesses its present and near future condition in order to p...

  15. "The tail wags the dog": A study of anomaly detection in commercial application performance

    OpenAIRE

    Gow, Richard; Venugopal, Srikumar; Ray, Pradeep

    2013-01-01

    The IT industry needs systems management models that leverage available application information to detect quality of service, scalability and health of service. Ideally this technique would be common for varying application types with different n-tier architectures under normal production conditions of varying load, user session traffic, transaction type, transaction mix, and hosting environment. This paper shows that a whole of service measurement paradigm utilizing a black box M/M/1 queuing...

  16. Using a nano-flare probe to detect RNA in live donor cells prior to somatic cell nuclear transfer.

    Science.gov (United States)

    Fu, Bo; Ren, Liang; Liu, Di; Ma, Jian-Zhang; An, Tie-Zhu; Yang, Xiu-Qin; Ma, Hong; Guo, Zhen-Hua; Zhu, Meng; Bai, Jing

    2016-01-01

    Many transgenes are silenced in mammalian cells (donor cells used for somatic cell nuclear transfer [SCNT]). Silencing correlated with a repressed chromatin structure or suppressed promoter, and it impeded the production of transgenic animals. Gene transcription studies in live cells are challenging because of the drawbacks of reverse-transcription polymerase chain reaction and fluorescence in situ hybridization. Nano-flare probes provide an effective approach to detect RNA in living cells. We used 18S RNA, a housekeeping gene, as a reference gene. This study aimed to establish a platform to detect RNA in single living donor cells using a Nano-flare probe prior to SCNT and to verify the safety and validity of the Nano-flare probe in order to provide a technical foundation for rescuing silenced transgenes in transgenic cloned embryos. We investigated cytotoxic effect of the 18S RNA-Nano-flare probe on porcine fetal fibroblasts, characterized the distribution of the 18S RNA-Nano-flare probe in living cells and investigated the effect of the 18S RNA-Nano-flare probe on the development of cloned embryos after SCNT. The cytotoxic effect of the 18S RNA-Nano-flare probe on porcine fetal fibroblasts was dose-dependent, and 18S RNA was detected using the 18S RNA-Nano-flare probe. In addition, treating donor cells with 500 pM 18S RNA-Nano-flare probe did not have adverse effects on the development of SCNT embryos at the pre-implantation stage. In conclusion, we established a preliminary platform to detect RNA in live donor cells using a Nano-flare probe prior to SCNT.

  17. Detection of CD2 expression in chicken hematogenic embryo yolk sac lymphoid cells prior to thymus genesis

    Institute of Scientific and Technical Information of China (English)

    Dongyu Zhou; Jigui Wang; Weiquan Liu; Rongxiu Liu; Yuehu Pei

    2008-01-01

    Lymphoid mononuclear cells from chick embryos at stage 16 were collected prior to fetal liver and thymus genesis to study the differentiation and function of the hematogenic yolk sac and to detect whether CD2 occurs on the surface of lymphoid mononuclear cells.The phenotype and functional activity of the cell surface protein E receptor and the ultrastructure of embryonic E+ cells were compared with those of mature T cells.Our results indicate 99.36% homology between the E receptors of embryonic lymphocytes and mature T cells.Other similarities,including molecular distribution,motivation,the ability to form an erythrocyte rosette,the structure of the receptor-ligand complex,and the conformation of the signal channel,were detected between embryonic lymphocytes and mature CD2-expressing T cells.These results indicate that CD2 is already expressed prior to fetal fiver and thymus genesis and that its expression is not dependent on the thymic microenvironment.

  18. A prior-knowledge-based threshold segmentation method of forward-looking sonar images for underwater linear object detection

    Science.gov (United States)

    Liu, Lixin; Bian, Hongyu; Yagi, Shin-ichi; Yang, Xiaodong

    2016-07-01

    Raw sonar images may not be used for underwater detection or recognition directly because disturbances such as the grating-lobe and multi-path disturbance affect the gray-level distribution of sonar images and cause phantom echoes. To search for a more robust segmentation method with a reasonable computational cost, a prior-knowledge-based threshold segmentation method of underwater linear object detection is discussed. The possibility of guiding the segmentation threshold evolution of forward-looking sonar images using prior knowledge is verified by experiment. During the threshold evolution, the collinear relation of two lines that correspond to double peaks in the voting space of the edged image is used as the criterion of termination. The interaction is reflected in the sense that the Hough transform contributes to the basis of the collinear relation of lines, while the binary image generated from the current threshold provides the resource of the Hough transform. The experimental results show that the proposed method could maintain a good tradeoff between the segmentation quality and the computational time in comparison with conventional segmentation methods. The proposed method redounds to a further process for unsupervised underwater visual understanding.

  19. Airway management of neonates with antenatally detected head and neck anomalies.

    Science.gov (United States)

    Stocks, R M; Egerman, R S; Woodson, G E; Bower, C M; Thompson, J W; Wiet, G J

    1997-06-01

    Five cases of prenatally detected neck masses that had a potential for airway obstruction at birth are described. The various options for management of the airway are discussed, including using maternal-fetal circulation until intubation, rigid bronchoscopy, tracheotomy, cyst aspiration, or extracorporeal membrane oxygen support. Congenital abnormalities involving the fetal face or neck are extremely rare. With technical advances in ultrasonography, these masses were first noted on prenatal ultrasound in the late 1970s. Before that period, they were detected at delivery. These masses are solid or cystic and may cause asphyxia because of airway obstruction at the time of delivery. The survivability of these neonates without immediate intervention at birth is 0% to 20%. If a neck mass is detected in the fetus by prenatal ultrasonography, then a strategic plan for these types of cases should be developed early in the prenatal period. The airway management plan should be tailored for each individual case. Coordination and the expertise of an obstetrician, neonatologist, anesthesiologist, and pediatric otolaryngologist are needed to manage these complex situations.

  20. Detecting anomalies in astronomical signals using machine learning algorithms embedded in an FPGA

    Science.gov (United States)

    Saez, Alejandro F.; Herrera, Daniel E.

    2016-07-01

    Taking a large interferometer for radio astronomy, such as the ALMA1 telescope, where the amount of stations (50 in the case of ALMA's main array, which can extend to 64 antennas) produces an enormous amount of data in a short period of time - visibilities can be produced every 16msec or total power information every 1msec (this means up to 2016 baselines). With the aforementioned into account it is becoming more difficult to detect problems in the signal produced by each antenna in a timely manner (one antenna produces 4 x 2GHz spectral windows x 2 polarizations, which means a 16 GHz bandwidth signal which is later digitized using 3-bits samplers). This work will present an approach based on machine learning algorithms for detecting problems in the already digitized signal produced by the active antennas (the set of antennas which is being used in an observation). The aim of this work is to detect unsuitable, or totally corrupted, signals. In addition, this development also provides an almost real time warning which finally helps stop and investigate the problem in order to avoid collecting useless information.

  1. Muscle MRS detects elevated PDE/ATP ratios prior to fatty infiltration in Becker muscular dystrophy.

    Science.gov (United States)

    Wokke, B H; Hooijmans, M T; van den Bergen, J C; Webb, A G; Verschuuren, J J; Kan, H E

    2014-11-01

    Becker muscular dystrophy (BMD) is characterized by progressive muscle weakness. Muscles show structural changes (fatty infiltration, fibrosis) and metabolic changes, both of which can be assessed using MRI and MRS. It is unknown at what stage of the disease process metabolic changes arise and how this might vary for different metabolites. In this study we assessed metabolic changes in skeletal muscles of Becker patients, both with and without fatty infiltration, quantified via Dixon MRI and (31) P MRS. MRI and (31) P MRS scans were obtained from 25 Becker patients and 14 healthy controls using a 7 T MR scanner. Five lower-leg muscles were individually assessed for fat and muscle metabolite levels. In the peroneus, soleus and anterior tibialis muscles with non-increased fat levels, PDE/ATP ratios were higher (P < 0.02) compared with controls, whereas in all muscles with increased fat levels PDE/ATP ratios were higher compared with healthy controls (P ≤ 0.05). The Pi /ATP ratio in the peroneus muscles was higher in muscles with increased fat fractions (P = 0.005), and the PCr/ATP ratio was lower in the anterior tibialis muscles with increased fat fractions (P = 0.005). There were no other significant changes in metabolites, but an increase in tissue pH was found in all muscles of the total group of BMD patients in comparison with healthy controls (P < 0.05). These findings suggest that (31) P MRS can be used to detect early changes in individual muscles of BMD patients, which are present before the onset of fatty infiltration.

  2. Anomaly Detection in Electroencephalogram Signals Using Unconstrained Minimum Average Correlation Energy Filter

    Directory of Open Access Journals (Sweden)

    Aini Hussain

    2009-01-01

    Full Text Available Problem statement: Electroencepharogram (EEG is an extremely complex signal with very low signal to noise ratio and these attributed to difficulty in analyzing the signal. Hence for detecting abnormal segment, a distinctive method is required to train the technologist to distinguish the anomalous in EEG data. The objective of this study was to create a framework to analyze EEG signals recorded from epileptic patients by evaluating the potential of UMACE filter to detect changes in single-channel EEG data during routine epilepsy monitoring. Approach: Normally, the peak to side lobe ratio (PSR of a UMACE filter was employed as an indicator if a test data is similar to an authentic class or vice versa, however in this study, the consistent changes of the correlation output known as Region Of Interest (ROI was plotted and monitored. Based on this approach, a novel method to analyze and distinguish variances in scalp EEG as well as comparing both normal and abnormal regions of the patient’s EEG was assessed. The performance of the novelty detection was examined based on the onset and end time of each seizure in the ROI plot. Results: Results showed that using ROI plot of variances one can distinguish irregularities in the EEG data. The advantage of the proposed technique was that it did not require large amount of data for training. Conclusion: As such, it was feasible to perform seizure analysis as well as localizing seizure onsets. In short, the technique can be used as a guideline for faster diagnosis in a lengthy EEG recording.

  3. Chromosomal differences between acute nonlymphocytic leukemia in patients with prior solid tumors and prior hematologic malignancies. A study of 14 cases with prior breast cancer

    Energy Technology Data Exchange (ETDEWEB)

    Mamuris, Z.; Dumont, J.; Dutrillaux, B.; Aurias, A. (Institut Curie, Paris (France))

    1989-10-01

    A cytogenetic study of 14 patients with secondary acute nonlymphocytic leukemia (S-ANLL) with prior treatment for breast cancer is reported. The chromosomes recurrently involved in numerical or structural anomalies are chromosomes 7, 5, 17, and 11, in decreasing order of frequency. The distribution of the anomalies detected in this sample of patients is similar to that observed in published cases with prior breast or other solid tumors, though anomalies of chromosome 11 were not pointed out, but it significantly differs from that of the S-ANLL with prior hematologic malignancies. This difference is principally due to a higher involvement of chromosome 7 in patients with prior hematologic malignancies and of chromosomes 11 and 17 in patients with prior solid tumors. A genetic determinism involving abnormal recessive alleles located on chromosomes 5, 7, 11, and 17 uncovered by deletions of the normal homologs may be a cause of S-ANLL. The difference between patients with prior hematologic malignancies or solid tumors may be explained by different constitutional mutations of recessive genes in the two groups of patients.

  4. Anomaly detection using simulated MTI data cubes derived from HYDICE data

    Energy Technology Data Exchange (ETDEWEB)

    Moya, M.M.; Taylor, J.G.; Stallard, B.R.; Motomatsu, S.E.

    1998-07-01

    The US Department of Energy is funding the development of the Multi-spectral Thermal Imager (MTI), a satellite-based multi-spectral (MS) thermal imaging sensor scheduled for launch in October 1999. MTI is a research and development (R and D) platform to test the applicability of multispectral and thermal imaging technology for detecting and monitoring signs of proliferation of weapons of mass destruction. During its three-year mission, MTI will periodically record images of participating government, industrial and natural sites in fifteen visible and infrared spectral bands to provide a variety of image data associated with weapons production activities. The MTI satellite will have spatial resolution in the visible bands that is five times better than LANDSAT TM in each dimension and will have five thermal bands. In this work, the authors quantify the separability between specific materials and the natural background by applying Receiver Operating Curve (ROC) analysis to the residual errors from a linear unmixing. The authors apply the ROC analysis to quantify performance of the MTI. They describe the MTI imager and simulate its data by filtering HYDICE hyperspectral imagery both spatially and spectrally and by introducing atmospheric effects corresponding to the MTI satellite altitude. They compare and contrast the individual effects on performance of spectral resolution, spatial resolution, atmospheric corrections, and varying atmospheric conditions.

  5. Multi-scale structure and topological anomaly detection via a new network statistic: The onion decomposition

    Science.gov (United States)

    Hébert-Dufresne, Laurent; Grochow, Joshua A.; Allard, Antoine

    2016-08-01

    We introduce a network statistic that measures structural properties at the micro-, meso-, and macroscopic scales, while still being easy to compute and interpretable at a glance. Our statistic, the onion spectrum, is based on the onion decomposition, which refines the k-core decomposition, a standard network fingerprinting method. The onion spectrum is exactly as easy to compute as the k-cores: It is based on the stages at which each vertex gets removed from a graph in the standard algorithm for computing the k-cores. Yet, the onion spectrum reveals much more information about a network, and at multiple scales; for example, it can be used to quantify node heterogeneity, degree correlations, centrality, and tree- or lattice-likeness. Furthermore, unlike the k-core decomposition, the combined degree-onion spectrum immediately gives a clear local picture of the network around each node which allows the detection of interesting subgraphs whose topological structure differs from the global network organization. This local description can also be leveraged to easily generate samples from the ensemble of networks with a given joint degree-onion distribution. We demonstrate the utility of the onion spectrum for understanding both static and dynamic properties on several standard graph models and on many real-world networks.

  6. Structural Anomalies Detected in Ceramic Matrix Composites Using Combined Nondestructive Evaluation and Finite Element Analysis (NDE and FEA)

    Science.gov (United States)

    Abdul-Aziz, Ali; Baaklini, George Y.; Bhatt, Ramakrishna T.

    2003-01-01

    and the experimental data. Furthermore, modeling of the voids collected via NDE offered an analytical advantage that resulted in more accurate assessments of the material s structural strength. The top figure shows a CT scan image of the specimen test section illustrating various hidden structural entities in the material and an optical image of the test specimen considered in this study. The bottom figure represents the stress response predicted from the finite element analyses (ref .3 ) for a selected CT slice where it clearly illustrates the correspondence of the high stress risers due to voids in the material with those predicted by the NDE. This study is continuing, and efforts are concentrated on improving the modeling capabilities to imitate the structural anomalies as detected.

  7. Risk of developing palatally displaced canines in patients with early detectable dental anomalies: a retrospective cohort study

    Science.gov (United States)

    GARIB, Daniela Gamba; LANCIA, Melissa; KATO, Renata Mayumi; OLIVEIRA, Thais Marchini; NEVES, Lucimara Teixeira das

    2016-01-01

    ABSTRACT The early recognition of risk factors for the occurrence of palatally displaced canines (PDC) can increase the possibility of impaction prevention. Objective To estimate the risk of PDC occurrence in children with dental anomalies identified early during mixed dentition. Material and Methods The sample comprised 730 longitudinal orthodontic records from children (448 females and 282 males) with an initial mean age of 8.3 years (SD=1.36). The dental anomaly group (DA) included 263 records of patients with at least one dental anomaly identified in the initial or middle mixed dentition. The non-dental anomaly group (NDA) was composed of 467 records of patients with no dental anomalies. The occurrence of PDC in both groups was diagnosed using panoramic and periapical radiographs taken in the late mixed dentition or early permanent dentition. The prevalence of PDC in patients with and without early diagnosed dental anomalies was compared using the chi-square test (p<0.01), relative risk assessments (RR), and positive and negative predictive values (PPV and NPV). Results PDC frequency was 16.35% and 6.2% in DA and NDA groups, respectively. A statistically significant difference was observed between groups (p<0.01), with greater risk of PDC development in the DA group (RR=2.63). The PPV and NPV was 16% and 93%, respectively. Small maxillary lateral incisors, deciduous molar infraocclusion, and mandibular second premolar distoangulation were associated with PDC. Conclusion Children with dental anomalies diagnosed during early mixed dentition have an approximately two and a half fold increased risk of developing PDC during late mixed dentition compared with children without dental anomalies. PMID:28076458

  8. Anomaly holography

    Energy Technology Data Exchange (ETDEWEB)

    Gripaios, Ben [Rudolf Peierls Centre for Theoretical Physics, University of Oxford, 1 Keble Rd., Oxford OX1 3NP (United Kingdom); Merton College, Oxford OX1 4JD (United Kingdom)], E-mail: b.gripaios1@physics.ox.ac.uk; West, Stephen M. [Rudolf Peierls Centre for Theoretical Physics, University of Oxford, 1 Keble Rd., Oxford OX1 3NP (United Kingdom)], E-mail: s.west1@physics.ox.ac.uk

    2008-01-21

    We consider, in the effective field theory context, anomalies of gauge field theories on a slice of a five-dimensional, anti-de Sitter geometry and their four-dimensional, holographic duals. A consistent effective field theory description can always be found, notwithstanding the presence of the anomalies and without modifying the degrees of freedom of the theory. If anomalies do not vanish, the d=4 theory contains additional pseudoscalar states, which are either present in the low-energy theory as physical, light states, or are eaten by (would-be massless) gauge bosons. We show that the pseudoscalars ensure that global anomalies of the four-dimensional dual satisfy the 't Hooft matching condition and comment on the relevance for warped models of electroweak symmetry breaking.

  9. Sketch-Based Anomalies Detection with IP Address Traceability%基于概要数据结构可溯源的异常检测方法

    Institute of Scientific and Technical Information of China (English)

    罗娜; 李爱平; 吴泉源; 陆华彪

    2009-01-01

    提出一种基于sketch概要数据结构的异常检测方法.该方法实时记录网络数据流信息到sketch数据结构,然后每隔一定周期进行异常检测.采用EWMA(exponentially weighted moving average)预测模型预测每一周期的预测值,计算观测值与预测值之间的差异sketch,然后基于差异sketch采用均值均方差模型建立网络流量变化参考.该方法能够检测DDoS、扫描等攻击行为,并能追溯异常的IP地址.通过模拟实验验证,该方法占用很少的计算和存储资源,能够检测骨干网络流量中的异常IP地址.%In this paper, an anomaly detection method is proposed based on the summary data structure-sketch. It records the network traffic information in sketch online and detects anomalies at every circle. After using EWMA forecasting model to get each circle's forecast sketch, this paper computes the errors between the recoded sketch and forecast sketch. Then, the network traffic change reference is constructed by establishing the Mean-Standard deviation model on the error sketch. The method is effective in detecting DDOS attack, scan attack and so on. Particularly, it can track the IP address of anomaly. Evaluated by the experiment, this method can detect anomaly in the backbone network with small computing and memory resource.

  10. 基于小波的网络流量异常分析与仿真%Analysis and Simulation of Network Traffic Anomaly Detection Based on Wavelet

    Institute of Scientific and Technical Information of China (English)

    贾志强

    2012-01-01

    网络流量异常检测及分析是网络及安全管理领域的重要研究内容,文章根据网络流量的信号特性和自相似性,利用小波变换局部放大能力及Hurst和李氏指数的变化与网络流量异常的对应关系,提出了一种基于小波分析的网络流量异常检测与定位方法.根据自相似指数的值在大时间尺度上来判定异常发生,并进一步在小时间尺度下基于李氏指数与信号奇异性的对应关系来分析并定位异常点.此方法通过DipSIF平台所采集的数据进行仿真验证,可有效地检测网络流量异常并定位异常发生点,与传统方法相比,异常检测的有效率更高.%Traffic anomaly detection and analysis of network is the important research of the network and security management. The paper introduces a method of based on wavelet analysis of network traffic anomaly detection and localization according to signal characteristic and self-similarity characteristic of the network traffic, which makes use of transform and local amplication of the wavelet and the correspondence between the change of Hurst & Lipschitz index with thenetwork traffic anomaly. It decides that wheather abnormal traffic has happened according to the change of sel-similar Hurst index on large time scales, and further makes use of the correspondence between Lipschitz index with the singularity of signal in small time scales to analyze the anomaly point, and then locates the points that network traffic anomaly occured. It is verified by simulated experiment with the data collected by DipSIF platform, which can effectively detect and locate the abnormal network traffic points that anomaly occurred. Comparing with traditional methods, it is more efficient.

  11. Urinary System anomalies at birth

    Directory of Open Access Journals (Sweden)

    Sharada B. Menasinkai

    2015-06-01

    Full Text Available Background: Congenital anomalies of urinary system are common and are found in 3-4% of population, and lethal urinary anomalies account for 10% of termination of pregnancy. Methods: A study was done to know the incidence of congenital anomalies at birth for the period of 4 months from May 99 - Sept 99 at Cheluvamba hospital attached to Mysore medical college. Congenital anomalies in the still births, live births and aborted fetuses >20 weeks were studied along with the case history and ultrasound reports. Aborted fetuses and still born babies were collected for autopsy after the consent of parents. These babies were fixed in 10% formalin and autopsy was done after fixing, and anomalies were noted. Results: Total births during study period were 3000. There were 61 babies with congenital anomalies and 6 babies had anomalies of urinary system. Among the urinary system anomalies 1 baby had bilateral renal agenesis, 1 baby had unilateral renal agenesis with anophthalmia (Fraser syndrome, 2 babies had Multicystic dysplastic kidney disease (MCDK and 1 live baby had hydronephrosis due to obstruction at pelvi ureteric junction, and 1 live female baby had polycystic kidneys. Conclusion: Incidence of urinary system anomalies in the present study was 2 per 1000 births. U/S detection of urinary anomalies varies with period of gestation, amniotic fluid volume and visualisation of urinary bladder. Autopsy helps to detect renal agenesis. [Int J Res Med Sci 2015; 3(3.000: 743-748

  12. SADM potentiometer anomaly investigations

    Science.gov (United States)

    Wood, Brian; Mussett, David; Cattaldo, Olivier; Rohr, Thomas

    2005-07-01

    During the last 3 years Contraves Space have been developing a Low Power (1-2kW) Solar Array Drive Mechanism (SADM) aimed at small series production. The mechanism was subjected to two test programmes in order to qualify the SADM to acceptable levels. During the two test programmes, anomalies were experienced with the Potentiometers provided by Eurofarad SA and joint investigations were undertaken to resolve why these anomalies had occurred. This paper deals with the lessons learnt from the failure investigation on the two Eurofarad (rotary) Potentiometer anomaly. The Rotary Potentiometers that were used were fully redundant; using two back to back mounted "plastic tracks". It is a pancake configuration mounted directly to the shaft of the Slip Ring Assembly at the extreme in-board end of the SADM. It has no internal bearings. The anomaly initially manifested itself as a loss of performance in terms of linearity, which was first detected during Thermal Vacuum testing. A subsequent anomaly manifested itself by the complete failure of the redundant potentiometer again during thermal vacuum testing. This paper will follow and detail the chain of events following this anomaly and identifies corrective measures to be applied to the potentiometer design and assembly process.

  13. Survey of prenatal screening policies in Europe for structural malformations and chromosome anomalies, and their impact on detection and termination rates for neural tube defects and Down's syndrome

    DEFF Research Database (Denmark)

    Boyd, P A; Devigan, C; Khoshnood, B

    2008-01-01

    screening policies in 18 countries and 1.13 million births in 12 countries in 2002-04. METHODS: (i) Questionnaire on national screening policies and termination of pregnancy for fetal anomaly (TOPFA) laws in 2004. (ii) Analysis of data on prenatal detection and termination for Down's syndrome and neural...... tube defects (NTDs) using the EUROCAT database. MAIN OUTCOME MEASURES: Existence of national prenatal screening policies, legal gestation limit for TOPFA, prenatal detection and termination rates for Down's syndrome and NTD. RESULTS: Ten of the 18 countries had a national country-wide policy for Down...

  14. Early India-Australia spreading history revealed by newly detected Mesozoic magnetic anomalies in the Perth Abyssal Plain

    Science.gov (United States)

    Williams, Simon E.; Whittaker, Joanne M.; Granot, Roi; Müller, Dietmar R.

    2013-07-01

    seafloor within the Perth Abyssal Plain (PAP), offshore Western Australia, is the only section of crust that directly records the early spreading history between India and Australia during the Mesozoic breakup of Gondwana. However, this early spreading has been poorly constrained due to an absence of data, including marine magnetic anomalies and data constraining the crustal nature of key tectonic features. Here, we present new magnetic anomaly data from the PAP that shows that the crust in the western part of the basin was part of the Indian Plate—the conjugate flank to the oceanic crust immediately offshore the Perth margin, Australia. We identify a sequence of M2 and older anomalies in the west PAP within crust that initially moved with the Indian Plate, formed at intermediate half-spreading rates (35 mm/yr) consistent with the conjugate sequence on the Australian Plate. More speculatively, we reinterpret the youngest anomalies in the east PAP, finding that the M0-age crust initially formed on the Indian Plate was transferred to the Australian Plate by a westward jump or propagation of the spreading ridge shortly after M0 time. Samples dredged from the Gulden Draak and Batavia Knolls (at the western edge of the PAP) reveal that these bathymetric features are continental fragments rather than igneous plateaus related to Broken Ridge. These microcontinents rifted away from Australia with Greater India during initial breakup at ~130 Ma, then rifted from India following the cessation of spreading in the PAP (~101-103 Ma).

  15. A comparison of classical and intelligent methods to detect potential thermal anomalies before the 11 August 2012 Varzeghan, Iran, earthquake (Mw = 6.4)

    Science.gov (United States)

    Akhoondzadeh, M.

    2013-04-01

    In this paper, a number of classical and intelligent methods, including interquartile, autoregressive integrated moving average (ARIMA), artificial neural network (ANN) and support vector machine (SVM), have been proposed to quantify potential thermal anomalies around the time of the 11 August 2012 Varzeghan, Iran, earthquake (Mw = 6.4). The duration of the data set, which is comprised of Aqua-MODIS land surface temperature (LST) night-time snapshot images, is 62 days. In order to quantify variations of LST data obtained from satellite images, the air temperature (AT) data derived from the meteorological station close to the earthquake epicenter has been taken into account. For the models examined here, results indicate the following: (i) ARIMA models, which are the most widely used in the time series community for short-term forecasting, are quickly and easily implemented, and can efficiently act through linear solutions. (ii) A multilayer perceptron (MLP) feed-forward neural network can be a suitable non-parametric method to detect the anomalous changes of a non-linear time series such as variations of LST. (iii) Since SVMs are often used due to their many advantages for classification and regression tasks, it can be shown that, if the difference between the predicted value using the SVM method and the observed value exceeds the pre-defined threshold value, then the observed value could be regarded as an anomaly. (iv) ANN and SVM methods could be powerful tools in modeling complex phenomena such as earthquake precursor time series where we may not know what the underlying data generating process is. There is good agreement in the results obtained from the different methods for quantifying potential anomalies in a given LST time series. This paper indicates that the detection of the potential thermal anomalies derive credibility from the overall efficiencies and potentialities of the four integrated methods.

  16. Contribution of ground surface altitude difference to thermal anomaly detection using satellite images: Application to volcanic/geothermal complexes in the Andes of Central Chile

    Science.gov (United States)

    Gutiérrez, Francisco J.; Lemus, Martín; Parada, Miguel A.; Benavente, Oscar M.; Aguilera, Felipe A.

    2012-09-01

    Detection of thermal anomalies in volcanic-geothermal areas using remote sensing methodologies requires the subtraction of temperatures, not provided by geothermal manifestations (e.g. hot springs, fumaroles, active craters), from satellite image kinetic temperature, which is assumed to correspond to the ground surface temperature. Temperatures that have been subtracted in current models include those derived from the atmospheric transmittance, reflectance of the Earth's surface (albedo), topography effect, thermal inertia and geographic position effect. We propose a model that includes a new parameter (K) that accounts for the variation of temperature with ground surface altitude difference in areas where steep relief exists. The proposed model was developed and applied, using ASTER satellite images, in two Andean volcanic/geothermal complexes (Descabezado Grande-Cerro Azul Volcanic Complex and Planchón-Peteroa-Azufre Volcanic Complex) where field data of atmosphere and ground surface temperature as well as radiation for albedo calibration were obtained in 10 selected sites. The study area was divided into three zones (Northern, Central and Southern zones) where the thermal anomalies were obtained independently. K value calculated for night images of the three zones are better constrained and resulted to be very similar to the Environmental Lapse Rate (ELR) determined for a stable atmosphere (ELR > 7 °C/km). Using the proposed model, numerous thermal anomalies in areas of ≥ 90 m × 90 m were identified that were successfully cross-checked in the field. Night images provide more reliable information for thermal anomaly detection than day images because they record higher temperature contrast between geothermal areas and its surroundings and correspond to more stable atmospheric condition at the time of image acquisition.

  17. Focal skin defect, limb anomalies and microphthalmia.

    NARCIS (Netherlands)

    Jackson, K.E.; Andersson, H.C.

    2004-01-01

    We describe two unrelated female patients with congenital single focal skin defects, unilateral microphthalmia and limb anomalies. Growth and psychomotor development were normal and no brain malformation was detected. Although eye and limb anomalies are commonly associated, clinical anophthalmia and

  18. Impact of low signal intensity assessed by cine magnetic resonance imaging on detection of poorly viable myocardium in patients with prior myocardial infarction.

    Science.gov (United States)

    Ota, Shingo; Tanimoto, Takashi; Orii, Makoto; Hirata, Kumiko; Shiono, Yasutsugu; Shimamura, Kunihiro; Matsuo, Yoshiki; Yamano, Takashi; Ino, Yasushi; Kitabata, Hironori; Yamaguchi, Tomoyuki; Kubo, Takashi; Tanaka, Atsushi; Imanishi, Toshio; Akasaka, Takashi

    2015-05-13

    Late gadolinium enhancement magnetic resonance imaging (LGE-MRI) has been established as a modality to detect myocardial infarction (MI). However, the use of gadolinium contrast is limited in patients with advanced renal dysfunction. Although the signal intensity (SI) of infarct area assessed by cine MRI is low in some patients with prior MI, the prevalence and clinical significance of low SI has not been evaluated. The aim of this study was to evaluate how low SI assessed by cine MRI may relate to the myocardial viability in patients with prior MI. Fifty patients with prior MI underwent both cine MRI and LGE-MRI. The left ventricle was divided into 17 segments. The presence of low SI and the wall motion score (WMS) of each segment were assessed by cine MRI. The transmural extent of infarction was evaluated by LGE-MRI. LGE was detected in 329 of all 850 segments (39%). The low SI assessed by cine MRI was detected in 105 of 329 segments with LGE (32%). All segments with low SI had LGE. Of all 329 segments with LGE, the segments with low SI showed greater transmural extent of infarction (78 [72 - 84] % versus 53 [38 - 72] %, P cine MRI may be effective for detecting poorly viable myocardium in patients with prior MI.

  19. Enzyme leaching of surficial geochemical samples for detecting hydromorphic trace-element anomalies associated with precious-metal mineralized bedrock buried beneath glacial overburden in northern Minnesota

    Science.gov (United States)

    Clark, Robert J.; Meier, A.L.; Riddle, G.; ,

    1990-01-01

    One objective of the International Falls and Roseau, Minnesota, CUSMAP projects was to develop a means of conducting regional-scale geochemical surveys in areas where bedrock is buried beneath complex glacially derived overburden. Partial analysis of B-horizon soils offered hope for detecting subtle hydromorphic trace-element dispersion patterns. An enzyme-based partial leach selectively removes metals from oxide coatings on the surfaces of soil materials without attacking their matrix. Most trace-element concentrations in the resulting solutions are in the part-per-trillion to low part-per-billion range, necessitating determinations by inductively coupled plasma/mass spectrometry. The resulting data show greater contrasts for many trace elements than with other techniques tested. Spatially, many trace metal anomalies are locally discontinuous, but anomalous trends within larger areas are apparent. In many instances, the source for an anomaly seems to be either basal till or bedrock. Ground water flow is probably the most important mechanism for transporting metals toward the surface, although ionic diffusion, electrochemical gradients, and capillary action may play a role in anomaly dispersal. Sample sites near the Rainy Lake-Seine River fault zone, a regional shear zone, often have anomalous concentrations of a variety of metals, commonly including Zn and/or one or more metals which substitute for Zn in sphalerite (Cd, Ge, Ga, and Sn). Shifts in background concentrations of Bi, Sb, and As show a trend across the area indicating a possible regional zoning of lode-Au mineralization. Soil anomalies of Ag, Co, and Tl parallel basement structures, suggesting areas that may have potential for Cobalt/Thunder Baytype silver viens. An area around Baudette, Minnesota, which is underlain by quartz-chlorite-carbonate-altered shear zones, is anomalous in Ag, As, Bi, Co, Mo, Te, Tl, and W. Anomalies of Ag, As, Bi, Te, and W tend to follow the fault zones, suggesting potential

  20. Time series analysis of precipitation and vegetation to detect food production anomalies in the Horn of Africa. The case of Lower Shabelle (Somalia

    Directory of Open Access Journals (Sweden)

    M. A. Belenguer-Plomer

    2016-12-01

    Full Text Available The Horn of Africa is one of the most food-insecure locations around the world due to the continuous increase of its population and the practice of the subsistence agriculture. This causes that much of the population cannot take the minimum nutritional needs for a healthy life. Moreover, this situation of food vulnerability may be seriously affected in the coming years due to the effects of climate change. The aim of this work is combine the information about the state of the vegetation that offers the NDVI with rainfall data to detect negative anomalies in food production. This work has been used the monthly products of NDVI MOD13A3 of MODIS and the rainfall estimation product TAMSAT, both during the period 2001-2015. With these products we have calculated the average of the entire time period selected and we have detected the years whose NDVI values were further away from the average, being these 2010, 2011 and 2014. Once detected the years with major anomalies in NDVI, there has been an exclusive monthly analysis of those years, where we have analysed the relationships between the value of NDVI and monthly rainfall, obtaining a direct relationship between the two values. It also has been used crop calendar to focus the analysis in the months of agricultural production and finding that the main cause of anomalies in vegetation is a decrease in the registration of rainfall during the months of agricultural production. This reason explains the origin of the food shortages that occurred in 2010 and 2011 that generated an enormous humanitarian crisis in this area.

  1. Intracardiac Eustachian Valve Cyst in an Adult Detected with Other Cardiac Anomalies: Usefulness of Multidetector CT in Diagnosis

    Energy Technology Data Exchange (ETDEWEB)

    Cho, Hyung Ji; Jung, Jung Im; Kim, Hwan Wook; Lee, Kyo Young [Seoul St. Mary' s Hospital, College of Medicine, The Catholic University of Korea, Seoul (Korea, Republic of)

    2012-07-15

    We present an unusual case of an intracardiac Eustachian valve cyst observed concurrently with atresia of the coronary sinus ostium, a persistent left superior vena cava (LSVC) and a bicuspid aortic valve. There have been several echocardiographic reports of Eustachian valve cysts; however, there is no report of multidetector computed tomography (MDCT) findings related to a Eustachian valve cyst. Recently, we observed a Eustachian valve cyst diagnosed on MDCT showing a hypodense cyst at the characteristic location of the Eustachian valve (the junction of the right atrium and inferior vena cava). MDCT also demonstrated additional cardiovascular anomalies including atresia of the coronary sinus ostium and a persistent LSVC and bicuspid aortic valve.

  2. Fetal renal anomalies : diagnosis, management, and outcome

    NARCIS (Netherlands)

    Damen-Elias, Henrica Antonia Maria

    2004-01-01

    In two to three percent of fetuses structural anomalies can be found with prenatal ultrasound investigation. Anomalies of the urinary tract account for 15 to 20% of these anomalies with a detection rate of approximately of 90%. In Chapter 2, 3 and 4 we present reference curves for size and growth of

  3. Investigation of the collision line broadening problem as applicable to the NASA Optical Plume Anomaly Detection (OPAD) system, phase 1

    Science.gov (United States)

    Dean, Timothy C.; Ventrice, Carl A.

    1995-05-01

    As a final report for phase 1 of the project, the researchers are submitting to the Tennessee Tech Office of Research the following two papers (reprinted in this report): 'Collision Line Broadening Effects on Spectrometric Data from the Optical Plume Anomaly System (OPAD),' presented at the 30th AIAA/ASME/SAE/ASEE Joint Propulsion Conference, 27-29 June 1994, and 'Calculation of Collision Cross Sections for Atomic Line Broadening in the Plume of the Space Shuttle Main Engine (SSME),' presented at the IEEE Southeastcon '95, 26-29 March 1995. These papers fully state the problem and the progress made up to the end of NASA Fiscal Year 1994. The NASA OPAD system was devised to predict concentrations of anomalous species in the plume of the Space Shuttle Main Engine (SSME) through analysis of spectrometric data. The self absorption of the radiation of these plume anomalies is highly dependent on the line shape of the atomic transition of interest. The Collision Line Broadening paper discusses the methods used to predict line shapes of atomic transitions in the environment of a rocket plume. The Voigt profile is used as the line shape factor since both Doppler and collisional line broadening are significant. Methods used to determine the collisional cross sections are discussed and the results are given and compared with experimental data. These collisional cross sections are then incorporated into the current self absorbing radiative model and the predicted spectrum is compared to actual spectral data collected from the Stennis Space Center Diagnostic Test Facility rocket engine. The second paper included in this report investigates an analytical method for determining the cross sections for collision line broadening by molecular perturbers, using effective central force interaction potentials. These cross sections are determined for several atomic species with H2, one of the principal constituents of the SSME plume environment, and compared with experimental data.

  4. 基于数字属性和符号属性混合数据的网络异常入侵检测方法%Network-based anomaly intrusion detection with numeric-and-nominal mixed data

    Institute of Scientific and Technical Information of China (English)

    蔡龙征; 余胜生; 王晓峰; 周敬利

    2006-01-01

    Anomaly detection is a key element of intrusion detection systems and a necessary complement of widely used misuse intrusion detection systems. Data sources used by network intrusion detection, like network packets or connections, often contain both numeric and nominal features. Both of these features contain important information for intrusion detection. These two features, on the other hand, have different characteristics. This paper presents a new network based anomaly intrusion detection approach that works well by building profiles for numeric and nominal features in different ways. During training, for each numeric feature, a normal profile is build through statistical distribution inference and parameter estimation, while for each nominal feature, a normal profile is setup through statistical method. These profiles are used as detection models during testing to judge whether a data being tested is benign or malicious. Experiments with the data set of 1999 DARPA (defense advanced research project agency) intrusion detection evaluation show that this approach can detect attacks effectively.

  5. An Adaptive Network-based Fuzzy Inference System for the detection of thermal and TEC anomalies around the time of the Varzeghan, Iran, (Mw = 6.4) earthquake of 11 August 2012

    Science.gov (United States)

    Akhoondzadeh, M.

    2013-09-01

    Anomaly detection is extremely important for forecasting the date, location and magnitude of an impending earthquake. In this paper, an Adaptive Network-based Fuzzy Inference System (ANFIS) has been proposed to detect the thermal and Total Electron Content (TEC) anomalies around the time of the Varzeghan, Iran, (Mw = 6.4) earthquake jolted in 11 August 2012 NW Iran. ANFIS is the famous hybrid neuro-fuzzy network for modeling the non-linear complex systems. In this study, also the detected thermal and TEC anomalies using the proposed method are compared to the results dealing with the observed anomalies by applying the classical and intelligent methods including Interquartile, Auto-Regressive Integrated Moving Average (ARIMA), Artificial Neural Network (ANN) and Support Vector Machine (SVM) methods. The duration of the dataset which is comprised from Aqua-MODIS Land Surface Temperature (LST) night-time snapshot images and also Global Ionospheric Maps (GIM), is 62 days. It can be shown that, if the difference between the predicted value using the ANFIS method and the observed value, exceeds the pre-defined threshold value, then the observed precursor value in the absence of non seismic effective parameters could be regarded as precursory anomaly. For two precursors of LST and TEC, the ANFIS method shows very good agreement with the other implemented classical and intelligent methods and this indicates that ANFIS is capable of detecting earthquake anomalies. The applied methods detected anomalous occurrences 1 and 2 days before the earthquake. This paper indicates that the detection of the thermal and TEC anomalies derive their credibility from the overall efficiencies and potentialities of the five integrated methods.

  6. 基于PSO-SVM的Modbus TCP通讯的异常检测方法%Modbus/TCP Communication Anomaly Detection Algorithm Based on PSO-SVM

    Institute of Scientific and Technical Information of China (English)

    尚文利; 张盛山; 万明; 曾鹏

    2014-01-01

    To detect and defend industry virus attacks to application layer protocol data is difficult issues in study of industrial security gateway .In this paper ,a data pre-processing method is presented ,which can convert Modbus TCP traffic into anomaly de-tection model ,and a PSO-SVM algorithm is designed ,which optimizes parameters by advanced Particle Swarm Optimization (PSO) algorithm .The method identifies anomalies of Modbus TCP traffic according to appear frequencies of the mode short sequence of Modbus function code sequence .Finally ,experimental data analysis shows that the proposed method can effectively detect abnormal of Modbus function code sequence .%如何有效检测和防御工业病毒对应用层协议数据的攻击是目前工业安全网关研究的难点问题。本文提出了将Modbus TCP通讯流量转换为异常检测模型所需数据形式的预处理方法,设计了一种利用粒子群PSO算法进行参数寻优的PSO-SVM算法。该方法根据Modbus功能码序列中的模式短序列出现的频率,识别出异常的Modbus TCP通讯流量。最后,通过实验数据分析,说明了提出方法可以有效实现对Modbus功能码序列的异常检测。

  7. Concept for Inclusion of Analytical and Computational Capability in Optical Plume Anomaly Detection (OPAD) for Measurement of Neutron Flux

    Science.gov (United States)

    Patrick, Marshall Clint; Cooper, Anita E.; Powers, W. T.

    2004-01-01

    Researchers are working on many fronts to make possible high-speed, automated classification and quantification of constituent materials in numerous environments. NASA's Marshall Space Flight Center has implemented a system for rocket engine flowfields/plumes. The Optical Plume Anomaly Detector (OPAD) system was designed to utilize emission and absorption spectroscopy for monitoring molecular and atomic particulates in gas plasma. An accompanying suite of tools and analytical package designed to utilize information collected by OPAD is known as the Engine Diagnostic Filtering System (EDiFiS). The current combination of these systems identifies atomic and molecular species and quantifies mass loss rates in H2/O2 rocket plumes. Capabilities for real-time processing are being advanced on several fronts, including an effort to hardware encode components of the EDiFiS for health monitoring and management. This paper addresses the OPAD with its tool suites, and discusses what is considered a natural progression: a concept for taking OPAD to the next logical level of high energy physics, incorporating fermion and boson particle analyses in measurement of neutron flux.

  8. Using memory for prior aircraft events to detect conflicts under conditions of proactive air traffic control and with concurrent task requirements.

    Science.gov (United States)

    Bowden, Vanessa K; Loft, Shayne

    2016-06-01

    In 2 experiments we examined the impact of memory for prior events on conflict detection in simulated air traffic control under conditions where individuals proactively controlled aircraft and completed concurrent tasks. Individuals were faster to detect conflicts that had repeatedly been presented during training (positive transfer). Bayesian statistics indicated strong evidence for the null hypothesis that conflict detection was not impaired for events that resembled an aircraft pair that had repeatedly come close to conflicting during training. This is likely because aircraft altitude (the feature manipulated between training and test) was attended to by participants when proactively controlling aircraft. In contrast, a minor change to the relative position of a repeated nonconflicting aircraft pair moderately impaired conflict detection (negative transfer). There was strong evidence for the null hypothesis that positive transfer was not impacted by dividing participant attention, which suggests that part of the information retrieved regarding prior aircraft events was perceptual (the new aircraft pair "looked" like a conflict based on familiarity). These findings extend the effects previously reported by Loft, Humphreys, and Neal (2004), answering the recent strong and unanimous calls across the psychological science discipline to formally establish the robustness and generality of previously published effects. (PsycINFO Database Record

  9. The Pioneer Anomaly

    Directory of Open Access Journals (Sweden)

    Viktor T. Toth

    2010-09-01

    Full Text Available Radio-metric Doppler tracking data received from the Pioneer 10 and 11 spacecraft from heliocentric distances of 20-70 AU has consistently indicated the presence of a small, anomalous, blue-shifted frequency drift uniformly changing with a rate of ~6 × 10–9 Hz/s. Ultimately, the drift was interpreted as a constant sunward deceleration of each particular spacecraft at the level of aP = (8.74 ± 1.33 × 10–10 m/s2. This apparent violation of the Newton's gravitational inverse square law has become known as the Pioneer anomaly; the nature of this anomaly remains unexplained. In this review, we summarize the current knowledge of the physical properties of the anomaly and the conditions that led to its detection and characterization. We review various mechanisms proposed to explain the anomaly and discuss the current state of efforts to determine its nature. A comprehensive new investigation of the anomalous behavior of the two Pioneers has begun recently. The new efforts rely on the much-extended set of radio-metric Doppler data for both spacecraft in conjunction with the newly available complete record of their telemetry files and a large archive of original project documentation. As the new study is yet to report its findings, this review provides the necessary background for the new results to appear in the near future. In particular, we provide a significant amount of information on the design, operations and behavior of the two Pioneers during their entire missions, including descriptions of various data formats and techniques used for their navigation and radio-science data analysis. As most of this information was recovered relatively recently, it was not used in the previous studies of the Pioneer anomaly, but it is critical for the new investigation.

  10. Usefulness of 40-slice multidetector row computed tomography to detect coronary disease in patients prior to cardiac valve surgery

    Energy Technology Data Exchange (ETDEWEB)

    Pouleur, Anne-Catherine; Polain de Waroux, Jean-Benoit le; Kefer, Joelle; Pasquet, Agnes; Vanoverschelde, Jean-Louis; Gerber, Bernhard L. [Cliniques Universitaires St. Luc UCL, Cardiology Division, Woluwe St. Lambert (Belgium); Coche, Emmanuel [Cliniques Universitaires St. Luc UCL, Radiology Division, Woluwe St. Lambert (Belgium)

    2007-12-15

    Preoperative identification of significant coronary artery disease (CAD) in patients prior to valve surgery requires systematic invasive coronary angiography. The purpose of this current prospective study was to evaluate whether exclusion of CAD by multi-detector CT (MDCT) might potentially avoid systematic cardiac catheterization in these patients. Eighty-two patients (53 males, 62 {+-} 13 years) scheduled to undergo valve surgery underwent 40-slice MDCT before invasive quantitative coronary angiography (QCA). According to QCA, 15 patients had CAD (5 one-vessel, 6 two-vessel and 4 three-vessel disease). The remaining 67 patients had no CAD. On a per-vessel basis, MDCT correctly identified 27/29 (sensitivity 93%) vessels with and excluded 277/299 vessels (specificity 93%) without CAD. On a per-patient basis, MDCT correctly identified 14/15 patients with (sensitivity 93%) and 60/67 patients without CAD (specificity 90%). Positive and negative predictive values of MDCT were 67% and 98%. Performing invasive angiography only in patients with abnormal MDCT might have avoided QCA in 60/82 (73%). MDCT could be potentially useful in the preoperative evaluation of patients with valve disease. By selecting only those patients with coronary lesions to undergo invasive coronary angiography, it could avoid cardiac catheterization in a large number of patients without CAD. (orig.)

  11. Usefulness of 40-slice multidetector row computed tomography to detect coronary disease in patients prior to cardiac valve surgery.

    Science.gov (United States)

    Pouleur, Anne-Catherine; le Polain de Waroux, Jean-Benoît; Kefer, Joëlle; Pasquet, Agnès; Coche, Emmanuel; Vanoverschelde, Jean-Louis; Gerber, Bernhard L

    2007-12-01

    Preoperative identification of significant coronary artery disease (CAD) in patients prior to valve surgery requires systematic invasive coronary angiography. The purpose of this current prospective study was to evaluate whether exclusion of CAD by multi-detector CT (MDCT) might potentially avoid systematic cardiac catheterization in these patients. Eighty-two patients (53 males, 62 +/- 13 years) scheduled to undergo valve surgery underwent 40-slice MDCT before invasive quantitative coronary angiography (QCA). According to QCA, 15 patients had CAD (5 one-vessel, 6 two-vessel and 4 three-vessel disease). The remaining 67 patients had no CAD. On a per-vessel basis, MDCT correctly identified 27/29 (sensitivity 93%) vessels with and excluded 277/299 vessels (specificity 93%) without CAD. On a per-patient basis, MDCT correctly identified 14/15 patients with (sensitivity 93%) and 60/67 patients without CAD (specificity 90%). Positive and negative predictive values of MDCT were 67% and 98%. Performing invasive angiography only in patients with abnormal MDCT might have avoided QCA in 60/82 (73%). MDCT could be potentially useful in the preoperative evaluation of patients with valve disease. By selecting only those patients with coronary lesions to undergo invasive coronary angiography, it could avoid cardiac catheterization in a large number of patients without CAD.

  12. Minor Physical Anomalies, Footprints, and Behavior: Was the Buddha Right?

    Science.gov (United States)

    Draper, Thomas W.; Munoz, Milagros M.

    1982-01-01

    A relationship between an anomaly of the footprint suggested by ancient Abhidhamma meditations and Minor Physical Anomalies Scale was observed in children. The footprint anomalies correlated with the activity levels of children in the same way as the scores on the scale and consistently with prior research using the scale. (Author/RD)

  13. Anomaly Structure of Supergravity and Anomaly Cancellation

    CERN Document Server

    Butter, Daniel

    2009-01-01

    We display the full anomaly structure of supergravity, including new D-term contributions to the conformal anomaly. This expression has the super-Weyl and chiral U(1)_K transformation properties that are required for implementation of the Green-Schwarz mechanism for anomaly cancellation. We outline the procedure for full anomaly cancellation. Our results have implications for effective supergravity theories from the weakly coupled heterotic string theory.

  14. 基于频繁模式的KPI异常检测研究%Research on anomaly detection of KPI based on frequent patterns

    Institute of Scientific and Technical Information of China (English)

    纪勇

    2016-01-01

    Aiming at the current TD-SCDMA network acquisition network key performance indicators (KPIs), this paper used frequent pattern mining method, focused on the analysis of correlation between off rate, wireless call completion rate and congestion rate. Frequent pattern deifnition was considered as the normal mode to carry out anomaly mode detection. This way not only effectively detected unusual combination of network, but also reflected the correlation between parameters, which played an effective guiding role in fast online detection.%文章针对TD-SCDMA现网采集的网络关键绩效指标(Key Performance Indicator,KPI),,利用频繁模式挖掘的方法,重点分析掉话率、无线接通率、拥塞率等之间的关联性。将频繁模式项定义为正常模式,以此进行异常模式检测。这样的方式不仅有效地检测了网络存在的异常组合,也反映了参数之间的关联性,对快速在线检测起到了有效的指导作用。

  15. Ready for a fight? The physiological effects of detecting an opponent's pheromone cues prior to a contest.

    Science.gov (United States)

    Garcia, Mark J; Williams, John; Sinderman, Benjamin; Earley, Ryan L

    2015-10-01

    Reception of pheromone cues can elicit significant physiological (e.g. steroid hormone levels) changes in the recipient. These pheromone-induced physiological changes have been well documented for male-female interactions, but scarcely in same-sex interactions (male-male and female-female). We sought to address this dearth in the current literature and examine whether mangrove rivulus fish (Kryptolebias marmoratus) could detect and, ultimately, mount a physiological response to the pheromone signature of a potential, same-sex competitor. We examined steroid hormone levels in mangrove rivulus exposed to one of three treatments: 1) isolation, 2) exposure to pheromones of a size-matched partner, and 3) pheromone exposure to a size-matched opponent followed by a physical encounter with the opponent. We found that exposure to a competitor's pheromone cues elicited a significant increase in testosterone levels. Increases in testosterone were similar across genetically distinct lineages derived from geographically distinct populations. Further, testosterone levels were similar between individuals only exposed to pheromone cues and individuals exposed to both pheromone cues and a subsequent physical encounter. Our findings led us to generate a number of testable predictions regarding how mangrove rivulus utilize pheromone signals in social interactions, the molecular mechanisms linking social stimuli and hormonal responses, and the possible adaptive benefits of hormonal responsiveness to receiving a potential competitor's pheromone cues.

  16. 基于协同神经网络的网络流量异常检测%Network traffic anomaly detection based on synergetic neural network

    Institute of Scientific and Technical Information of China (English)

    马卫; 熊伟

    2012-01-01

    For network traffic with complex dynamics characteristic, a method is proposed for network traffic anomaly detection, which based on a top-down synergetic neural network. First select the datasets that contain normal network traffic and abnormal attack traffic as a prototype pattern, and then calculate order parameter by synergetic neural network. Finally the detection result is obtained according to the evolution result of the order parameter corresponding to the prototype pattern in the end. Experimental results show that this method can effectively identify normal traffic and types of abnormal attacks.%针对网络流量具有复杂的动力学特性,提出了一种应用自上而下的协同神经网络进行网络流量异常检测的方法.首先选择包含正常网络流量和异常攻击流量的数据集作为原型模式,然后通过协同神经网络进行序参量的动力演化,最终根据原型模式对应的序参量的演化结果来判定检测结果.实验结果证明,该方法能有效的识别出正常流量和异常攻击的种类.

  17. Seismic Monitoring Prior to and During DFDP-2 Drilling, Alpine Fault, New Zealand: Matched-Filter Detection Testing and the Real-Time Monitoring System

    Science.gov (United States)

    Boese, C. M.; Chamberlain, C. J.; Townend, J.

    2015-12-01

    In preparation for the second stage of the Deep Fault Drilling Project (DFDP) and as part of related research projects, borehole and surface seismic stations were installed near the intended DFDP-2 drill-site in the Whataroa Valley from late 2008. The final four borehole stations were installed within 1.2 km of the drill-site in early 2013 to provide near-field observations of any seismicity that occurred during drilling and thus provide input into operational decision-making processes if required. The basis for making operational decisions in response to any detected seismicity had been established as part of a safety review conducted in early 2014 and was implemented using a "traffic light" system, a communications plan, and other operational documents. Continuous real-time earthquake monitoring took place throughout the drilling period, between September and late December 2014, and involved a team of up to 15 seismologists working in shifts near the drill-site and overseas. Prior to drilling, records from 55 local earthquakes and 14 quarry blasts were used as master templates in a matched-filter detection algorithm to test the capabilities of the seismic network for detecting seismicity near the drill site. The newly detected microseismicity was clustered near the DFDP-1 drill site at Gaunt Creek, 7.4 km southwest of DFDP-2. Relocations of these detected events provide more information about the fault geometry in this area. Although no detectable seismicity occurred within 5 km of the drill site during the drilling period, the region is capable of generating earthquakes that would have required an operational response had they occurred while drilling was underway (including a M2.9 event northwest of Gaunt Creek on 15 August 2014). The largest event to occur while drilling was underway was of M4.5 and occurred approximately 40 km east of the DFDP-2 drill site. In this presentation, we summarize the setup and operations of the seismic network and discuss key

  18. 工业过程异常检测、寿命预测与维修决策的研究进展%A Survey on Anomaly Detection, Life Prediction and Maintenance Decision for Industrial Processes

    Institute of Scientific and Technical Information of China (English)

    周东华; 魏慕恒; 司小胜

    2013-01-01

    作为保障工业过程安全性、可靠性和经济性的重要技术,异常检测、寿命预测与维修决策在过去几十年得到了越来越广泛的关注和长足的发展.本文结合异常检测、寿命预测与维修决策各研究环节之间的相互联系,综述了异常检测、寿命预测与维修决策的联合研究现状,重点总结了异常检测与寿命预测、异常检测与维修决策、寿命预测与维修决策、维修决策与备件管理的联合研究动态.最后,探讨了该领域中存在的问题及未来的研究方向.%The past decades have witnessed an increasingly growing research interest and significant progress on various aspects of anomaly detection,life prediction,and maintenance decision.In this paper,according to the linkages among anomaly detection,life prediction,and maintenance decision,the state of the art of the integrated studies of anomaly detection,life prediction,and maintenance decision are reviewed and the potential issues needed to be solved are highlighted.Particularly,the emphasis is placed on the development of integrated anomaly detection and life prediction,integrated anomaly detection and maintenance decision,integrated life prediction and maintenance decision,and integrated maintenance decision and spare parts ordering.Finally,the unsolved problems and future research directions in the reviewed field are discussed.

  19. Experimental evidence for spring and autumn windows for the detection of geobotanical anomalies through the remote sensing of overlying vegetation

    Science.gov (United States)

    Labovitz, M. L.; Masuoka, E. J.; Bell, R.; Nelson, R. F.; Larsen, C. A.; Hooker, L. K.; Troensegaard, K. W.

    1985-01-01

    It is pointed out that in many regions of the world, vegetation is the predominant factor influencing variation in reflected energy in the 0.4-2.5 micron region of the spectrum. Studies have, therefore, been conducted regarding the utility of remote sensing for detecting changes in vegetation which could be related to the presence of mineralization. The present paper provides primarily a report on the results of the second year of a multiyear study of geobotanical-remote-sensing relationships as developed over areas of sulfide mineralization. The field study has a strong experimental design basis. It is proceeded by first delineating the boundaries of a large geographic region which satisfied a set of previously enumerated field-site criteria. Within this region, carefully selected pairs of mineralized and nonmineralized test sites were examined over the growing season. The experiment is to provide information about the spectral and temporal resolutions required for remote-sensing-geobotanical exploration. The obtained results are evaluated.

  20. Chiral anomalies and differential geometry

    Energy Technology Data Exchange (ETDEWEB)

    Zumino, B.

    1983-10-01

    Some properties of chiral anomalies are described from a geometric point of view. Topics include chiral anomalies and differential forms, transformation properties of the anomalies, identification and use of the anomalies, and normalization of the anomalies. 22 references. (WHK)

  1. A HOST ANOMALY DETECTION METHOD BASED ON LDA MODEL%基于LDA模型的主机异常检测方法

    Institute of Scientific and Technical Information of China (English)

    贺喜; 蒋建春; 丁丽萍; 王永吉; 廖晓峰

    2012-01-01

    基于系统调用序列的入侵检测是分析主机系统调用数据进而发现入侵的一种安全检测技术,其关键技术是如何能够更准确地抽取系统调用序列的特征,并进行分类.为此,引进LDA( Latent Dirichlet Allocation )文本挖掘模型构建新的入侵检测分类算法.该方法将系统调用短序列视为word,利用LDA模型提取进程系统调用序列的主题特征,并结合系统调用频率特征,运用kNN(k-Nearest Neighbor)分类算法进行异常检测.针对DAPRA数据集的实验结果表明,该方法提高了入侵检测的准确度,降低了误报率.%The technique of intrusion detection based on sequence of host system call is a security detection technique mainly focusing on analysing the data set of host system call and further finding the intrusion. Its key technology relies on how to extract the characteristics of system call sequence more accurately and then followed by classification. In this paper, aiming at this, LDA (Latent Dirichlet Allocation) text mining model is introduced to build a new intrusion detection classification algorithm. In this method, topic characteristics of system call sequence are extracted using LDA model which the short sequence of system call is regarded by the method as word. Combined with the frequency characteristics of system calls, kNN (k-Nearest Neighbor) classification algorithm is used for anomaly detection. Experiment is evaluated on 1998 DAPRA data set, the result shows that the method improves the accuracy of intrusion detection, and reduces the false alarm rate.

  2. Dendritic cell algorithm for time series oriented anomaly detection%面向异常检测的时间序列树突状细胞算法

    Institute of Scientific and Technical Information of China (English)

    田玉玲

    2014-01-01

    Aiming at the fact that the high randomness existing in definitions of signals and the antigen results in the lower detection rate used by the Dendritic Cell Algorithm,the Dendritic Cell Algorithm for anomaly detection based on time series is proposed.The underlying methodology is to perform antigen detection via the change point detection and multiple data streams correlation analysis,and the change point data reflecting the mutation status as the candidate solution of the abnormal is selected.Features are extracted based on the subspace tracker algorithm and various input signal subspaces are obtained and classified precisely. A dynamic migration threshold is incorporated into the context evaluation of the algorithm.The accumulation of the antigen assessment in a certain window time decreases the false positive rate effectively.Simulation demonstrates that the algorithm shows a better performance on the detection rate,accuracy rate and stability with less memory space and computing resource.%针对树突状细胞算法中信号及参数的定义存在高度随机性,导致检测率较低的问题,提出了一种时间序列数据的异常检测树突状细胞算法。采用多维数据流相关性分析和变化点检测方法对抗原进行检测,遴选出能够反映突变状态的关键点数据作为异常活动候选解;基于变化点子空间追踪算法提取特征集,准确地获取及分类各种输入信号子空间;在算法的上下文评估中加入动态迁移阈值的概念,累积一定窗口时间内的抗原评估,有效地减少了误判率。通过仿真实验证明该算法能够利用更少的存储空间和计算资源,有效地提高异常检测的检测率与准确率,具有更高的稳定性。

  3. Event-Driven Collaboration through Publish/Subscribe Messaging Services for Near-Real- Time Environmental Sensor Anomaly Detection and Management

    Science.gov (United States)

    Liu, Y.; Downey, S.; Minsker, B.; Myers, J. D.; Wentling, T.; Marini, L.

    2006-12-01

    One of the challenges in designing cyberinfrastructure for national environmental observatories is how to provide integrated cyberenvironment which not only provides a standardized pipeline for streaming data from sensors into the observatory for archiving and distribution, but also makes raw data and identified events available in real-time for use in individual and group research efforts. This aspect of observatories is critical for promoting efficient collaboration and innovation among scientists and engineers and enabling observatories to serve as a focus that directly supports the broad community. The National Center for Supercomputing Applications' Environmental Cyberinfrastructure Demo (ECID) project has adopted an event-driven architecture and developed a CyberCollaboratory to facilitate event-driven, near-real-time collaboration and management of sensors and workflows for bringing data from environmental observatories into local research contexts. The CyberCollaboratory's event broker uses publish-subscribe service powered by JMS (Java Messaging Service) with semantics-enhanced messages using RDF (Resource Description Framework) triples to allow exchange of contextual information about the event between the event generators and the event consumers. Non-scheduled, event-driven collaboration effectively reduces the barrier to collaboration for scientists and engineers and promotes much faster turn-around time for critical environmental events. This is especially useful for real-time adaptive monitoring and modeling of sensor data in environmental observatories. In this presentation, we illustrate our system using a sensor anomaly detection event as an example where near-real- time data streams from field sensor in Corpus Christi Bay, Texas, trigger monitoring/anomaly alerts in the CyberCollaboratory's CyberDashboard and collaborative activities in the CyberCollaboratory. The CyberDashboard is a Java application where users can monitor various events

  4. Path scanning for the detection of anomalous subgraphs and use of DNS requests and host agents for anomaly/change detection and network situational awareness

    Energy Technology Data Exchange (ETDEWEB)

    Neil, Joshua Charles; Fisk, Michael Edward; Brugh, Alexander William; Hash, Jr., Curtis Lee; Storlie, Curtis Byron; Uphoff, Benjamin; Kent, Alexander

    2017-01-31

    A system, apparatus, computer-readable medium, and computer-implemented method are provided for detecting anomalous behavior in a network. Historical parameters of the network are determined in order to determine normal activity levels. A plurality of paths in the network are enumerated as part of a graph representing the network, where each computing system in the network may be a node in the graph and the sequence of connections between two computing systems may be a directed edge in the graph. A statistical model is applied to the plurality of paths in the graph on a sliding window basis to detect anomalous behavior. Data collected by a Unified Host Collection Agent ("UHCA") may also be used to detect anomalous behavior.

  5. Wavelet Analysis-Based Real-Time Anomaly Detection Algorithm for Wireless Sensor Network%基于小波分析的无线传感网实时异常检测算法

    Institute of Scientific and Technical Information of China (English)

    李致远; 朱求志; 吴永焜; 唐振宇; 胡华明

    2014-01-01

    Anomaly detection can detect new and unknown attacks,which has great significance on the wireless sensor networks security. Nowadays,the proposed anomaly detection schemes has poor real-time,high false positive rate and the large amount of computational overhead, and hence the schemes are not suitable for wireless sensor networks. In this paper,a wavelet analysis-based real-time anomaly detection ( Wavelet Analysis-based Real-time Anomaly Detection, WARAD) algorithm for wireless sensor network is proposed. Throughout the detecting process, the WARAD algorithm reversely collects the real-time network traffic,and then uses the variance of the wavelet coefficients in the small-scale interval to compute the Hurst values,which can improve the real-time and the accuracy of anomaly detection,and reduce the computational complexity of solving the Hurst values. Finally,the WARAD algorithm-based intrusion detection system is implemented on the platform of MeshIDE. The experimental results showed that the proposed algorithm greatly improved the real-time of anomaly detection for wireless sensor networks,and reduced the false positive rate and the false negative rate of anomaly detection.%异常检测技术能够检测到未知攻击,对于保障无线传感器网络安全具有重要意义。当前的异常检测技术实时性差,误报率高且计算量大,因此,无法直接应用在无线传感器网络中。鉴于此,提出基于小波分析的实时无线传感网异常检测( Wavelet Analysis-Based Real-time Anomaly Detection,WARAD)算法。在整个检测过程中, WARAD算法采用了逆向获取实时网络流量,然后通过对小尺度区间使用小波系数方差法计算Hurst值,从而提高异常检测的实时性、准确率,并降低求解Hurst值的运算复杂度。最后,在MeshIDE平台上实现了基于WARAD算法的异常检测系统,实验结果表明此算法极大地提高了无线传感网环境下异常检测的实时性,并降低了异常检测的误报率和漏报率。

  6. Determination of treosulfan in plasma and urine by HPLC with refractometric detection; pharmacokinetic studies in children undergoing myeloablative treatment prior to haematopoietic stem cell transplantation.

    Science.gov (United States)

    Główka, Franciszek K; Łada, Marta Karaźniewicz; Grund, Grzegorz; Wachowiak, Jacek

    2007-05-01

    A direct and selective HPLC method with refractometric detection was worked out for determination of treosulfan in plasma and urine of children. Before injection onto reverse phase column plasma samples with treosulfan and barbital (I.S.) were clarified using filtration. The mobile phase was composed of phosphate buffer, pH 5 and acetonitrile. The linear range of the standard curve of treosulfan spanned concentrations of 10.0-2000.0 microg/ml and 50.0-10000.0 microg/ml in plasma and urine, respectively, and covered the levels found in biological fluids after infusion of the drug. The limit of detection amounted to 5 microg/ml for plasma and 25 microg/ml for urine. Intra- and inter-day precision and accuracy of the measurement fulfilled analytical criteria accepted in pharmacokinetic studies. Recovery of treosulfan as well as stability in biological fluids was also calculated. The validated method was successfully applied in pharmacokinetic studies of treosulfan administered to children prior to haematopoietic stem cell transplantation. Differences between pharmacokinetics of treosulfan in children and adults were also studied.

  7. Considerations in the Interpretation of Cosmological Anomalies

    CERN Document Server

    Peiris, Hiranya V

    2014-01-01

    Anomalies drive scientific discovery -- they are associated with the cutting edge of the research frontier, and thus typically exploit data in the low signal-to-noise regime. In astronomy, the prevalence of systematics --- both "known unknowns" and "unknown unknowns" --- combined with increasingly large datasets, the widespread use of ad hoc estimators for anomaly detection, and the "look-elsewhere" effect, can lead to spurious false detections. In this informal note, I argue that anomaly detection leading to discoveries of new physics requires a combination of physical understanding, careful experimental design to avoid confirmation bias, and self-consistent statistical methods. These points are illustrated with several concrete examples from cosmology.

  8. Anomaly detection for internet surveillance

    NARCIS (Netherlands)

    Bouma, H.; Raaijmakers, S.A.; Halma, A.H.R.; Wedemeijer, H.

    2012-01-01

    Many threats in the real world can be related to activity of persons on the internet. Internet surveillance aims to predict and prevent attacks and to assist in finding suspects based on information from the web. However, the amount of data on the internet rapidly increases and it is time consuming

  9. Anomaly Detection for Complex Systems

    Data.gov (United States)

    National Aeronautics and Space Administration — In performance maintenance in large, complex systems, sensor information from sub-components tends to be readily available, and can be used to make predictions about...

  10. Anomaly Detection with Text Mining

    Data.gov (United States)

    National Aeronautics and Space Administration — Many existing complex space systems have a significant amount of historical maintenance and problem data bases that are stored in unstructured text forms. The...

  11. NMF-NAD: detecting network-wide traffic anomaly based on NMF%NMF-NAD:基于NMF的全网络流量异常检测方法

    Institute of Scientific and Technical Information of China (English)

    魏祥麟; 陈鸣; 张国敏; 黄建军

    2012-01-01

    A non-negative matrix factorization (NMF) based network wide traffic anomalies detection (NMF-NAD) method was proposed. NMF-NAD firstly reconstructed the traffic matrix in the non-negative sub-space, and then detected the anomalies through Shewhart control chart based on the reconstruction error. Experimental results on both simulation and Abilene data show that NMF-NAD can achieve high detection accuracy with low complexity.%提出了一种基于非负矩阵分解(NME non-negative matrix factorization)的多元异常检测算法(NMF-NAD,NMF baseD network-wide traffic anomalies detection),该算法首先采用非负子空间方法对流量矩阵进行重构,然后基于重构误差利用Shewhart控制图进行异常检测.模拟实验与因特网实测数据的分析表明,NMF-NAD算法有较高的检测精度和较低的处理复杂度.

  12. Tracheobronchial Branching Anomalies

    Energy Technology Data Exchange (ETDEWEB)

    Hong, Min Ji; Kim, Young Tong; Jou, Sung Shick [Soonchunhyang University, Cheonan Hospital, Cheonan (Korea, Republic of); Park, A Young [Soonchunhyang University College of Medicine, Asan (Korea, Republic of)

    2010-04-15

    There are various congenital anomalies with respect to the number, length, diameter, and location of tracheobronchial branching patterns. The tracheobronchial anomalies are classified into two groups. The first one, anomalies of division, includes tracheal bronchus, cardiac bronchus, tracheal diverticulum, pulmonary isomerism, and minor variations. The second one, dysmorphic lung, includes lung agenesis-hypoplasia complex and lobar agenesis-aplasia complex

  13. Progress of study on detection and analysis methods of voice anomaly in patients with cleft lip and palate%唇腭裂患者的语音异常检测及分析方法研究进展

    Institute of Scientific and Technical Information of China (English)

    秦世玉; 李冬爽(综述); 孙晋虎(审校)

    2014-01-01

    Congenital cleft lip and palate will cause abnormal voice function of patients .The research of de-tection and analysis method of voice anomaly helps the correction of voice function .This article will review the recent detection and analysis methods of voice anomaly in patients with cleft lip and palate .%先天性唇腭裂会造成患者语音功能异常,唇腭裂患者语音异常检测及分析方法的研究有助于对语音功能的矫正。该文就近期对唇腭裂患者语音检测及分析的方法作一综述。

  14. Seasonality of congenital anomalies in Europe

    DEFF Research Database (Denmark)

    Luteijn, Johannes Michiel; Dolk, Helen; Addor, Marie-Claude;

    2014-01-01

    with influenza. RESULTS: We detected statistically significant seasonality in prevalence of anomalies previously associated with influenza, but the conception peak was in June (2.4% excess). We also detected seasonality in congenital cataract (April conceptions, 27%), hip dislocation and/or dysplasia (April, 12......%), congenital hydronephrosis (July, 12%), urinary defects (July, 5%), and situs inversus (December, 36%), but not for nonchromosomal anomalies combined, chromosomal anomalies combined, or other anomalies analyzed. CONCLUSION: We have confirmed previously described seasonality for congenital cataract and hip......BACKGROUND: This study describes seasonality of congenital anomalies in Europe to provide a baseline against which to assess the impact of specific time varying exposures such as the H1N1 pandemic influenza, and to provide a comprehensive and recent picture of seasonality and its possible relation...

  15. Network Traffic Anomalies Identification Based on Classification Methods

    Directory of Open Access Journals (Sweden)

    Donatas Račys

    2015-07-01

    Full Text Available A problem of network traffic anomalies detection in the computer networks is analyzed. Overview of anomalies detection methods is given then advantages and disadvantages of the different methods are analyzed. Model for the traffic anomalies detection was developed based on IBM SPSS Modeler and is used to analyze SNMP data of the router. Investigation of the traffic anomalies was done using three classification methods and different sets of the learning data. Based on the results of investigation it was determined that C5.1 decision tree method has the largest accuracy and performance and can be successfully used for identification of the network traffic anomalies.

  16. A DATA MINING-BASED METHOD OF TRANSACTION ANOMALY DETECTION%基于数据挖掘的异常交易检测方法

    Institute of Scientific and Technical Information of China (English)

    柴洪峰; 李锐; 王兴建; 叶家炜

    2013-01-01

    提出一种基于数据挖掘的异常交易检测方法,可以在业务层面和操作层面对交易中的异常进行检测.当一个用户提交一笔新的消费交易时,采用贝叶斯信念网络算法判断当前交易属于正常交易的后验概率,作为在业务层面的可信因子;然后提取该用户在当前交易之前的若干个操作,与当前交易一起构成一个固定长度的操作序列,并通过BLAST-SSAHA算法将其与该用户正常操作序列和已知异常操作序列进行比对,得出在操作层面的可信因子.综合考虑业务层面的可信因子和操作层面的可信因子,最终决定当前交易是否为异常交易.%This paper presents a data mining-based transaction anomaly detection method, which can detect the fraud at both the business and operational level. When a user submits a new purchase request, the Bayesian belief network is used to determine the posterior probability that is the index of normal transaction, and use this as its credibility factor at business level. Then we extract user' s previous recen operations to form a fixed-length sequence of operations along with the current transaction. The BLAST-SSAHA aligns this sequence wit! user's normal operation sequences and known fraud operation sequences to arrive at the credibility factor at operational level. Considerin; comprehensively the credibility factors on these two levels, the final decision can be made on whether the current transaction is abnormal.

  17. Cryo-electron microscopy and single molecule fluorescent microscopy detect CD4 receptor induced HIV size expansion prior to cell entry

    Energy Technology Data Exchange (ETDEWEB)

    Pham, Son [Deakin University, Victoria 3216 (Australia); CSIRO Australian Animal Health Laboratory, Victoria 3220 (Australia); Tabarin, Thibault [ARC Centre of Excellence in Advanced Molecular Imaging, University of New South Wales, New South Wales 3220 (Australia); Garvey, Megan; Pade, Corinna [Deakin University, Victoria 3216 (Australia); CSIRO Australian Animal Health Laboratory, Victoria 3220 (Australia); Rossy, Jérémie [ARC Centre of Excellence in Advanced Molecular Imaging, University of New South Wales, New South Wales 3220 (Australia); Monaghan, Paul; Hyatt, Alex [CSIRO Australian Animal Health Laboratory, Victoria 3220 (Australia); Böcking, Till [ARC Centre of Excellence in Advanced Molecular Imaging, University of New South Wales, New South Wales 3220 (Australia); Leis, Andrew [CSIRO Australian Animal Health Laboratory, Victoria 3220 (Australia); Gaus, Katharina, E-mail: k.gaus@unsw.edu.au [ARC Centre of Excellence in Advanced Molecular Imaging, University of New South Wales, New South Wales 3220 (Australia); Mak, Johnson, E-mail: j.mak@deakin.edu.au [Deakin University, Victoria 3216 (Australia); CSIRO Australian Animal Health Laboratory, Victoria 3220 (Australia)

    2015-12-15

    Viruses are often thought to have static structure, and they only remodel after the viruses have entered target cells. Here, we detected a size expansion of virus particles prior to viral entry using cryo-electron microscopy (cryo-EM) and single molecule fluorescence imaging. HIV expanded both under cell-free conditions with soluble receptor CD4 (sCD4) targeting the CD4 binding site on the HIV-1 envelope protein (Env) and when HIV binds to receptor on cellular membrane. We have shown that the HIV Env is needed to facilitate receptor induced virus size expansions, showing that the ‘lynchpin’ for size expansion is highly specific. We demonstrate that the size expansion required maturation of HIV and an internal capsid core with wild type stability, suggesting that different HIV compartments are linked and are involved in remodelling. Our work reveals a previously unknown event in HIV entry, and we propose that this pre-entry priming process enables HIV particles to facilitate the subsequent steps in infection. - Highlights: • Cell free viruses are able to receive external trigger that leads to apparent size expansion. • Virus envelope and CD4 receptor engagement is the lynchpin of virus size expansion. • Internal capsid organisation can influence receptor mediated virus size expansion. • Pre-existing virus-associated lipid membrane in cell free virus can accommodate the receptor mediated virus size expansion.

  18. Dynamic and real-time network anomaly detection model inspired by immune%基于免疫的网络动态实时异常检测模型

    Institute of Scientific and Technical Information of China (English)

    彭凌西; 曾金全

    2012-01-01

    网络异常检测已成为入侵检测系统发展的重要方向.现有异常检测模型对检测模式描述为一种静态方式,缺乏良好的自适应性和协同性,检测率低,难以满足高速网络环境下实时检测的需求.针对此,借鉴人体免疫系统优异的自学习自适应机制,提出了一种新的基于免疫的网络动态实时异常检测模型NAIM.该模型通过对检测模式进行动态描述,结合抗体细胞动态克隆原理,探讨种痘及疫苗分发机制,实现检测模式随真实网络环境同步演化,从而提高网络异常检测的准确性和及时性.%The network anomaly detection has become the promising direction of intrusion detection system. The existing anomaly detection models depict the detection pattern with a static way, which lack good adaptability and interoperability with low detection rate, so it is difficult to implement the real-time detection under the high- speed network environment. Our research uses the excellent mechanism of Self-learning and adaptability of the human immune system, and a novel real-time immune-based anomaly detection model(NAIM) is proposed. The model dynamically depicts detection model, combining the antibody's clone theory and disscussing the vaccina- tion and bacterin distribution mechanism, which achieves the detection mode's synchronous evolvement with the real network enviroment, thus improves the network anomaly detection's veracity and timeliness.

  19. Morning glory disc anomaly with Chiari type I malformation.

    Science.gov (United States)

    Arlow, Tim; Arepalli, Sruthi; Flanders, Adam E; Shields, Carol L

    2014-04-30

    Morning glory disc anomaly is a rare optic nerve dysplasia associated with various neovascular abnormalities. Due to these associations, children with morning glory disc anomaly have brain imaging and angiography to detect other congenital defects. The authors report the case of an infant with morning glory disc anomaly and coexisting Chiari type I malformation.

  20. Fighting Prior Review.

    Science.gov (United States)

    Bowen, John

    1990-01-01

    Reviews arguments for and against prior administrative review and censorship of student expression. Suggests that prior review strips any pretense of democracy from many American educational institutions. Argues that prior review is journalistically inappropriate, educationally unsound, and practically illogical. (KEH)

  1. 数据流异常检测及其在僵尸网络检测中的应用%Data flow anomaly detection technique and its application in Botnet detection

    Institute of Scientific and Technical Information of China (English)

    邓军

    2011-01-01

    Mosi of the current detection of P2P(Peer to Peer) Botnet adopts traditional reverse engineering method. which is VPry accurate, hut difficult to he implemented and shows low efficiency. It becomes ineffPctive for varinnts. This paper attempts to find a data stream anomaly detection method suitahle to the data stream application cases. and tries to apply it to P2P Zombic Virus detection. By monitoring network data stream. the special behaviors of P2P Zomhie Virus in their spreading can be found. The locating of the zomhie host can he realized hy caplu ring those hehaviors.%目前大多关于P2P僵尸网络检测的研究都采用传统的逆向工程方法,这些方法检测都比较准确,但其工程实施难度太大,效率较低,且对于变种病毒,该类检测方法无能为力.本文尝试通过数据流异常检测技术的应用,找到一种适合数据流应用场景的异常检测方法,并尝试将其应用于P2P僵尸病毒的检测当中,通过监控网络数据流,能够有效地发现P2P僵尸病毒在传播过程当中的特殊行为,并通过捕获这些行为来实现发现僵尸主机的目的.

  2. 基于改进符号化度量方法的机场噪声异常检测%An Anomaly Detection Method of Airport-noise Time Series Based on Improved SAX Measurement

    Institute of Scientific and Technical Information of China (English)

    王伟; 王建东; 张霞

    2014-01-01

    With the expansion of airport transportation scale , the airport noise issue is becoming one of the obstacles for the sustain-able development of the aviation industry .Anomalies in the airport noise are of great significance for the timely improvement of the equipments of aircraft and airports .In this paper , according to the characteristics of airport noise , a time series anomaly detection method for single monitoring point is proposed , which is based on the improved symbolic aggregate approximation similarity measure-ment .This method calculates the measure by applying the improved similarity measure , and finally finds anomalies using the k-nearest neighbor anomaly detection method.The proposed method is applied in practice after the theoretical verification of its feasibility .%机场噪声中的异常情况拥有很大价值,利用它能够及时完善飞机和机场的设备。结合机场噪声数据的特点,对上述问题进行研究并提出一种基于改进的符号化聚集近似( Symbolic Aggregate Approximation ,SAX)相似性度量的单监测点的时间序列异常检测方法。其运用相似性度量方法计算出度量结果,再运用k近邻异常检测方法进行异常发现,最后发现异常时间段。该方法在理论验证可行性之后在某机场的实测数据中进行应用,取得了良好的效果。

  3. Diagnosing Traffic Anomalies Using a Two-Phase Model

    Institute of Scientific and Technical Information of China (English)

    Bin Zhang; Jia-Hai Yang; Jian-Ping Wu; Ying-Wu Zhu

    2012-01-01

    Network traffic anomalies are unusual changes in a network,so diagnosing anomalies is important for network management.Feature-based anomaly detection models (ab)normal network traffic behavior by analyzing packet header features. PCA-subspace method (Principal Component Analysis) has been verified as an efficient feature-based way in network-wide anomaly detection.Despite the powerful ability of PCA-subspace method for network-wide traffic detection,it cannot be effectively used for detection on a single link.In this paper,different from most works focusing on detection on flow-level traffic,based on observations of six traffc features for packet-level traffic,we propose a new approach B6SVM to detect anomalies for packet-level traffic on a single link.The basic idea of B6-SVM is to diagnose anomalies in a multi-dimensional view of traffic features using Support Vector Machine (SVM).Through two-phase classification,B6-SVM can detect anomalies with high detection rate and low false alarm rate.The test results demonstrate the effectiveness and potential of our technique in diagnosing anomalies.Further,compared to previous feature-based anomaly detection approaches,B6-SVM provides a framework to automatically identify possible anomalous types.The framework of B6-SVM is generic and therefore,we expect the derived insights will be helpful for similar future research efforts.

  4. Anomaly Detection of Ranging Information of Airborne TACAN Based on One-Class SVM Classifier%基于One-Class SVM的机载塔康测距信息异常检测方法研究

    Institute of Scientific and Technical Information of China (English)

    李城梁

    2015-01-01

    针对多源导航信息融合系统中导航传感器数据保障的问题,本文提出了一种基于One-Class SVM的机载塔康测距信息异常检测方法。首先,提取机载塔康测距信息的时域参数构成特征样本空间;然后,采用One-Class SVM训练出机载塔康测距信息正常状态时的模型,通过发现非正常状态的样本进行异常检测。利用模拟的机载塔康测距数据进行方法验证,实验结果表明:该异常检测方法对机载塔康测距信息中的噪声有一定的鲁棒性,可以满足实际应用的需要。%According to the anomaly detection for ranging information of airborne TACAN in system which fused information of multi-source navigation, this article proposed a detection method based on One-Class SVM. First, the features space is built by extracting time domain features. Then, the model of normal state is built by training the One-Class SVM classifier. Anomaly information is detected by the trained model. The experimental results show that the proposed method has good performance in anomaly detection.

  5. Competing Orders and Anomalies

    Science.gov (United States)

    Moon, Eun-Gook

    2016-08-01

    A conservation law is one of the most fundamental properties in nature, but a certain class of conservation “laws” could be spoiled by intrinsic quantum mechanical effects, so-called quantum anomalies. Profound properties of the anomalies have deepened our understanding in quantum many body systems. Here, we investigate quantum anomaly effects in quantum phase transitions between competing orders and striking consequences of their presence. We explicitly calculate topological nature of anomalies of non-linear sigma models (NLSMs) with the Wess-Zumino-Witten (WZW) terms. The non-perturbative nature is directly related with the ’t Hooft anomaly matching condition: anomalies are conserved in renormalization group flow. By applying the matching condition, we show massless excitations are enforced by the anomalies in a whole phase diagram in sharp contrast to the case of the Landau-Ginzburg-Wilson theory which only has massive excitations in symmetric phases. Furthermore, we find non-perturbative criteria to characterize quantum phase transitions between competing orders. For example, in 4D, we show the two competing order parameter theories, CP(1) and the NLSM with WZW, describe different universality class. Physical realizations and experimental implication of the anomalies are also discussed.

  6. Anomaly-induced baryogenesis

    CERN Document Server

    Kobakhidze, A

    2004-01-01

    We propose a new mechanism for dynamical generation of the observed baryon asymmetry within the minimal Standard model extended by massive Majorana neutrinos and non-vanishing electroweak Chern-Simons term. We show that electroweak Chern-Simons number is produced in the expanding universe due to the conformal anomaly and subsequently converted into baryon number through the triangle anomaly.

  7. Competing Orders and Anomalies.

    Science.gov (United States)

    Moon, Eun-Gook

    2016-08-08

    A conservation law is one of the most fundamental properties in nature, but a certain class of conservation "laws" could be spoiled by intrinsic quantum mechanical effects, so-called quantum anomalies. Profound properties of the anomalies have deepened our understanding in quantum many body systems. Here, we investigate quantum anomaly effects in quantum phase transitions between competing orders and striking consequences of their presence. We explicitly calculate topological nature of anomalies of non-linear sigma models (NLSMs) with the Wess-Zumino-Witten (WZW) terms. The non-perturbative nature is directly related with the 't Hooft anomaly matching condition: anomalies are conserved in renormalization group flow. By applying the matching condition, we show massless excitations are enforced by the anomalies in a whole phase diagram in sharp contrast to the case of the Landau-Ginzburg-Wilson theory which only has massive excitations in symmetric phases. Furthermore, we find non-perturbative criteria to characterize quantum phase transitions between competing orders. For example, in 4D, we show the two competing order parameter theories, CP(1) and the NLSM with WZW, describe different universality class. Physical realizations and experimental implication of the anomalies are also discussed.

  8. The Detection of Hatching Eggs Prior to Incubation by the Near Infrared Spectrum%基于近红外光谱的孵前种蛋检测

    Institute of Scientific and Technical Information of China (English)

    祝志慧; 王巧华; 王树才; 戴明钰; 马美湖

    2012-01-01

    利用近红外漫反射光谱分析技术对种蛋中的无精蛋和受精蛋进行检测.通过不同波段范围、不同主成分因子数和不同光谱预处理方法对种蛋类型检测结果的比较分析,建立了种蛋的定性检测模型.结果表明:选取光谱范围为4 119.20~9 881.46 cm-1,19个主成分因子数,原始光谱经过SNV+一阶导数+Norris微分过滤的预处理方法,利用马氏距离建立种蛋定性检测模型,校正集正确率达到92.50%,验证集正确率达到91.67%.该研究为上孵前无精蛋和受精蛋的无损检测提供了新的途径.%The detection of the infertile eggs and fertile eggs by the near infrared diffuse reflectance spectra was proposed. Models based on different band regions range, different principal component numbers and the different spectral pre-processing methods were compared and the optimal calibration model was established. The results show that qualitative forecasting model of hatching eggs is established by Mahalanobis Distance, which is with band regions range being 4 119. 20~9 881. 46 cm-1, principal component number being 19 and spectral pre-processing method being SNV+first derivative+Norris differential filter. The precision rate of calibration set is 92. 5% and that of validation set is 91. 67%. The study provides a new way for nondestructive testing of the fertile eggs and infertile eggs prior to incubation.

  9. Ionic liquid-based zinc oxide nanofluid for vortex assisted liquid liquid microextraction of inorganic mercury in environmental waters prior to cold vapor atomic fluorescence spectroscopic detection.

    Science.gov (United States)

    Amde, Meseret; Liu, Jing-Fu; Tan, Zhi-Qiang; Bekana, Deribachew

    2016-01-01

    Zinc oxide nanofluid (ZnO-NF) based vortex assisted liquid liquid microextraction (ZnO-NF VA-LLME) was developed and employed in extraction of inorganic mercury (Hg(2+)) in environmental water samples, followed by cold vapor atomic fluorescence spectrometry (CV-AFS). Unlike other dispersive liquid liquid microextraction techniques, ZnO-NF VA-LLME is free of volatile organic solvents and dispersive solvent consumption. Analytical signals were obtained without back-extraction from the ZnO-NF phase prior to CV-AFS determination. Some essential parameters of the ZnO-NF VA-LLME and cold vapor generation such as composition and volume of the nanofluid, vortexing time, pH of the sample solution, amount of the chelating agent, ionic strength and matrix interferences have been studied. Under optimal conditions, efficient extraction of 1ng/mL of Hg(2+) in 10mL of sample solution was achieved using 50μL of ZnO-NF. The enrichment factor before dilution, detection limits and limits of quantification of the method were about 190, 0.019 and 0.064ng/mL, respectively. The intra and inter days relative standard deviations (n=8) were found to be 4.6% and 7.8%, respectively, at 1ng/mL spiking level. The accuracy of the current method was also evaluated by the analysis of certified reference materials, and the measured Hg(2+) concentration of GBW08603 (9.6ng/mL) and GBW(E)080392 (8.9ng/mL) agreed well with their certified value (10ng/mL). The method was applied to the analysis of Hg(2+) in effluent, influent, lake and river water samples, with recoveries in the range of 79.8-92.8% and 83.6-106.1% at 1ng/mL and 5ng/mL spiking levels, respectively. Overall, ZnO-NF VA-LLME is fast, simple, cost-effective and environmentally friendly and it can be employed for efficient enrichment of the analyte from various water samples.

  10. Mixed hemimicelles solid-phase extraction based on sodium dodecyl sulfate-coated nano-magnets for selective adsorption and enrichment of illegal cationic dyes in food matrices prior to high-performance liquid chromatography-diode array detection detection.

    Science.gov (United States)

    Qi, Ping; Liang, Zhi-an; Wang, Yu; Xiao, Jian; Liu, Jia; Zhou, Qing-qiong; Zheng, Chun-hao; Luo, Li-Ni; Lin, Zi-hao; Zhu, Fang; Zhang, Xue-wu

    2016-03-11

    In this study, mixed hemimicelles solid-phase extraction (MHSPE) based on sodium dodecyl sulfate (SDS) coated nano-magnets Fe3O4 was investigated as a novel method for the extraction and separation of four banned cationic dyes, Auramine O, Rhodamine B, Basic orange 21 and Basic orange 22, in condiments prior to HPLC detection. The main factors affecting the extraction of analysts, such as pH, surfactant and adsorbent concentrations and zeta potential were studied and optimized. Under optimized conditions, the proposed method was successful applied for the analysis of banned cationic dyes in food samples such as chili sauce, soybean paste and tomato sauce. Validation data showed the good recoveries in the range of 70.1-104.5%, with relative standard deviations less than 15%. The method limits of determination/quantification were in the range of 0.2-0.9 and 0.7-3μgkg(-1), respectively. The selective adsorption and enrichment of cationic dyes were achieved by the synergistic effects of hydrophobic interactions and electrostatic attraction between mixed hemimicelles and the cationic dyes, which also resulted in the removal of natural pigments interferences from sample extracts. When applied to real samples, RB was detected in several positive samples (chili powders) within the range from 0.042 to 0.177mgkg(-1). These results indicate that magnetic MHSPE is an efficient and selective sample preparation technique for the extraction of banned cationic dyes in a complex matrix.

  11. 基于特征选择的模糊聚类异常入侵行为检测%Anomaly Intrusion Behavior Detection Based on Fuzzy Clustering and Features Selection

    Institute of Scientific and Technical Information of China (English)

    唐成华; 刘鹏程; 汤申生; 谢逸

    2015-01-01

    网络攻击连接具有行为的多变性和复杂性等特征,利用基于传统聚类的行为挖掘技术来构建异常入侵检测模型是不可行的。针对网络攻击行为的特点,提出了基于特征选择的模糊聚类异常入侵模型。首先通过层次聚类算法改善了FCM 聚类算法结果对初始聚类中心的敏感性,再利用遗传算法的全局搜索能力克服了其在迭代时易陷入局部最优的缺点,并将它们结合构成一种AGFCM 算法;然后采用信息增益算法对网络攻击连接数据集的特征属性进行排序,同时利用约登指数来删减数据集的特征属性以确定特征属性容量;最后利用低维特征属性集和改进的FCM 聚类算法构建了异常入侵检测模型。实验结果表明该模型对绝大多数的网络攻击类型具有很好的检测能力,为解决异常入侵检测模型的误警率和检测率等问题提供了一种可行的解决途径。%The behaviors of network attack connection are always changeable and complex .Typical behavior mining methods ,which always do using traditional clustering ,do not fit in with constructing anomaly intrusion detection model .According to the characteristics of network attacks ,the anomaly intrusion detection model based on fuzzy clustering and features selection are proposed .Firstly ,the results that the fuzzy C‐means clustering algorithm is sensitive to the initial cluster centers is improved using hierarchical clustering algorithm ,the disadvantage that FCM is easy to fall into local optimum in the iteration is overcome using the global search ability of genetic algorithm ,and they are combined into a AGFCM algorithm .Secondly ,the feature attribute data sets of network attack connection are sorted through the information gain algorithm .The capacity of feature attributes is determined by using the Youden index to cut the data sets at the same time .Lastly ,the anomaly intrusion detection model is built

  12. Anomalies on orbifolds

    Energy Technology Data Exchange (ETDEWEB)

    Arkani-Hamed, Nima; Cohen, Andrew G.; Georgi, Howard

    2001-03-16

    We discuss the form of the chiral anomaly on an S1/Z2 orbifold with chiral boundary conditions. We find that the 4-divergence of the higher-dimensional current evaluated at a given point in the extra dimension is proportional to the probability of finding the chiral zero mode there. Nevertheless the anomaly, appropriately defined as the five dimensional divergence of the current, lives entirely on the orbifold fixed planes and is independent of the shape of the zero mode. Therefore long distance four dimensional anomaly cancellation ensures the consistency of the higher dimensional orbifold theory.

  13. 调试中基于文法编码的日志异常检测算法%A Log Anomaly Detection Algorithm for Debugging Based on Grammar-Based Codes

    Institute of Scientific and Technical Information of China (English)

    王楠; 韩冀中; 方金云

    2013-01-01

    调试软件中的非确定错误对软件开发有重要意义.近年来,随着云计算系统的快速发展和对录制重放调试方法研究的深入,使用异常检测方法从大量文本日志或控制流日志等数据中找出异常的信息对调试愈发重要.传统的异常检测算法大多是为检测和防范攻击而设计的,它们很多基于马尔可夫假设,对事件流上的剧烈变化很敏感.但是新的问题要求异常检测能够检出语义级别的异常行为.实验表明现有的基于马尔可夫假设的异常检测算法在这方面表现不佳.提出了一种新的基于文法编码的异常检测算法.该算法不依赖于统计模型、概率模型、机器学习及马尔可夫假设,设计和实现都极为简单.实验表明在检测高层次的语义异常方面,该算法比传统方法有优势.%Debugging non-deterministic bugs has long been an important research area in software development. In recent years, with the rapid emerging of large cloud computing systems and the development of record replay debugging, the key of such debugging problem becomes mining anomaly information from text console logs and/or execution flow logs. Anomaly detection algorithms can therefore be used in this area. However, although many approaches have been proposed, traditional anomaly detection algorithms are designed for detecting network attacking and not suitable for the new problems. One important reason is the Markov assumption on which many traditional anomaly detection methods are based. Markov-based methods are sensitive to harshly trashing in event transitions. In contrast, the new problems in system diagnosing require the abilities of detecting semantic misbehaviors. Experiment results show the powerless of Markov-based methods on those problems. This paper presents a novel anomaly detection algorithm which is based on grammar-based codes. Different from previous approaches, our algorithm is a non-Markov approach. It doesn

  14. Neutrino anomalies without oscillations

    Indian Academy of Sciences (India)

    Sandip Pakvasa

    2000-01-01

    I review explanations for the three neutrino anomalies (solar, atmospheric and LSND) which go beyond the `conventional' neutrino oscillations induced by mass-mixing. Several of these require non-zero neutrino masses as well.

  15. Scattering anomaly in optics

    CERN Document Server

    Silveirinha, Mario G

    2016-01-01

    In time-reversal invariant electronic systems the scattering matrix is anti-symmetric. This property enables an effect, designated here as "scattering anomaly", such that the electron transport does not suffer from back reflections, independent of the specific geometry of the propagation path or the presence of time-reversal invariant defects. In contrast, for a generic time-reversal invariant photonic system the scattering matrix is symmetric and there is no similar anomaly. Here, it is theoretically proven that despite these fundamental differences there is a wide class of photonic platforms - in some cases formed only by time-reversal invariant media - in which the scattering anomaly can occur. It is shown that an optical system invariant under the action of the composition of the time-reversal, parity and duality operators is characterized by an anti-symmetric scattering matrix. Specific examples of photonic platforms wherein the scattering anomaly occurs are given, and it is demonstrated with full wave n...

  16. DREDed Anomaly Mediation

    CERN Document Server

    Boyda, E; Pierce, A T; Boyda, Ed; Murayama, Hitoshi; Pierce, Aaron

    2002-01-01

    We offer a guide to dimensional reduction (DRED) in theories with anomaly mediated supersymmetry breaking. Evanescent operators proportional to epsilon arise in the bare Lagrangian when it is reduced from d=4 to d= (4-2 epsilon) dimensions. In the course of a detailed diagrammatic calculation, we show that inclusion of these operators is crucial. The evanescent operators conspire to drive the supersymmetry-breaking parameters along anomaly-mediation trajectories across heavy particle thresholds, guaranteeing the ultraviolet insensitivity.

  17. The Pioneer Anomaly

    CERN Document Server

    de Diego, Jose A

    2008-01-01

    Analysis of the radio-metric data from Pioneer 10 and 11 spacecrafts has indicated the presence of an unmodeled acceleration starting at 20 AU, which has become known as the Pioneer anomaly. The nature of this acceleration is uncertain. In this paper we give a description of the effect and review some relevant mechanisms proposed to explain the observed anomaly. We also discuss on some future projects to investigate this phenomenon.

  18. Anomalies and gravity

    CERN Document Server

    Mielke, E W

    2006-01-01

    Anomalies in Yang-Mills type gauge theories of gravity are reviewed. Particular attention is paid to the relation between the Dirac spin, the axial current j_5 and the non-covariant gauge spin C. Using diagrammatic techniques, we show that only generalizations of the U(1)- Pontrjagin four--form F^ F= dC arise in the chiral anomaly, even when coupled to gravity. Implications for Ashtekar's canonical approach to quantum gravity are discussed.

  19. Design and Implementation of an Anomaly Detector

    Energy Technology Data Exchange (ETDEWEB)

    Bagherjeiran, A; Cantu-Paz, E; Kamath, C

    2005-07-11

    This paper describes the design and implementation of a general-purpose anomaly detector for streaming data. Based on a survey of similar work from the literature, a basic anomaly detector builds a model on normal data, compares this model to incoming data, and uses a threshold to determine when the incoming data represent an anomaly. Models compactly represent the data but still allow for effective comparison. Comparison methods determine the distance between two models of data or the distance between a model and a point. Threshold selection is a largely neglected problem in the literature, but the current implementation includes two methods to estimate thresholds from normal data. With these components, a user can construct a variety of anomaly detection schemes. The implementation contains several methods from the literature. Three separate experiments tested the performance of the components on two well-known and one completely artificial dataset. The results indicate that the implementation works and can reproduce results from previous experiments.

  20. Quick Anomaly Detection by the Newcomb--Benford Law, with Applications to Electoral Processes Data from the USA, Puerto Rico and Venezuela

    CERN Document Server

    Pericchi, Luis; 10.1214/09-STS296

    2012-01-01

    A simple and quick general test to screen for numerical anomalies is presented. It can be applied, for example, to electoral processes, both electronic and manual. It uses vote counts in officially published voting units, which are typically widely available and institutionally backed. The test examines the frequencies of digits on voting counts and rests on the First (NBL1) and Second Digit Newcomb--Benford Law (NBL2), and in a novel generalization of the law under restrictions of the maximum number of voters per unit (RNBL2). We apply the test to the 2004 USA presidential elections, the Puerto Rico (1996, 2000 and 2004) governor elections, the 2004 Venezuelan presidential recall referendum (RRP) and the previous 2000 Venezuelan Presidential election. The NBL2 is compellingly rejected only in the Venezuelan referendum and only for electronic voting units. Our original suggestion on the RRP (Pericchi and Torres, 2004) was criticized by The Carter Center report (2005). Acknowledging this, Mebane (2006) and The...

  1. Anomaly Detection of User Behavior Based on Shell Commands and Co-Occurrence Matrix%基于Shell命令和共生矩阵的用户行为异常检测方法

    Institute of Scientific and Technical Information of China (English)

    李超; 田新广; 肖喜; 段洣毅

    2012-01-01

    用户行为异常检测是当前网络安全领域研究的热点内容.提出一种新的基于共生矩阵的用户行为异常检测方法,主要用于Unix或Linux平台上以shell命令为审计数据的入侵检测系统.该方法在训练阶段充分考虑了用户行为复杂多变的特点和审计数据的时序相关属性,依据shell命令的出现频率并利用阶梯式的数据归并方法来确定事件,然后构建模型矩阵来刻画用户的正常行为.在检测阶段,首先为每一个当前事件序列构建一个部分正则化共生矩阵,然后根据矩阵2范数计算这些矩阵与模型矩阵的距离,得到距离流,最后通过平滑滤噪处理距离流来判决用户行为.在Purdue大学实验数据和SEA实验数据上的两组实验结果表明,该方法具有很高的检测性能,其可操作性也优于同类方法.%Anomaly detection of user behavior is now one of the major concerns of system security research. Anomaly detection systems establish the normal behavior profile of a subject (e. g. user), and compare the observed behavior of the subject with the profile and signal intrusions when the subject's observed behavior differs significantly from the profile. One problem with anomaly detection is that it is likely to raise many false alarms. Unusual but legitimate use may sometimes be considered anomalous. This paper proposes a novel method for anomaly detection of user behavior, which is applicable to host-based intrusion detection systems using shell commands as audit data. Considering the property and the uncertainty of user behavior, the method obtains an event sequence with less variety of events after hierarchically merging shell command tokens into sets and then profiles the user's normal behavior with a partly normalized co-occurrence matrix. In the detection stage, for event current sequence, a normalized co-occurrence matrix is constructed. Then the distances between these matrixes and the profile matrix are

  2. The Role of Imaging in Craniofacial Anomalies

    Directory of Open Access Journals (Sweden)

    P. Alipour

    2008-01-01

    Full Text Available It is important to know craniofacial anatomy in infancy for early detection of craniofacial anomalies, to help the surgeon's decision ,for repair and increase the patients, quality of life .In this regard, imaging has the major role in preoperative diagnostic maping and post operative follow up repair."nWe are going to show the normal craniofacial anatomy appearances in infancy in order to detect early craniofacial anomaly and syndromatic craniosynostosis with plain skull X-ray and CT scan reconstruction imaging.

  3. Radioactive anomaly discrimination from spectral ratios

    Science.gov (United States)

    Maniscalco, James; Sjoden, Glenn; Chapman, Mac Clements

    2013-08-20

    A method for discriminating a radioactive anomaly from naturally occurring radioactive materials includes detecting a first number of gamma photons having energies in a first range of energy values within a predetermined period of time and detecting a second number of gamma photons having energies in a second range of energy values within the predetermined period of time. The method further includes determining, in a controller, a ratio of the first number of gamma photons having energies in the first range and the second number of gamma photons having energies in the second range, and determining that a radioactive anomaly is present when the ratio exceeds a threshold value.

  4. The Network Traffic Anomaly Detection Method Based on Synergetic Neural Networks in Cloud Communications%基于协同神经网络的云通信异常检测方法

    Institute of Scientific and Technical Information of China (English)

    石云; 陈钟

    2014-01-01

    云计算和服务的全分布式和开放结构成为潜在入侵者一个更具吸引力的目标,安全是云计算最大的挑战。为了减少安全隐患,提出了基于协同神经网络网络流量动态特性的云通信网络流量异常检测方法,用协同动力学方程与一组序参量来描述云通信网络通信系统的复杂行为,当这个方程式演变时,只有主要因素决定的序参量可以收敛到1,从而检测出异常。文中使用标准的美国国防部高级研究计划局的数据集进行方法性能的评估,实验结果表明,该方法能有效地检测出网络流量异常,并达到较高的检测率和低误报率。%The fully distributed and open structure of cloud computing and services have become an even more attractive target for potential intruders. Security is the greatest challenge of cloud computing. To reduce security risks, the approaches of the network traffic anomaly detection in cloud communications have been presented, which analyze dynamic characteristics of the network traffic based on the synergetic neural net-works. A synergetic dynamic equation with a group of the order parameters is used to describe the complex behaviors of the network traffic system in cloud communications. When this equation is evolved, only the or-der parameter determined by the primary factors can converge to 1. Then, the anomaly can be detected. The paper evaluate the performance of this approaches using the standard Defense Advanced Research Projects Agency data sets. Experimental results show that the approaches can effectively detect the network traffic anomaly and achieve the high detection probability and the low false alarms rate.

  5. Bayesian priors for transiting planets

    CERN Document Server

    Kipping, David M

    2016-01-01

    As astronomers push towards discovering ever-smaller transiting planets, it is increasingly common to deal with low signal-to-noise ratio (SNR) events, where the choice of priors plays an influential role in Bayesian inference. In the analysis of exoplanet data, the selection of priors is often treated as a nuisance, with observers typically defaulting to uninformative distributions. Such treatments miss a key strength of the Bayesian framework, especially in the low SNR regime, where even weak a priori information is valuable. When estimating the parameters of a low-SNR transit, two key pieces of information are known: (i) the planet has the correct geometric alignment to transit and (ii) the transit event exhibits sufficient signal-to-noise to have been detected. These represent two forms of observational bias. Accordingly, when fitting transits, the model parameter priors should not follow the intrinsic distributions of said terms, but rather those of both the intrinsic distributions and the observational ...

  6. Overcoming priors anxiety

    CERN Document Server

    D'Agostini, Giulio

    1999-01-01

    The choice of priors may become an insoluble problem if priors and Bayes' rule are not seen and accepted in the framework of subjectivism. Therefore, the meaning and the role of subjectivity in science is considered and defended from the pragmatic point of view of an ``experienced scientist''. The case for the use of subjective priors is then supported and some recommendations for routine and frontier measurement applications are given. The issue of reference priors is also considered from the practical point of view and in the general context of ``Bayesian dogmatism''.

  7. 基于光流法与特征统计的鱼群异常行为检测%Anomaly detection of fish school behavior based on features statistical and optical flow methods

    Institute of Scientific and Technical Information of China (English)

    于欣; 侯晓娇; 卢焕达; 余心杰; 范良忠; 刘鹰

    2014-01-01

    鱼类群体行为的异常检测能够为鱼类健康监控与预警提供重要的方法和手段,对研究鱼类行为的机理,提升水产养殖过程中的信息化水平具有非常重要的意义。该文通过计算机视觉和图像处理技术,基于鱼群运动特征统计方法,对鱼群异常行为检测进行研究。利用Lucas-Kanade光流法得到目标鱼群的运动矢量,并对目标运动的行为特征进行统计,得到速度与转角这2个行为特征的联合直方图与联合概率分布。最后,在联合概率分布的基础上,基于标准互信息(normalized mutual information-NMI)和局部距离异常因子(local distance-based outlier factor-LDOF)2种方法对鱼群行为进行异常检测。试验结果表明,2种异常检测方法均达到99.5%以上的准确率。%The behavior of fishes is very sensitive to the changes of the parameters of the environment, such as temperature, dissolved oxygen, light, and so on. The anomaly detection of fish school behavior can not only discover the relationship between the fish behaviors and the environmental parameters, but also provide an important method and tool for fish health monitoring and early warning. Moreover, it is very meaningful for the study of the mechanism of fish behavior and promotion of the informatization level in aquaculture. By using computer vision technology and based on a statistical method of motion features, the anomaly detection of fish school behavior was studied. The zebra fish was selected as the study object in this paper. First, based on the foreground object detection method with a threshold value method, the backgrounds were removed from the original video images to reduce the influence of noises. Secondly, by the Lucas-Kanade optical flow method, which is based on the local deference method and has better performance, the vectors of motion behavior could be obtained in different temporal and spatial conditions. Thirdly, from these data, the

  8. Classical Trace Anomaly

    OpenAIRE

    Farhoudi, M.

    1995-01-01

    We seek an analogy of the mathematical form of the alternative form of Einstein's field equations for Lovelock's field equations. We find that the price for this analogy is to accept the existence of the trace anomaly of the energy-momentum tensor even in classical treatments. As an example, we take this analogy to any generic second order Lagrangian and exactly derive the trace anomaly relation suggested by Duff. This indicates that an intrinsic reason for the existence of such a relation sh...

  9. Congenital laryngeal anomalies,

    Directory of Open Access Journals (Sweden)

    Michael J. Rutter

    2014-12-01

    Full Text Available Introduction: It is essential for clinicians to understand issues relevant to the airway management of infants and to be cognizant of the fact that infants with congenital laryngeal anomalies are at particular risk for an unstable airway. Objectives: To familiarize clinicians with issues relevant to the airway management of infants and to present a succinct description of the diagnosis and management of an array of congenital laryngeal anomalies. Methods: Revision article, in which the main aspects concerning airway management of infants will be analyzed. Conclusions: It is critical for clinicians to understand issues relevant to the airway management of infants.

  10. Anomalies without Massless Particles

    CERN Document Server

    Gurlanik, Z

    1994-01-01

    Baryon and lepton number in the standard model are violated by anomalies, even though the fermions are massive. This problem is studied in the context of a two dimensional model. In a uniform background field, fermion production arise from non-adiabatic behavior that compensates for the absence of massless modes. On the other hand, for localized instanton-like configurations, there is an adiabatic limit. In this case, the anomaly is produced by bound states which travel across the mass gap. The sphaleron corresponds to a bound state at the halfway point.

  11. Cognitive Temporal Document Priors

    NARCIS (Netherlands)

    Peetz, M.H.; de Rijke, M.

    2013-01-01

    Temporal information retrieval exploits temporal features of document collections and queries. Temporal document priors are used to adjust the score of a document based on its publication time. We consider a class of temporal document priors that is inspired by retention functions considered in cogn

  12. FOETAL ULTRASOUND - NEUROECTODERMAL ANOMALIES IN RURAL PREGNANT WOMEN

    Directory of Open Access Journals (Sweden)

    Mala Venkata

    2016-06-01

    Full Text Available BACKGROUND A prospective clinical study to know the various types of congenital Neuroectodermal Anomalies on obstetric Ultrasound, in rural pregnant women. To reduce the maternal morbidity and mortality by early detection of these Congenital Neuroectodermal Anomalies. To calculate the incidence and prevalence of different types of Congenital Neuroectodermal Anomalies, in these rural pregnant women. To assist the obstetrician in taking decisions regarding the termination or continuation of the pregnancy in relation to the type of malformation and its prognosis. METHODS A prospective clinical study of Congenital Neuroectodermal Anomalies in 22,000 rural pregnant women coming to the Santhiram Medical College, Radiology Department for a routine obstetric scan. 44 cases of neuroectodermal anomalies were detected out of the 22000 cases, within an incidence of 2 per 1000 cases. Approximately 1 in every 500 cases showed an anomaly. RESULTS The most common lesions detected were hydrocephalus, and spina bifida followed by anencephaly. Association of these lesions with consanguinity, previous history of similar anomaly and intake of iron and folic acid tablets was noted. CONCLUSION Ultrasound is an excellent modality for the diagnosis and characterisation of the neuroectodermal anomalies. Its multiplanar imaging property along with real time image visualisation make it an excellent tool for the diagnosis and characterisation of these anomalies

  13. Bolivian Bouguer Anomaly Grid

    Data.gov (United States)

    National Oceanic and Atmospheric Administration, Department of Commerce — A 1 kilometer Bouguer anomaly grid for the country of Bolivia.Number of columns is 550 and number of rows is 900. The order of the data is from the lower left to...

  14. Minnesota Bouguer Anomaly Grid

    Data.gov (United States)

    National Oceanic and Atmospheric Administration, Department of Commerce — A 1.5 kilometer Bouguer anomaly grid for the state of Minnesota. Number of columns is 404 and number of rows is 463. The order of the data is from the lower left to...

  15. Detecting the Relationship Between Summer Rainfall Anomalies in Eastern China and the SSTA in the Global Domain with a New Significance Test Method

    Institute of Scientific and Technical Information of China (English)

    LU Chuhan; GUAN Zhaoyong; WANG Panxing; DUAN Mingkeng

    2009-01-01

    It is suggested that the multiple samples in a correlation map or a set of correlation maps should be examined with sig-nificance tests as per the Bernoulli probability, model. Therefore, both the contemporaneous and lag correlations of summertime pre-cipitation R in any one of the three regions of Northern China (NC), the Changjiang-Huaihe River Valley (CHRV), and Southern China (SC) with the SSTA in the global domain have been tested in the present article, using our significance test method and the method proposed by Livezey and Chen (1983) respectively. Our results demonstrate that the contemporaneous correlations of sum-mer R in CHRV with the SSTA are larger than those in NC. Significant correlations of SSTA with CHRV R are found to be in some warm SST regions in the tropics, whereas those of SSTA with NC R, which are opposite in sign as compared to the SSTA-CHRV R correlations, are found to be in some regions where the mean SSTs are low. In comparison with the patterns of the contemporaneous correlations, the 1 to 12 month lag correlations between NC R and SSTA, and those between CHRV summer R and SSTA show simi-lar patterns, including the magnitudes and signs, and the spatial distributions of the coefficients. However, the summer rainfall in SC is not well correlated with the SSTA, no matter how long the lag interval is. The results derived from the observations have set up a relationship frame connecting the precipitation anomalies in NC, CHRV, and SC with the SSTA in the global domain, which is criti-cally useful for our understanding and predicting the climate variabilities in different parts of China Both NC and CHRV summer R are connected with El Nino events, showing a'--'pattern in an El Nino year and a'+ +'pattern in the subsequent year.

  16. 3D electrical resistivity inversion using prior spatial shape constraints

    Institute of Scientific and Technical Information of China (English)

    Li Shu-Cai; Nie Li-Chao; Liu Bin; Song Jie; Liu Zheng-Yu; Su Mao-Xin; Xu Lei

    2013-01-01

    To minimize the number of solutions in 3D resistivity inversion, an inherent problem in inversion, the amount of data considered have to be large and prior constraints need to be applied. Geological and geophysical data regarding the extent of a geological anomaly are important prior information. We propose the use of shape constraints in 3D electrical resistivity inversion. Three weighted orthogonal vectors (a normal and two tangent vectors) were used to control the resistivity differences at the boundaries of the anomaly. The spatial shape of the anomaly and the constraints on the boundaries of the anomaly are thus established. We incorporated the spatial shape constraints in the objective function of the 3D resistivity inversion and constructed the 3D resistivity inversion equation with spatial shape constraints. Subsequently, we used numerical modeling based on prior spatial shape data to constrain the direction vectors and weights of the 3D resistivity inversion. We established a reasonable range between the direction vectors and weights, and verified the feasibility and effectiveness of using spatial shape prior constraints in reducing excessive structures and the number of solutions. We applied the prior spatially shape-constrained inversion method to locate the aquifer at the Guangzhou subway. The spatial shape constraints were taken from ground penetrating radar data. The inversion results for the location and shape of the aquifer agree well with drilling data, and the number of inversion solutions is significantly reduced.

  17. Astrometric solar system anomalies

    Energy Technology Data Exchange (ETDEWEB)

    Nieto, Michael Martin [Los Alamos National Laboratory; Anderson, John D [PROPULSION LABORATORY

    2009-01-01

    There are at least four unexplained anomalies connected with astrometric data. perhaps the most disturbing is the fact that when a spacecraft on a flyby trajectory approaches the Earth within 2000 km or less, it often experiences a change in total orbital energy per unit mass. next, a secular change in the astronomical unit AU is definitely a concern. It is increasing by about 15 cm yr{sup -1}. The other two anomalies are perhaps less disturbing because of known sources of nongravitational acceleration. The first is an apparent slowing of the two Pioneer spacecraft as they exit the solar system in opposite directions. Some astronomers and physicists are convinced this effect is of concern, but many others are convinced it is produced by a nearly identical thermal emission from both spacecraft, in a direction away from the Sun, thereby producing acceleration toward the Sun. The fourth anomaly is a measured increase in the eccentricity of the Moon's orbit. Here again, an increase is expected from tidal friction in both the Earth and Moon. However, there is a reported unexplained increase that is significant at the three-sigma level. It is produent to suspect that all four anomalies have mundane explanations, or that one or more anomalies are a result of systematic error. Yet they might eventually be explained by new physics. For example, a slightly modified theory of gravitation is not ruled out, perhaps analogous to Einstein's 1916 explanation for the excess precession of Mercury's perihelion.

  18. 无线自组织网络中多层综合的节点行为异常检测方法%Multi-layer Integrated Anomaly Detection of Mobile Nodes Behaviors in Mobile Ad Hoc Networks

    Institute of Scientific and Technical Information of China (English)

    王涛; 余顺争

    2009-01-01

    Mobile Ad hoc Networks are very vulnerable to malicious attacks due to the nature of mobile computing envi-ronment such as wireless communication channels, limited power and bandwidth, dynamically changing and distributed network topology,etc.The general existing Intrusion Detection Systems (IDS) have provided little evidence that they are applicable to a broader range threats.Based on the generalized and cooperative intrusion detection architecture pro-posed as the foundation for all intrusion detection, we presented an anomaly detection mechanism to discriminate the il-legitimate network behaviors of mobile nodes.By collecting the observation sequences of multiple protocol layers, Hid-den semi-Markov Model (HSMM) was explored to describe the network behaviors of legitimate nodes and to implement the anomaly detection for various malicious attacks.We conducted extensive experiments using the na-2 simulation envi-ronment to evaluate and validate our research.%Ad hoe网络由于采用无线信道、有限的电源和带宽、分布式控制等,会比有线网络更易受到入侵攻击.通常的入侵检测技术具有检测能力单一、缺乏对抗新入侵方式的能力等缺陷.在分布式入侵检测系统(IDS)的基础上,提出一种针对移动节点网络行为的异常检测机制.基于多层综合的观测值序列,采用隐半马尔可夫模型(HSMM)建立描述网络中合法节点正常行为的检测模型,继而对网络中的正常与异常行为进行判断与识别.实验表明,此方法能针对现有多种入侵方式进行有效的检测.

  19. Detection of selenocompounds in a tryptic digest of yeast selenoprotein by MALDI time-of-flight MS prior to their structural analysis by electrospray ionization triple quadrupole MS.

    Science.gov (United States)

    Encinar, Jorge Ruiz; Ruzik, Rafal; Buchmann, William; Tortajada, Jeanine; Lobinski, Ryszard; Szpunar, Joanna

    2003-03-01

    MALDI-TOFMS was proposed as a key technique to a novel generic approach for the speciation analysis of selenium in yeast supplements. Owing to a lower detection limit and superior matrix tolerance to electrospray MS it allowed a successful detection of selenocompounds in samples for which electrospray MS had failed. The analytical approach developed was applied to the identification of a previously unreported selenopentapeptide (m/z 596) in the tryptic digest of a water-soluble selenoprotein fraction isolated by size-exclusion chromatography. The information on the mass of the protonated molecular ion obtained from MALDI allowed the optimization of the conditions for collision induced dissociation MS using a triple quadrupole spectrometer that enabled the determination of the amino acid sequence SeMet-Asn-Ala-Gly-Arg of the selenopeptide.

  20. Detection of a Hobi-like virus in archival samples suggests circulation of this emerging pestivirus species in Europe prior to 2007.

    Science.gov (United States)

    Decaro, Nicola; Mari, Viviana; Lucente, Maria Stella; Sciarretta, Rossana; Elia, Gabriella; Ridpath, Julia F; Buonavoglia, Canio

    2013-12-27

    The first reported incidence of Hobi-like viruses in Europe dates to a 2010 outbreak of respiratory disease in cattle in Italy. In this study, a Hobi-like virus was detected in archival samples, collected in 2007 in Italy from a cattle herd displaying respiratory disease, during the validation of a nested PCR protocol for rapid characterization of bovine pestiviruses. Phylogeny conducted with full-length pestivirus genomes and three informative genomic sequences, placed the strain detected in the samples, Italy-129/07, into the Hobi-like virus branch. Italy-129/07, similar to other Hobi-like viruses isolated in Italy, was more closely related to viruses of South American origin, than Hobi-like viruses of Southeast Asian origin. This suggests a possible introduction of this emerging group of pestiviruses into Italy as a consequence of using contaminated biological products such as fetal bovine serum originating in South America. This report of a Hobi-like virus associated with respiratory disease along with the full-genomic characterization of the virus detected provides new data that contributes to the body of knowledge regarding the epidemiology, pathobiology and genetic diversity of this emerging group of pestiviruses. Importantly, it dates the circulation of Hobi-like viruses in Italy to 2007, at least three years before previous reports.

  1. Major congenital anomalies in babies born with Down syndrome

    DEFF Research Database (Denmark)

    Morris, Joan K; Garne, Ester; Wellesley, Diana;

    2014-01-01

    Previous studies have shown that over 40% of babies with Down syndrome have a major cardiac anomaly and are more likely to have other major congenital anomalies. Since 2000, many countries in Europe have introduced national antenatal screening programs for Down syndrome. This study aimed...... to determine if the introduction of these screening programs and the subsequent termination of prenatally detected pregnancies were associated with any decline in the prevalence of additional anomalies in babies born with Down syndrome. The study sample consisted of 7,044 live births and fetal deaths with Down...... syndrome registered in 28 European population-based congenital anomaly registries covering seven million births during 2000-2010. Overall, 43.6% (95% CI: 42.4-44.7%) of births with Down syndrome had a cardiac anomaly and 15.0% (14.2-15.8%) had a non-cardiac anomaly. Female babies with Down syndrome were...

  2. Adding Papillomacular Bundle Measurements to Standard Optical Coherence Tomography Does Not Increase Sensitivity to Detect Prior Optic Neuritis in Patients with Multiple Sclerosis.

    Directory of Open Access Journals (Sweden)

    Mona Laible

    Full Text Available To improve the detection of retinal nerve fiber layer (RNFL thinning in multiple sclerosis (MS, a special peripapillary ring scanning algorithm (N-site RNFL, N-RNFL was developed for spectral domain optical coherence tomography (SD-OCT. In contrast to the standard protocol (ST-RNFL scanning starts nasally, not temporally, and provides an additional sector of analysis, the papillomacular bundle (PMB. We aimed to ascertain whether the temporal RNFL differs between the two techniques, whether N-RNFL is more sensitive than ST-RNFL to detect previous optic neuritis (ON, and whether analyzing the PMB adds additional sensitivity. Furthermore, we investigated whether RNFL is associated with disease severity and/or disease duration.We conducted a cross-sectional case-control study of 38 patients with MS, of whom 24 had a history of ON, and 40 healthy controls (HC. Subjects with ON within the previous 6 months were excluded. Records included clinical characteristics, visual evoked potentials (VEP, and SD-OCT in both techniques.In a total of 73 evaluable MS eyes, temporal N-RNFL was abnormal in 17.8%, temporal ST-RNFL in 19.2%, and the PMB-RNFL in 21.9%. In ON eyes, the sensitivity of temporal N-RNFL and ST-RNFL did not differ significantly (37.0%/33.3%, p = 0.556. The sensitivity of VEP was 85.2%. RNFL thickness was associated with disease severity in all eyes, with and without a history of ON, and with disease duration.The two OCT techniques detected previous ON with similar sensitivity, but the sensitivity of VEPs was superior to that of both N-RNFL and ST-RNFL. Our results indicate that the widely used ST-RNFL technique is appropriate for peripapillary RNFL measurements in MS patients.

  3. XYY chromosome anomaly and schizophrenia.

    Science.gov (United States)

    Rajagopalan, M; MacBeth, R; Varma, S L

    1998-02-07

    Sex chromosome anomalies have been associated with psychoses, and most of the evidence is linked to the presence of an additional X chromosome. We report a patient with XYY chromosome anomaly who developed schizophrenia.

  4. Anomaly-safe discrete groups

    Energy Technology Data Exchange (ETDEWEB)

    Chen, Mu-Chun, E-mail: muchunc@uci.edu [Department of Physics and Astronomy, University of California, Irvine, CA 92697-4575 (United States); Fallbacher, Maximilian, E-mail: m.fallbacher@tum.de [Physik–Department T30, Technische Universität München, James–Franck–Straße 1, 85748 Garching (Germany); Ratz, Michael, E-mail: michael.ratz@tum.de [Physik–Department T30, Technische Universität München, James–Franck–Straße 1, 85748 Garching (Germany); Trautner, Andreas, E-mail: andreas.trautner@tum.de [Physik–Department T30, Technische Universität München, James–Franck–Straße 1, 85748 Garching (Germany); Excellence Cluster Universe, Boltzmannstraße 2, 85748 Garching (Germany); Vaudrevange, Patrick K.S., E-mail: patrick.vaudrevange@tum.de [Excellence Cluster Universe, Boltzmannstraße 2, 85748 Garching (Germany); TUM Institute for Advanced Study, Lichtenbergstraße 2a, 85748 Garching (Germany); Arnold Sommerfeld Center for Theoretical Physics, Ludwig–Maximilians–Universität München, Theresienstraße 37, 80333 München (Germany)

    2015-07-30

    We show that there is a class of finite groups, the so-called perfect groups, which cannot exhibit anomalies. This implies that all non-Abelian finite simple groups are anomaly-free. On the other hand, non-perfect groups generically suffer from anomalies. We present two different ways that allow one to understand these statements.

  5. Anomaly-safe discrete groups

    Directory of Open Access Journals (Sweden)

    Mu-Chun Chen

    2015-07-01

    Full Text Available We show that there is a class of finite groups, the so-called perfect groups, which cannot exhibit anomalies. This implies that all non-Abelian finite simple groups are anomaly-free. On the other hand, non-perfect groups generically suffer from anomalies. We present two different ways that allow one to understand these statements.

  6. Fialuridine induces acute liver failure in chimeric TK-NOG mice: a model for detecting hepatic drug toxicity prior to human testing.

    Directory of Open Access Journals (Sweden)

    Dan Xu

    2014-04-01

    Full Text Available BACKGROUND: Seven of 15 clinical trial participants treated with a nucleoside analogue (fialuridine [FIAU] developed acute liver failure. Five treated participants died, and two required a liver transplant. Preclinical toxicology studies in mice, rats, dogs, and primates did not provide any indication that FIAU would be hepatotoxic in humans. Therefore, we investigated whether FIAU-induced liver toxicity could be detected in chimeric TK-NOG mice with humanized livers. METHODS AND FINDINGS: Control and chimeric TK-NOG mice with humanized livers were treated orally with FIAU 400, 100, 25, or 2.5 mg/kg/d. The response to drug treatment was evaluated by measuring plasma lactate and liver enzymes, by assessing liver histology, and by electron microscopy. After treatment with FIAU 400 mg/kg/d for 4 d, chimeric mice developed clinical and serologic evidence of liver failure and lactic acidosis. Analysis of liver tissue revealed steatosis in regions with human, but not mouse, hepatocytes. Electron micrographs revealed lipid and mitochondrial abnormalities in the human hepatocytes in FIAU-treated chimeric mice. Dose-dependent liver toxicity was detected in chimeric mice treated with FIAU 100, 25, or 2.5 mg/kg/d for 14 d. Liver toxicity did not develop in control mice that were treated with the same FIAU doses for 14 d. In contrast, treatment with another nucleotide analogue (sofosbuvir 440 or 44 mg/kg/d po for 14 d, which did not cause liver toxicity in human trial participants, did not cause liver toxicity in mice with humanized livers. CONCLUSIONS: FIAU-induced liver toxicity could be readily detected using chimeric TK-NOG mice with humanized livers, even when the mice were treated with a FIAU dose that was only 10-fold above the dose used in human participants. The clinical features, laboratory abnormalities, liver histology, and ultra-structural changes observed in FIAU-treated chimeric mice mirrored those of FIAU-treated human participants. The use

  7. Craniofacial anomalies in twins.

    Science.gov (United States)

    Keusch, C F; Mulliken, J B; Kaplan, L C

    1991-01-01

    Studies of twins provide insight into the relative contribution of genetic and environmental factors in the causality of structural anomalies. Thirty-five affected twin pairs were identified from a group of 1114 patients with congenital craniofacial deformities evaluated from 1972 to 1989. Forty-three of these 70 twins exhibited one or more craniofacial anomalies; these were analyzed for dysmorphic characteristics, zygosity, concordance, and family history. The anomalies were categorized into two groups: malformations and deformations. The malformations (n = 36) included hemifacial microsomia (n = 10), cleft lip and palate (n = 8), cleft palate (n = 4), rare facial cleft (n = 2), craniosynostosis (n = 2), Binder syndrome (n = 2), Treacher Collins syndrome (n = 2), craniopagus (n = 2), CHARGE association (n = 1), frontonasal dysplasia (n = 2), and constricted ears (n = 1). The deformations (n = 7) included plagiocephaly (n = 5), hemifacial hypoplasia (n = 1), and micrognathia (n = 1). Twenty-one monozygotic and 14 dizygotic twin pairs were identified. The concordance rate was 33 percent for monozygotic twins and 7 percent for dizygotic twins.(ABSTRACT TRUNCATED AT 250 WORDS)

  8. Botnet Anomaly Traffic Detection Based on Modified-CUSUM Algorithms%基于改进CUSUM算法的僵尸网络流量异常检测

    Institute of Scientific and Technical Information of China (English)

    来犇; 张怡

    2012-01-01

    The detection of Botnet has become one of the hot spots in network security research. An extinct characteristic of Botnet is to build up C&C channel through which the attacker would be able to send commands to bots and receive the responses. The response action is likely to cause a sudden change in network traffic. Based on the characteristic of the change point, we propose an improved CUSUM algorithm in this paper to detect the change point in network traffic of Botnet. The experiment result shows that the algorithm we proposed is effective to detect the change point in network traffic of Botnet with a higher detection ratio and a higher accuracy.%僵尸网络(Botnet)检测已经成为近年来网络安全领域的研究热点之一,Botnet的一个显著特点是能建立C&C通道,攻击者可以通过这个通道给bots发送命令,并接收与命令相对应的响应,而响应往往会引起网络流量的突变。基于这一特点,本文提出一种改进的CUSUM的算法,对僵尸网络流量中的突变点进行检测。经实验表明,本文所采用的算法是有效的,能有效地检测出流量中的突变点,并且能提高检测速度和准确率。

  9. INVESTIGATION OF NEURAL NETWORK ALGORITHM FOR DETECTION OF NETWORK HOST ANOMALIES IN THE AUTOMATED SEARCH FOR XSS VULNERABILITIES AND SQL INJECTIONS

    Directory of Open Access Journals (Sweden)

    Y. D. Shabalin

    2016-03-01

    Full Text Available A problem of aberrant behavior detection for network communicating computer is discussed. A novel approach based on dynamic response of computer is introduced. The computer is suggested as a multiple-input multiple-output (MIMO plant. To characterize dynamic response of the computer on incoming requests a correlation between input data rate and observed output response (outgoing data rate and performance metrics is used. To distinguish normal and aberrant behavior of the computer one-class neural network classifieris used. General idea of the algorithm is shortly described. Configuration of network testbed for experiments with real attacks and their detection is presented (the automated search for XSS and SQL injections. Real found-XSS and SQL injection attack software was used to model the intrusion scenario. It would be expectable that aberrant behavior of the server will reveal itself by some instantaneous correlation response which will be significantly different from any of normal ones. It is evident that correlation picture of attacks from different malware running, the site homepage overriding on the server (so called defacing, hardware and software failures will differ from correlation picture of normal functioning. Intrusion detection algorithm is investigated to estimate false positive and false negative rates in relation to algorithm parameters. The importance of correlation width value and threshold value selection was emphasized. False positive rate was estimated along the time series of experimental data. Some ideas about enhancement of the algorithm quality and robustness were mentioned.

  10. 基于无监督学习的电力用户异常用电模式检测%Anomaly Detection for Power Consumption Patterns Based on Unsupervised Learning

    Institute of Scientific and Technical Information of China (English)

    庄池杰; 张斌; 胡军; 李秋硕; 曾嵘

    2016-01-01

    The primary purpose of anomaly detection for power consumption patterns is to lower the non-technical losses (NTL), thus reducing the operating costs for power utility. A model based on unsupervised learning was proposed to detect anomaly consumption patterns. This model is suitable for load dataset without training set. The model includes modules of feature extraction, principal component analysis, grid processing, calculation of local outlier factor (LOF), etc. Firstly, various features were extracted from load profiles to characterize consumption patterns of the customers. Then PCA was used to map customers to a two-dimensional plane. This mapping procedure is in favor of data visualization and LOF calculation. The grid processing procedure can screen data in low density region and thus lift calculation efficiency. The output of the model is abnormal degree for all customers'' consumption patterns. The result indicates that with the use of this abnormality sequence, detecting customers with higher LOF rank can find out most abnormal consumption patterns.%检测异常用电模式的主要目的在于降低非技术性损失(non-technical losses,NTL),降低电力公司的运营成本.该文提出了基于无监督学习的异常用电模式检测模型,适用于电力用户数据集缺乏训练样本的情况.该模型包括特征提取、主成分分析、网格处理、计算局部离群因子等模块.首先提取多个表征用户用电模式的特征量,通过主成分分析将每个用户映射到二维平面,实现数据可视化并便于计算局部离群因子.网格处理技术筛选出低密度区域的数据点,显著提升了算法效率.该模型输出所有用户用电行为的异常度及疑似概率排序,研究结果表明利用该排序,只需要检测异常度排序靠前的少数用户即可查出大部分异常用户.

  11. Determination of eight fluoroquinolones in groundwater samples with ultrasound-assisted ionic liquid dispersive liquid-liquid microextraction prior to high-performance liquid chromatography and fluorescence detection.

    Science.gov (United States)

    Vázquez, M M Parrilla; Vázquez, P Parrilla; Galera, M Martínez; García, M D Gil

    2012-10-20

    An ultrasound-assisted ionic liquid dispersive liquid-liquid microextraction (US-IL-DLLME) procedure was developed for the extraction of eight fluoroquinolones (marbofloxacin, norfloxacin, ciprofloxacin, lomefloxacin, danofloxacin, enrofloxacin, oxolinic acid and nalidixic acid) in groundwater, using high-performance liquid chromatography with fluorescence detection (HPLC-FD). The ultrasound-assisted process was applied to accelerate the formation of the fine cloudy solution using a small volume of disperser solvent (0.4 mL of methanol), which increased the extraction efficiency and reduced the equilibrium time. For the DLLME procedure, the IL 1-octyl-3-methylimidazolium hexafluorophosphate ([C(8)MIM] [PF(6)]) and methanol (MeOH) were used as extraction and disperser solvent, respectively. By comparing [C(8)MIM] [PF(6)] with 1-hexyl-3-methylimidazolium hexafluorophosphate ([C(6)MIM] [PF(6)]) and 1-butyl-3-methylimidazolium hexafluorophosphate ([C(4)MIM] [PF(6)]) as extraction solvents, it was observed that when using [C(8)MIM] [PF(6)] the cloudy solution was formed more readily than when using [C(6)MIM] [PF(6)] or [C(4)MIM] [PF(6)]. The factors affecting the extraction efficiency, such as the type and volume of ionic liquid, type and volume of disperser solvent, cooling in ice-water, sonication time, centrifuging time, sample pH and ionic strength, were optimised. A slight increase in the recoveries of fluoroquinolones was observed when an ice-water bath extraction step was included in the analytical procedure (85-107%) compared to those obtained without this step (83-96%). Under the optimum conditions, linearity of the method was observed over the range 10-300 ng L(-1) with correlation coefficient >0.9981. The proposed method has been found to have excellent sensitivity with limit of detection between 0.8 and 13 ng L(-1) and precision with relative standard deviation values between 4.8 and 9.4% (RSD, n=5). Good enrichment factors (122-205) and recoveries (85

  12. Homogeneous Liquid-Liquid Microextraction for Determination of Organophosphorus Pesticides in Environmental Water Samples Prior to Gas Chromatography-Flame Photometric Detection.

    Science.gov (United States)

    Berijani, Sana; Sadigh, Mirhanif; Pournamdari, Elham

    2016-07-01

    In this study, homogeneous liquid-liquid microextraction (HLLME) was developed for preconcentration and extraction of 15 organophosphorus pesticides (OPPs) from water samples coupling with gas chromatography followed by a flame photometric detector (HLLME-GC-FPD). In this method, OPPs were extracted by the homogeneous phase in a ternary solvent system (water/acetic acid/chloroform). The homogeneous solution was excluded by the addition of sodium hydroxide as a phase separator reagent and a cloudy solution was formed. After centrifugation (3 min at 5,000 rpm), the fine particles of extraction solvent (chloroform) were sedimented at the bottom of the conical test tube (10.0 ± 0.5 µL). Furthermore, 0.5 µL of the sedimented phase was injected into the GC for separation and determination of OPPs. Optimal results were obtained under the following conditions: volume of the extracting solvent (chloroform), 53 µL; volume of the consolute solvent (acetic acid), 0.76 mL and concentration of sodium hydroxide, 40% (w/v). Under the optimum conditions, the enrichment factors of (260-665), the extraction percent of 75.8-104%, the dynamic linear range of 0.03-300 µg L(-1) and the limits of detection of 0.004-0.03 µg L(-1) were obtained for the OPPs. This method was successfully applied for the extraction and determination of the OPPs in environmental water samples.

  13. 自组织增量神经网络IDS研究%Network anomaly detection with improved self-organizing incremental neural net-work

    Institute of Scientific and Technical Information of China (English)

    向直扬; 朱俊平

    2014-01-01

    理想的网络入侵检测系统(IDS)是无监督学习的、在线学习的。现有的满足这两个标准的方法训练速度较慢,无法保证入侵检测系统所需要的低丢包率。为了提高训练速度,提出一种基于改进的自组织增量神经网络(improved SOINN)的网络异常检测方法,用于在线地、无监督地训练网络数据分类器;并提出使用三种数据精简(Data Reduction)的方法,包括随机子集选取,k-means聚类和主成分分析的方法,来进一步加速改进的SOINN的训练。实验结果表明,提出的方法在保持较高检测率的前提下,减少了训练时间。%An ideal Intrusion Detection System(IDS)should implement unsupervised learning and online learning. Exist-ing methods suffice these two criterions requires too much training time, which would cause a high packet loss rate and is unacceptable. To overcome the difficulty, an intrusion detection method based on improved Self-Organizing Incremental Neural Network(SOINN)and data reduction is presented, which allows online training of network classifiers in an unsu-pervised fashion. Also, data reduction methods, including random subset selection, k-means clustering, and principle com-ponent analysis are employed to accelerate the training. Experimental results show that the proposed method requires less time in training while maintaining a high detection rate.

  14. Anomaly intrusion detection based on modified SVM%基于改进的SVM方法的异常检测研究

    Institute of Scientific and Technical Information of China (English)

    张辉; 刘成

    2016-01-01

    利用非参数检验的方法提取出对分类结果影响显著的特征变量,提出一种改进的SVM多分类方法(D-SVM),其融合了判别分析,可以解决样本不均衡导致的分类不准确和误报率高的问题。将多分类问题处理成一个个二分类问题,D-SVM既可以保持SVM较好的分类准确性,同时又可以不受样本不均衡的影响,具有较低的误报率。将 D-SVM 应用到 KDD99数据集,结果表明,该方法具有较高的分类准确性和较低的误报率。%A modified SVM multi-classification algorithm integrated with discriminant analysis (D-SVM) was pro-posed, which could solve the problem of low detection accuracy and high false alarm rate caused by unbalanced datasets. For a multi-classification problem could be divided into several binary classification problems, D-SVM could not only have the virtue of high detection accuracy, but also have a low false alarm rate even confronted with unbalanced datasets. Experiments based on KDD99 dataset verify the feasibility and validity of the integrated ap-proach. Results show that when confronted with multi-classification problems, D-SVM could achieve a high detec-tion accuracy and low false alarm rate even when SVM alone fails because of the unbalanced datasets.

  15. Arthur Prior and 'Now'

    DEFF Research Database (Denmark)

    Blackburn, Patrick Rowan; Jørgensen, Klaus Frovin

    2015-01-01

    ’s search led him through the work of Castaneda, and back to his own work on hybrid logic: the first made temporal reference philosophically respectable, the second made it technically feasible in a modal framework. With the aid of hybrid logic, Prior built a bridge from a two-dimensional UT calculus...

  16. 面向Android手机平台异常入侵检测的研究%Research on Android mobile phone platform for anomaly intrusion detection

    Institute of Scientific and Technical Information of China (English)

    杨午圣; 孙敏

    2014-01-01

    With the popularity of smart mobile phone, the harm of intrusion is more and more serious. This paper is, based on the Android smartphone platform, combined with intrusion detection research, to solve the problem of intrusion detection of smartphone. In order to give a reasonable judgment and update the phone as soon as possible, the paper collects the system and the network characteristic data on the Android platform, and uploads them to the remote cloud servers, then analyzes using Support Vector Machine(SVM). The experimental results show that, taking the kind of mechanism not only can reduce resource consumption of smart phones, but also can handle and response the intrusion as quickly as possible.%智能手机应用普及的同时,入侵的危害也越来越严重。针对Android智能手机平台,结合入侵检测的相关研究,解决智能手机入侵检测的问题。采取在Android平台下采集系统和网络特征数据,上传至远程云服务器,在服务器上利用SVM进行分析处理,以给出合理的入侵与否的判断,进而尽快更新手机的处理机制。实验结果表明,既减少了智能手机资源消耗,又能对手机的异常入侵尽快做出反应和处理。

  17. A Correlation between Renal Anomalies and Vesicoureteral Reflux

    Energy Technology Data Exchange (ETDEWEB)

    Kim, Seung Soo; Kim, Young Tong; Kim, Il Young; Shin, Hyeong Cheol [Dept. of Radiology, Cheonan Hospital, Soonchunhyang University College of Medicine, Cheonan (Korea, Republic of)

    2011-12-15

    To investigate the frequency of vesicoureteral reflux (VUR) in children with renal anomalies a evaluate the correlation between renal anomalies and VUR. Eighty-one children (1 day-8 years) with renal anomalies underwent voiding cystourethrogram between 2006 and 2009 were reviewed. This study included ureteropelvic junction stenosis (n = 32), ureteropelvic duplication (n = 20), multicystic dysplastic kidney (n = 12), fusion anomaly (n = 11), renal agenesis (n = 3), unilateral renal hypoplasia (n = 2), and ectopic kidney (n = 1). The frequency, grade, and location of VUR were evaluated. The grade of VUR according to age and anomaly type was statistically analyzed, and the patients with VUR were followed. The VUR was present in 14 (17.3%); ipsilateral VUR was present in 8 (57.1%), bilateral VUR in 4 (28.6%), and contralateral VUR in 2 (14.2%). VUR was detected in 9 patients under the age of one. There was no statistical correlation between VUR grade and either age or anomaly type of the nine patients showed continuous VUR on up. The frequency of VUR in children with renal anomalies was 17.3%. VUR was most frequently detected in children under the age of one, and VUR grade was not related to age and anomaly type.

  18. Chiral supergravity and anomalies

    CERN Document Server

    Mielke, E W; Macias, Alfredo; Mielke, Eckehard W.

    1999-01-01

    Similarily as in the Ashtekar approach, the translational Chern-Simons term is, as a generating function, instrumental for a chiral reformulation of simple (N=1) supergravity. After applying the algebraic Cartan relation between spin and torsion, the resulting canonical transformation induces not only decomposition of the gravitational fields into selfdual and antiselfdual modes, but also a splitting of the Rarita-Schwinger fields into their chiral parts in a natural way. In some detail, we also analyze the consequences for axial and chiral anomalies.

  19. Low Risk Anomalies?

    DEFF Research Database (Denmark)

    Schneider, Paul; Wagner, Christian; Zechner, Josef

    This paper shows theoretically and empirically that beta- and volatility-based low risk anomalies are driven by return skewness. The empirical patterns concisely match the predictions of our model that endogenizes the role of skewness for stock returns through default risk. With increasing downside...... of betting against beta/volatility among low skew firms compared to high skew firms is economically large. Our results suggest that the returns to betting against beta or volatility do not necessarily pose asset pricing puzzles but rather that such strategies collect premia that compensate for skew risk...

  20. [Fetal ocular anomalies: the advantages of prenatal magnetic resonance imaging].

    Science.gov (United States)

    Brémond-Gignac, D; Copin, H; Elmaleh, M; Milazzo, S

    2010-05-01

    Congenital ocular malformations are uncommon and require prenatal diagnosis. Severe anomalies are more often detected by trained teams and minor anomalies are more difficult to identify and must be systematically sought, particularly when multiple malformations or a family and maternal history is known. The prenatal diagnosis-imaging tool most commonly used is ultrasound but it can be completed by magnetic resonance imaging (MRI), which contributes crucial information. Fetal dysmorphism can occur in various types of dysfunction and prenatal diagnosis must recognize fetal ocular anomalies. After systematic morphologic ultrasound imaging, different abnormalities detected by MRI are studied. Classical parameters such as binocular and interorbital measurements are used to detect hypotelorism and hypertelorism. Prenatal ocular anomalies such as cataract microphthalmia, anophthalmia, and coloboma have been described. Fetal MRI added to prenatal sonography is essential in detecting cerebral and general anomalies and can give more information on the size and morphology of the eyeball. Fetal abnormality detection includes a detailed family and maternal history, an amniotic fluid sample for karyotype, and other analyses for a better understanding of the images. Each pregnancy must be discussed with all specialists for genetic counseling. With severe malformations, termination of pregnancy is proposed because of risk of blindness and associated cerebral or systemic anomalies. Early prenatal diagnosis of ocular malformations can also detect associated abnormalities, taking congenital cataracts that need surgical treatment into account as early as possible. Finally, various associated syndromes need a pediatric check-up that could lead to emergency treatment.

  1. A study of associated congenital anomalies with biliary atresia

    Directory of Open Access Journals (Sweden)

    Lucky Gupta

    2016-01-01

    Full Text Available Background/Purpose: This study aims to analyze the incidence and type of various associated anomalies among infants with extrahepatic biliary atresia (EHBA, compare their frequency with those quoted in the existing literature and assess their role in the overall management. Materials and Methods: A retrospective study was performed on 137 infants who underwent the Kasai procedure for EHBA during the past 12 years. The medical records were reviewed for the incidence and type of associated anomalies in addition to the details of the management of the EHBA. Results: Of the137 infants, 40 (29.2% were diagnosed as having 58 anomalies. The majority of patients had presented in the 3 rd month of life; mean age was 81 ± 33 days (range = 20-150 days. There were 32 males and 8 females; boys with EHBA had a higher incidence of associated anomalies. Of these 40 patients, 22 (37.9% had vascular anomalies, 13 patients (22.4% had hernias (umbilical-10, inguinal-3, 7 patients (12.1% had intestinal malrotation, 4 patients (6.8% had choledochal cyst, 1 patient (1.7% had Meckel′s diverticulum, 3 patients (5% had undergone prior treatment for jejunoileal atresias (jejunal-2, ileal-1, 2 patients (3.4% had undergone prior treatment for esophageal atresia and tracheoesophageal fistula, 2 patients (3.4% had spleniculi, and 2 patients (3.4% were diagnosed as having situs inversus. Conclusions: The most common associated anomalies in our study were related to the vascular variation at the porta hepatis and the digestive system. The existence of anomalies in distantly developing anatomic regions in patients with EHBA supports the possibility of a "generalized" insult during embryogenesis rather than a "localized" defect. In addition, male infants were observed to have significantly more associated anomalies as compared with the female infants in contrast to earlier reports.

  2. 自适应的Web攻击异常检测方法%Adaptive anomaly detection method of Web-based attacks

    Institute of Scientific and Technical Information of China (English)

    温凯; 郭帆; 余敏

    2012-01-01

    针对传统建模容易引入不可信样本的问题,提出了一种自适应建立基于Web攻击异常检测模型的方法.依据样本中Request-URL的结构特征对样本集进行分类,并利用样本的各属性来构造样本分类子集的离散性函数,其中离散程度值将作为识别正常行为集的依据;在此基础上,使用改进的隐马尔可夫模型(HMM)算法对正常行为样本集进行建模,并利用HMM合并的方法实现检测模型的动态更新.实验结果表明,所提方法建立的模型能够有效地识别出Web攻击请求,并降低检测的误报率.%Concerning the problem that untrusted sample can be easily introduced in traditional methods, an adaptive model was proposed in this paper. Based on the description of the structural feature of Request-URL, a whole sample set was divided into smaller subsets. The discreteness of a subset was calculated by its properties, which would determine whether the subset is normal. On basis of these, the detection model was created by the improved algorithm with the normal subsets, and dynamic update of model was achieved by Hidden Markov Model (HMM) merging. The experimental results show thai the adaptive model built by the proposed method can effectively identify Web-based attacks and reduce false alert ratio.

  3. A Framework for Security Components Anomalies Severity Evaluation and Classification

    Directory of Open Access Journals (Sweden)

    Kamel Karoui

    2013-07-01

    Full Text Available Security components such as firewalls, IDS and IPS, are the most widely adopted security devices fornetwork protection.These components are often implemented with several errors (or anomalies that aresometimes critical. To ensure the security of their networks, administrators should detect these anomaliesand correct them. Before correcting the detected anomalies, the administrator should evaluate and classifythese latter to determine the best strategy to correct them. In this work, we propose a framework to assessand classify the detected anomalies using a three evaluation criteria: a quantitative evaluation, a semanticevaluation and multi-anomalies evaluation. The proposed process, convenient in an audit process, will bedetailed by a case study to demonstrate its usefulness

  4. Anomaly indicators for time-reversal symmetric topological orders

    CERN Document Server

    Wang, Chenjie

    2016-01-01

    Some time-reversal symmetric topological orders are anomalous in that they cannot be realized in strictly two-dimensions without breaking time reversal symmetry; instead, they can only be realized on the surface of certain three-dimensional systems. We propose two quantities, which we call {\\it anomaly indicators}, that can detect if a time-reversal symmetric topological order is anomalous in this sense. Both anomaly indicators are expressed in terms of the quantum dimensions, topological spins, and time-reversal properties of the anyons in the given topological order. The first indicator, $\\eta_2$, applies to bosonic systems while the second indicator, $\\eta_f$, applies to fermionic systems in the DIII class. We conjecture that $\\eta_2$, together with a previously known indicator $\\eta_1$, can detect the two known $\\mathbb Z_2$ anomalies in the bosonic case, while $\\eta_f$ can detect the $\\mathbb Z_{16}$ anomaly in the fermionic case.

  5. Combined application of alpha-track and fission-track techniques for detection of plutonium particles in environmental samples prior to isotopic measurement using thermo-ionization mass spectrometry.

    Science.gov (United States)

    Lee, Chi-Gyu; Suzuki, Daisuke; Esaka, Fumitaka; Magara, Masaaki; Kimura, Takaumi

    2011-07-15

    The fission track technique is a sensitive detection method for particles which contain radio-nuclides like (235)U or (239)Pu. However, when the sample is a mixture of plutonium and uranium, discrimination between uranium particles and plutonium particles is difficult using this technique. In this study, we developed a method for detecting plutonium particles in a sample mixture of plutonium and uranium particles using alpha track and fission track techniques. The specific radioactivity (Bq/g) for alpha decay of plutonium is several orders of magnitude higher than that of uranium, indicating that the formation of the alpha track due to alpha decay of uranium can be disregarded under suitable conditions. While alpha tracks in addition to fission tracks were detected in a plutonium particle, only fission tracks were detected in a uranium particle, thereby making the alpha tracks an indicator for detecting particles containing plutonium. In addition, it was confirmed that there is a linear relationship between the numbers of alpha tracks produced by plutonium particles made of plutonium certified standard material and the ion intensities of the various plutonium isotopes measured by thermo-ionization mass spectrometry. Using this correlation, the accuracy in isotope ratios, signal intensity and measurement errors is presumable from the number of alpha tracks prior to the isotope ratio measurements by thermal ionization mass spectrometry. It is expected that this method will become an effective tool for plutonium particle analysis. The particles used in this study had sizes between 0.3 and 2.0 μm.

  6. 基于 PSO-SVM算法的环境监测数据异常检测和缺失补全%Anomaly Detection and Missing Completion of Environment Monitoring Data based on PSO-SVM

    Institute of Scientific and Technical Information of China (English)

    魏晶茹; 马瑜; 白冰; 任贵召; 贺青

    2016-01-01

    For problems of abnormal data and missing data in environmental monitoring, an anomaly detec-tion and data missing completion algorithm was presented based on particle swarm optimization with support vec-tor machine ( PSO-SVM) .Non-linear SVM model was established by applying the PSO algorithm in selecting the appropriate training parameter set and fitting prediction of real data.Taking the experimental data from a sewage plant in Ningxia Hui Autonomous Region, the predictions by this algorithm had the accuracy rate of 97.977%, showing high accuracy in abnormal data detection and missing data completion.%针对环境监测数据异常和数据缺失问题,提出了基于支持向量机的粒子群优化数据异常检测和缺失补全算法。利用粒子群优化算法选取较优的支持向量机训练参数组合,以此建立非线性的支持向量机模型,并利用结果模型对测得的真实数据拟合预测。以宁夏回族自治区某污水处理厂的污染物测量数据作为实验数据,结果表明,利用该算法预测数据的准确率可达97.977%,检测异常数据准确度高,缺失数据补全正确。

  7. Quivers via anomaly chains

    Energy Technology Data Exchange (ETDEWEB)

    Casero, Roberto [Dipartimento di Fisica, Universita di Milano-Bicocca, Piazza della Scienza, 3, 20126 Milan (Italy)]. E-mail: roberto.casero@mib.infn.it; Trincherini, Enrico [Dipartimento di Fisica, Universita di Milano-Bicocca, Piazza della Scienza, 3, 20126 Milan (Italy)

    2003-09-01

    We study quivers in the context of matrix models. We introduce chains of generalized Konishi anomalies to write the quadratic and cubic equations that constrain the resolvents of general affine A-circumflex{sub n-1} and non-affine A{sub n} quiver gauge theories, and give a procedure to calculate all higher-order relations. For these theories we also evaluate, as functions of the resolvents, VEV's of chiral operators with two and four bi-fundamental insertions. As an example of the general procedure we explicitly consider the two simplest quivers A{sub 2} and A-circumflex{sub 1}, obtaining in the first case a cubic algebraic curve, and for the affine theory the same equation as that of U(N) theories with adjoint matter, successfully reproducing the RG cascade result. (author)

  8. Quivers via anomaly chains

    CERN Document Server

    Casero, R; Casero, Roberto; Trincherini, Enrico

    2003-01-01

    We study quivers in the context of matrix models. We introduce chains of generalized Konishi anomalies to write the quadratic and cubic equations that constrain the resolvents of general affine and non-affine quiver gauge theories, and give a procedure to calculate all higher-order relations. For these theories we also evaluate, as functions of the resolvents, VEV's of chiral operators with two and four bifundamental insertions. As an example of the general procedure we explicitly consider the two simplest quivers A2 and A1(affine), obtaining in the first case a cubic algebraic curve, and for the affine theory the same equation as that of U(N) theories with adjoint matter, successfully reproducing the RG cascade result.

  9. Cubic anomalies in WMAP

    CERN Document Server

    Land, K; Land, Kate; Magueijo, Joao

    2004-01-01

    We perform a frequentist analysis of the bispectrum of WMAP first year data. We find clear signal domination up to l=200, with overall consistency with Gaussianity except for the following features. There is a flat patch (i.e. a low chi-squared region) in the same-l components of the bispectrum spanning the range l=32-62; this may be interpreted as ruling out Gaussianity at the 99.6% confidence level. There is also an asymmetry between the North and South inter-l bispectrum components at the 99% confidence level. The preferred asymmetry axis correlates well with the (l,b)=(57,10) direction quoted in the literature for asymmetries in the power spectrum and three-point correlation function. However our analysis of the quadrupole (its bispectrum and principal axes) fail to make contact with previously claimed anomalies.

  10. Turtle carapace anomalies: the roles of genetic diversity and environment.

    Directory of Open Access Journals (Sweden)

    Guillermo Velo-Antón

    Full Text Available BACKGROUND: Phenotypic anomalies are common in wild populations and multiple genetic, biotic and abiotic factors might contribute to their formation. Turtles are excellent models for the study of developmental instability because anomalies are easily detected in the form of malformations, additions, or reductions in the number of scutes or scales. METHODOLOGY/PRINCIPAL FINDINGS: In this study, we integrated field observations, manipulative experiments, and climatic and genetic approaches to investigate the origin of carapace scute anomalies across Iberian populations of the European pond turtle, Emys orbicularis. The proportion of anomalous individuals varied from 3% to 69% in local populations, with increasing frequency of anomalies in northern regions. We found no significant effect of climatic and soil moisture, or climatic temperature on the occurrence of anomalies. However, lower genetic diversity and inbreeding were good predictors of the prevalence of scute anomalies among populations. Both decreasing genetic diversity and increasing proportion of anomalous individuals in northern parts of the Iberian distribution may be linked to recolonization events from the Southern Pleistocene refugium. CONCLUSIONS/SIGNIFICANCE: Overall, our results suggest that developmental instability in turtle carapace formation might be caused, at least in part, by genetic factors, although the influence of environmental factors affecting the developmental stability of turtle carapace cannot be ruled out. Further studies of the effects of environmental factors, pollutants and heritability of anomalies would be useful to better understand the complex origin of anomalies in natural populations.

  11. DESIGN AND IMPLEMENTATION OF OPENSTACK-BASED ADAPTIVE ANOMALY DETECTION MODEL%基于OpenStack的自适应异常检测模型的设计与实现

    Institute of Scientific and Technical Information of China (English)

    熊辉; 吕智慧; 张世永

    2015-01-01

    云计算是通过Internet以服务的方式提供动态可伸缩的虚拟化资源的计算模式,所提供的服务基于现有标准化的网络协议,具有特定的格式及标准。然而现有技术和标准协议所存在的安全隐患为非法分子敞开了入侵的大门。基于支持向量机SVM和主成分分析方法PCA提出云环境中自适应异常检测模型CAPS(Cloud Adaptive PCA-SVM),基于OpenStack真实云平台数据,采用PCA进行数据降维,利用SVM分类器,将疑似异常提交至云安全管理员进行确认,不断对所构造的分类器进行迭代,能够对历史数据自适应检测。实验表明,所提出的CAPS具有以下优点:(1)与标准SVM相比,自适应过程和平均迭代时间花费较少,效率较高;(2)与经典的异常检测方法相比,在真实云环境中在较低的误报率下能达到较高的检测率。%Cloud computing is a computing mode which provides dynamical and scalable resources of virtualisation by means of services through Internet.The cloud services provided are based on existing normalised networks protocols and have specific formats and criteria. However current technologies and standard protocols exist security pitfalls,which open the door of invasion for illegal attackers.This paper comes up with CAPS (cloud adaptive PCA-SVM)model based on support vector machine (SVM)and primary component analysis (PCA). According to the data on OpenStack real cloud platform,the model uses PCA for data dimensionality reduction and adopts SVM classifier to submit the suspected anomalies to cloud security operator for verification.By constant iteration of the constructed classifier it is able to make adaptive detection on historical data.Experiment shows that the proposed CAPS has following strengths:(1 )Time consumption of adaptation process and average iteration is lower than standard SVM,and the efficiency is higher.(2)Achieving higher detection rate with lower

  12. Stream Processing Method and Condition Monitoring Anomaly Detection for Big Data in Smart Grid%智能电网大数据流式处理方法与状态监测异常检测

    Institute of Scientific and Technical Information of China (English)

    王德文; 杨力平

    2016-01-01

    In view of the characteristics of smart grid , such as instantaneity , volatility , disorder , etc . , a real ‐time stream processing framework of big data in the smart grid is proposed . The framework can realize data collection , data buffer and flow calculation , so as to meet the fast processing need , such as condition monitoring anomaly detection and analysis of electric behaviors . In order to solve the problem of inconsistency in the speed of data acquisition and flow calculation , the data source change is monitored , while the data are collected in real‐time and buffered by using the message subscription mode . A Storm‐based sliding window processing approach to monitoring the data stream is proposed to process the condition monitoring data stream in batches within the specified time , while ensuring continuous data computation and detecting abnormality by threshold determination . Experimental results show that , under the condition of a definite cluster size , appropriately changing the number of working processes and the number of concurrent execution threads can increase the tuple throughput of sliding window and improve the real‐time processing efficiency of condition monitoring anomaly detection .%针对智能电网大数据流的实时性、易失性、无序性等特点,提出智能电网大数据的实时流处理框架,实现数据收集、数据缓冲与流式计算,满足状态监测异常检测与用电数据分析等快速处理需要。通过采集系统节点监听数据源变化并实时收集数据,利用消息订阅模式对数据进行缓冲,解决数据采集与流式计算速度不一致的问题。提出一种基于 Storm 的状态监测数据流滑动窗口处理方法,在规定时间内分批处理状态监测数据流,保证数据的连续计算,通过阈值判断进行异常检测。实验结果表明,在集群规模一定的条件下,适当地改变工作进程数以及执行器线程的并发数设

  13. Algebraic study of chiral anomalies

    Indian Academy of Sciences (India)

    Juan Mañes; Raymond Stora; Bruno Zumino

    2012-06-01

    The algebraic structure of chiral anomalies is made globally valid on non-trivial bundles by the introduction of a fixed background connection. Some of the techniques used in the study of the anomaly are improved or generalized, including a systematic way of generating towers of ‘descent equations’.

  14. What is a Timing Anomaly?

    DEFF Research Database (Denmark)

    Cassez, Franck; Hansen, Rene Rydhof; Olesen, Mads Chr.

    2012-01-01

    Timing anomalies make worst-case execution time analysis much harder, because the analysis will have to consider all local choices. It has been widely recognised that certain hardware features are timing anomalous, while others are not. However, defining formally what a timing anomaly is, has bee...

  15. Anomaly mediation deformed by axion

    Energy Technology Data Exchange (ETDEWEB)

    Nakayama, Kazunori, E-mail: kazunori@hep-th.phys.s.u-tokyo.ac.jp [Department of Physics, University of Tokyo, Bunkyo-ku, Tokyo 113-0033 (Japan); Kavli Institute for the Physics and Mathematics of the Universe, University of Tokyo, Kashiwa 277-8583 (Japan); Yanagida, Tsutomu T. [Kavli Institute for the Physics and Mathematics of the Universe, University of Tokyo, Kashiwa 277-8583 (Japan)

    2013-05-13

    We show that in supersymmetric axion models the axion supermultiplet obtains a sizable F-term due to a non-supersymmetric dynamics and it generally gives the gaugino masses comparable to the anomaly mediation contribution. Thus the gaugino mass relation predicted by the anomaly mediation effect can be significantly modified in the presence of axion to solve the strong CP problem.

  16. Local inversion of magnetic anomalies: Implication for Mars' crustal evolution

    OpenAIRE

    Quesnel, Yoann; Langlais, Benoit; Sotin, Christophe

    2007-01-01

    International audience; Martian magnetic anomalies have been revealed by the Mars Global Surveyor (MGS) mission in the south hemisphere of Mars. The present study models anomalies located in the ancient Terra Sirenum area between latitudes 26°S and 40°S and longitudes 185°E and 210°E using forward and inverse approaches. While the high-altitude measurements reveal the presence of two main magnetic anomalies, three are detected by low-altitude data. They are modeled as uncorrelated dipolar sou...

  17. Text Anomalies Detection Using Histograms of Words

    Directory of Open Access Journals (Sweden)

    Abdulwahed Faraj Almarimi

    2016-01-01

    Full Text Available Authors of written texts mainly can be characterized by some collection of attributes obtained from texts. Texts of the same author are very similar from the style point of view. We can consider that attributes of a full text are very similar to attributes of parts in the same text. In the same thoughts can be compared different parts of the same text. In the paper, we describe an algorithm based on histograms of a mapped text to interval. In the mapping, it is kipped the word order as in the text. Histograms are analyzed from a cluster point of view. If a cluster dispersion is not large, the text is probably written by the same author. If the cluster dispersion is large, the text will be split in two or more parts and the same analysis will be done for the text parts.  The experiments were done on English and Arabic texts. For combined English texts our algorithm covers that texts were not written by one author. We have got the similar results for combined Arabic texts. Our algorithm can be used to basic text analysis if the text was written by one author.       

  18. Recurring Anomaly Detection System (ReADS)

    Data.gov (United States)

    National Aeronautics and Space Administration — Overview: ReADS can analyze text reports, such as aviation reports and problem or maintenance records. ReADS uses text clustering algorithms to group loosely related...

  19. Anomaly Detection at Multiple Scales (ADAMS)

    Science.gov (United States)

    2011-11-09

    must resort to generating their own data that simulates insider attacks. The Schonlau dataset is the most widely used for academic study. It...measurements are estimated by well-known software plagiarism tools . 39 As explained above, there are many different techniques for code trans- formation

  20. Compressive Hyperspectral Imaging and Anomaly Detection

    Science.gov (United States)

    2010-02-01

    Examples include the discrete cosine basis and various wavelets based bases. They have been thoroughly studied and widely considered in applications...the desired jointly sparse a"s, one shall adjust a and b. 4.4 Hyperspectral Image Reconstruction and Denoising We apply the model x* = Da’ + e! to...iteration for compressive sensing and sparse denoising ,’" Communications in Mathematical Sciences , 2008. W. Yin, "Analysis and generalizations of

  1. A Semiparametric Model for Hyperspectral Anomaly Detection

    Science.gov (United States)

    2012-01-01

    statistical power of detectors (this is specially the case in LWIR (longwave infrared) HS imagery where the radiance values observed in calibrated data... calibration , acquisition geometry, and contamination from adjacent objects (see, for instance, the discussion in [5, 6]), have led to the development...behaves as a blackbody in the LWIR region of the electromagnetic spectrum (note: there is a whole topic of study in mathematical statistics on feature

  2. Advanced Ground Systems Maintenance Anomaly Detection Project

    Data.gov (United States)

    National Aeronautics and Space Administration — This project will develop the capability to identify anomalous conditions (indications to potential impending system failure) in ground system operations before such...

  3. Anomaly Detection in a Fleet of Systems

    Data.gov (United States)

    National Aeronautics and Space Administration — A fleet is a group of systems (e.g., cars, aircraft) that are designed and manufactured the same way and are intended to be used the same way. For example, a fleet...

  4. Detection of Anomalies in Diaphragm Walls

    NARCIS (Netherlands)

    Spruit, R.; Van Tol, F.; Broere, W.

    2015-01-01

    If a calamity with a retaining wall occurs, the impact on surrounding buildings and infrastructure is at least an order of magnitude more severe than without the calamity. In 2005 and 2006 major leaks in the retaining walls of underground stations in Amsterdam and Rotterdam occurred. After these cas

  5. To detect anomalies in diaphragm walls

    NARCIS (Netherlands)

    Spruit, R.

    2015-01-01

    Diaphragm walls are potentially ideal retaining walls for deep excavations in densely built-up areas, as they cause no vibrations during their construction and provide structural elements with high strength and stiffness. In the recent past, however, several projects using diaphragm walls as soil an

  6. 云环境下 SDN 的流量异常检测性能分析%Performance Analysis of Traffic Anomaly Detection in Cloud-based Software-defined Network

    Institute of Scientific and Technical Information of China (English)

    马超; 程力; 孔玲玲

    2015-01-01

    The increasing complexity of hybrid cloud networks becomes a bottleneck of cloud computing.As a potential solution, SDN has gained great attentions from both industry and academia, especially in the network security domain.Research on utili-zing SDN in network attack detection is still in its inception phase.Specifically, it has not been evaluated whether SDN can effi-ciently detect internal network attacks in a cloud environment.In this research we implement both SDN and traditional network in-frastructures based on OpenStack platform.We simulate both flood and port-scan attacks and utilize two types of traffic anomaly detection algorithms.Experiment results indicate that the SDN method shows better performance in memory usage without degrad-ing its accuracy, while it also suffers performance bottleneck when directly deployed into SDN controllers.%随着复杂的混合云网络逐渐成为云计算发展的瓶颈,软件定义网络( SDN)技术近年来成为学术界和工业界关注的热点。在网络安全领域,对于应用SDN来解决网络攻击的研究尚处于起步阶段,SDN是否能够高效检测来自内部的网络攻击尚无定论。针对该问题,在分析SDN技术框架的基础上,设计基于OpenStack的云环境实验方案。在传统云环境网络和SDN环境下同时测试2种流量异常检测算法,模拟Flood攻击和端口扫描攻击,分析SDN在检测攻击时的精确度和资源使用率。结果表明,在云环境下利用SDN检测内部威胁时比传统网络环境占用更少的物理内存而不影响精确度,但直接在SDN控制器上部署安全应用的方式也存在性能瓶颈。

  7. 用BP神经网络技术探测汶川地震前电离层NmF2异常扰动%IONOSPHERIC ELECTRON DENSITY ANOMALIES DETECTED BY BP ARTIFICIAL NEURAL NETWORK BEFORE WENCHUAN EARTHQUAKE

    Institute of Scientific and Technical Information of China (English)

    熊晶; 吴云; 林剑

    2013-01-01

    On the basis of the F2 layer peak electron density ( NmF2) from University Corporation for Atmospheric Research (UCAR) , we constructed a Back Propogation(BP) artificial neural network (ANN) in order to detect pre-earthquake anomalies for the first time. The ANN provides NmF2 model value with five parameters: DOY, local time(LT) , longitude ( LON ) , latitude ( LAT) and solar activity index of F10. 7 (FLUX). We compare the model value with observations during the Wenchuan earthquake. It is found that NmF2 around the forthcoming epicenter decreased remarkably in the afternoon period of day 6 -4 before the earthquake, but enhanced day 3 -2 before the earthquake.%基于UCAR公布的电离层F2层最大电子密度数据NmF2,利用人工神经网络技术,构建局部地区NmF2模型.以年积日DOY、当地时LT、经度LON、纬度LAT和F10.7太阳活动指数FLUX为网络输入,以NmF2为网络输出,提供磁平静期NmF2模型值作为参考背景,通过模型值与观测值的比较,发现2008年5月12日汶川7.9级地震前震中附近上空NmF2在震前第6~4天(6-8日)减小约30%,震前第3~2天(9-10日)明显增大约40%.

  8. Anomaly Mediation and Cosmology

    CERN Document Server

    Basboll, A; Jones, D R T

    2011-01-01

    We consider an extension of the MSSM wherein anomaly mediation is the source of supersymmetry-breaking, and the tachyonic slepton problem is solved by a Fayet-Iliopoulos (FI) $D$-term associated with an additional $U(1)$ symmetry, which also facilitates the see-saw mechanism for neutrino masses and a natural source for the Higgs $\\mu$-term. We explore the cosmological consequences of the model, showing that the model naturally produces a period of hybrid inflation, terminating in the production of cosmic strings. In spite of the presence of a $U(1)$ with an FI term, inflation is effected by the $F$-term, with a $D$-flat tree potential (the FI term being cancelled by non-zero squark and slepton fields). Calculating the 1-loop corrections to the inflaton potential, we estimate the constraints on the parameters of the model from Cosmic Microwave Background data. We briefly discuss the mechanisms for baryogenesis via conventional leptogenesis, the out-of-equilibrium production of neutrinos from the cosmic strings...

  9. Prevalence and distribution of selected dental anomalies among saudi children in Abha, Saudi Arabia

    Science.gov (United States)

    2016-01-01

    Background Dental anomalies are not an unusual finding in routine dental examination. The effect of dental anomalies can lead to functional, esthetic and occlusal problems. The Purpose of the study was to determine the prevalence and distribution of selected developmental dental anomalies in Saudi children. Material and Methods The study was based on clinical examination and Panoramic radiographs of children who visited the Pediatric dentistry clinics at King Khalid University College of Dentistry, Saudi Arabia. These patients were examined for dental anomalies in size, shape, number, structure and position. Data collected were entered and analyzed using statistical package for social sciences version. Results Of the 1252 children (638 Boys, 614 girls) examined, 318 subjects (25.39%) presented with selected dental anomalies. The distribution by gender was 175 boys (27.42%) and 143 girls (23.28%). On intergroup comparison, number anomalies was the most common anomaly with Hypodontia (9.7%) being the most common anomaly in Saudi children, followed by hyperdontia (3.5%). The Prevalence of size anomalies were Microdontia (2.6%) and Macrodontia (1.8%). The prevalence of Shape anomalies were Talon cusp (1.4%), Taurodontism (1.4%), Fusion (0.8%).The prevalence of Positional anomalies were Ectopic eruption (2.3%) and Rotation (0.4%). The prevalence of structural anomalies were Amelogenesis imperfecta (0.3%) Dentinogenesis imperfecta (0.1%). Conclusions A significant number of children had dental anomaly with Hypodontia being the most common anomaly and Dentinogenesis imperfecta being the rare anomaly in the study. Early detection and management of these anomalies can avoid potential orthodontic and esthetic problems in a child. Key words:Dental anomalies, children, Saudi Arabia. PMID:27957258

  10. Spatially-Aware Temporal Anomaly Mapping of Gamma Spectra

    CERN Document Server

    Reinhart, Alex; Biegalski, Steven

    2014-01-01

    For security, environmental, and regulatory purposes it is useful to continuously monitor wide areas for unexpected changes in radioactivity. We report on a temporal anomaly detection algorithm which uses mobile detectors to build a spatial map of background spectra, allowing sensitive detection of any anomalies through many days or months of monitoring. We adapt previously-developed anomaly detection methods, which compare spectral shape rather than count rate, to function with limited background data, allowing sensitive detection of small changes in spectral shape from day to day. To demonstrate this technique we collected daily observations over the period of six weeks on a 0.33 square mile research campus and performed source injection simulations.

  11. Methods and Systems for Characterization of an Anomaly Using Infrared Flash Thermography

    Science.gov (United States)

    Koshti, Ajay M. (Inventor)

    2013-01-01

    A method for characterizing an anomaly in a material comprises (a) extracting contrast data; (b) measuring a contrast evolution; (c) filtering the contrast evolution; (d) measuring a peak amplitude of the contrast evolution; (d) determining a diameter and a depth of the anomaly, and (e) repeating the step of determining the diameter and the depth of the anomaly until a change in the estimate of the depth is less than a set value. The step of determining the diameter and the depth of the anomaly comprises estimating the depth using a diameter constant C.sub.D equal to one for the first iteration of determining the diameter and the depth; estimating the diameter; and comparing the estimate of the depth of the anomaly after each iteration of estimating to the prior estimate of the depth to calculate the change in the estimate of the depth of the anomaly.

  12. Detection of Numerical Chromosomal Anomalies in Spontaneous Abortion by Fluorescent in situ Hybridization%FISH技术在检测自然流产绒毛组织非整倍体异常中的应用研究

    Institute of Scientific and Technical Information of China (English)

    周佳; 蔡彩萍; 姚红霞; 骆敏; 郭茗; 杨颖俊; 孙路明

    2013-01-01

    Objective:To study the clinical value of fluorescent in situ hybridization (FISH) detection method for numerical chromosomal anomalies in spontaneous abortion and to evaluate its efficiency compared with the classic method of karyotyping.Methods:A total of 157 patients who suffered from spontaneous abortion were observed.All of these cases were detected chromosome 16,22,13,21,18,X and Y by FISH.The chorionic villi samples (CVS) were cultured for chromosome analysis at the same time.Results:Seventy-six samples were successfully karyotyped,while the success rate of FISH was 100%.For the two methods,64 cases matched perfectly,and the corresponding rate of FISH to karyotyping was 84.2%.Conclusion:FISH provides a diagnosis for spontaneous abortion because of rapid,easy to carry out and higher successful rate.Although FISH can not substitute the traditional karyotping,it can be a supplementary method to traditional kayotyping.%目的:探讨运用荧光原位杂交(FISH)检测自然流产绒毛组织的临床价值,评价它与传统经典的核型分析方法的关系.方法:对157例孕早期自然流产的绒毛组织进行FISH检测,均采用16、22、13、21、18、X、Y号染色体荧光探针检测,判断染色体非整倍体异常情况.同时进行绒毛细胞培养染色体核型分析,作为对照诊断标准.结果:核型分析成功率为48.4%,FISH检测成功率为100%.核型分析成功的76例样本中,64例结果与核型分析结果相一致,以细胞遗传学作为诊断标准,诊断的符合率为84.2%.结论:FISH技术与传统的绒毛细胞培养染色体核型分析相比,过程迅速,方法简单,提高了诊断的成功率,但无法完全取代传统的染色体核型分析,应两者结合应用于临床.

  13. Discovering System Health Anomalies Using Data Mining Techniques

    Science.gov (United States)

    Sriastava, Ashok, N.

    2005-01-01

    We present a data mining framework for the analysis and discovery of anomalies in high-dimensional time series of sensor measurements that would be found in an Integrated System Health Monitoring system. We specifically treat the problem of discovering anomalous features in the time series that may be indicative of a system anomaly, or in the case of a manned system, an anomaly due to the human. Identification of these anomalies is crucial to building stable, reusable, and cost-efficient systems. The framework consists of an analysis platform and new algorithms that can scale to thousands of sensor streams to discovers temporal anomalies. We discuss the mathematical framework that underlies the system and also describe in detail how this framework is general enough to encompass both discrete and continuous sensor measurements. We also describe a new set of data mining algorithms based on kernel methods and hidden Markov models that allow for the rapid assimilation, analysis, and discovery of system anomalies. We then describe the performance of the system on a real-world problem in the aircraft domain where we analyze the cockpit data from aircraft as well as data from the aircraft propulsion, control, and guidance systems. These data are discrete and continuous sensor measurements and are dealt with seamlessly in order to discover anomalous flights. We conclude with recommendations that describe the tradeoffs in building an integrated scalable platform for robust anomaly detection in ISHM applications.

  14. Interior Alaska Bouguer Gravity Anomaly

    Data.gov (United States)

    National Oceanic and Atmospheric Administration, Department of Commerce — A 1 kilometer Complete Bouguer Anomaly gravity grid of interior Alaska. All grid cells within the rectangular data area (from 61 to 66 degrees North latitude and...

  15. Notes on Anomaly Induced Transport

    CERN Document Server

    Landsteiner, Karl

    2016-01-01

    Chiral anomalies give rise to dissipationless transport phenomena such as the chiral magnetic and vortical effects. In these notes I review the theory from a quantum field theoretic, hydrodynamic and holographic perspective. A physical interpretation of the otherwise somewhat obscure concepts of consistent and covariant anomalies will be given. Vanishing of the CME in strict equilibrium will be connected to the boundary conditions in momentum space imposed by the regularization. The role of the gravitational anomaly will be explained. That it contributes to transport in an unexpectedly low order in the derivative expansion can be easiest understood via holography. Anomalous transport is supposed to play also a key role in understanding the electronics of advanced materials, the Dirac- and Weyl (semi)metals. Anomaly related phenomena such as negative magnetoresistivity, anomalous Hall effect, thermal anomalous Hall effect and Fermi arcs can be understood via anomalous transport. Finally I briefly review a holo...

  16. ALP hints from cooling anomalies

    CERN Document Server

    Giannotti, Maurizio

    2015-01-01

    We review the current status of the anomalies in stellar cooling and argue that, among the new physics candidates, an axion-like particle would represent the best option to account for the hinted additional cooling.

  17. Interior Alaska Bouguer Gravity Anomaly

    Data.gov (United States)

    National Oceanic and Atmospheric Administration, Department of Commerce — A 1 kilometer Complete Bouguer Anomaly gravity grid of interior Alaska. Only those grid cells within 10 kilometers of a gravity data point have gravity values....

  18. 基于Shell命令和DTMC模型的用户行为异常检测新方法%Novel Method for Anomaly Detection of User Behavior Based on Shell Commands and DTMC Models

    Institute of Scientific and Technical Information of China (English)

    肖喜; 翟起滨; 田新广; 陈小娟

    2011-01-01

    提出一种新的基于离散时间Markov链模型的用户行为异常检测方法,主要用于以shell命令为审计数据的入侵检测系统.该方法在训练阶段充分考虑了用户行为复杂多变的特点和审计数据的短时相关性,将shell命令序列作为基本数据处理单元,依据其出现频率利用阶梯式的数据归并方法来确定Markov链的状态,同现有方法相比提高了用户行为轮廓描述的准确性和对用户行为变化的适应性,并且大幅度减少了状态个数,节约了存储成本.在检测阶段,针对检测实时性和准确度需求,通过计算状态序列的出现概率分析用户行为异常程度,并提供了基于固定窗长度和可变窗长度的两种均值滤噪处理及行为判决方案.实验表明,该方法具有很高的检测性能,其可操作性也优于同类方法.%This paper presented a novel method for anomaly detection of user behavior based on the discrete-time Mar kov chain model;which is applicable to intrusion detection systems using shell commands as audit data. In the training period;the uncertainty of the user's behavior and the relevance of the operation of shell commands in short time were fully considered. This method takes the sequences of shell commands as the basic processing units. It merges the se quences into sets in terms of their ordered frequencies and then constructs states of the Markov chain on the merged re sults. Therefore this method increases the accuracy of describing the normal behavior profile and the adaptability to the variations of the user's behavior and sharply reduces the number of states and the required storage space. In the detec tion stage;considering the real-time performance and the accuracy requirement of the detection system; it analyzes the a nomaly degree of the user's behavior by computing the occurrence probabilities of the state sequences;and then pro vides two schemes;based on the probability stream filtered with single

  19. Investigation of atmospheric anomalies associated with Kashmir and Awaran Earthquakes

    Science.gov (United States)

    Mahmood, Irfan; Iqbal, Muhammad Farooq; Shahzad, Muhammad Imran; Qaiser, Saddam

    2017-02-01

    The earthquake precursors' anomalies at diverse elevation ranges over the seismogenic region and prior to the seismic events are perceived using Satellite Remote Sensing (SRS) techniques and reanalysis datasets. In the current research, seismic precursors are obtained by analyzing anomalies in Outgoing Longwave Radiation (OLR), Air Temperature (AT), and Relative Humidity (RH) before the two strong Mw>7 earthquakes in Pakistan occurred on 8th October 2005 in Azad Jammu Kashmir with Mw 7.6, and 24th September 2013 in Awaran, Balochistan with Mw 7.7. Multi-parameter data were computed based on multi-year background data for anomalies computation. Results indicate significant transient variations in observed parameters before the main event. Detailed analysis suggests presence of pre-seismic activities one to three weeks prior to the main earthquake event that vanishes after the event. These anomalies are due to increase in temperature after release of gases and physical and chemical interactions on earth surface before the earthquake. The parameter variations behavior for both Kashmir and Awaran earthquake events are similar to other earthquakes in different regions of the world. This study suggests that energy release is not concentrated to a single fault but instead is released along the fault zone. The influence of earthquake events on lightning were also investigated and it was concluded that there is a significant atmospheric lightning activity after the earthquake suggesting a strong possibility for an earthquake induced thunderstorm. This study is valuable for identifying earthquake precursors especially in earthquake prone areas.

  20. Space weather and space anomalies

    Directory of Open Access Journals (Sweden)

    L. I. Dorman

    2005-11-01

    Full Text Available A large database of anomalies, registered by 220 satellites in different orbits over the period 1971-1994 has been compiled. For the first time, data from 49 Russian Kosmos satellites have been included in a statistical analysis. The database also contains a large set of daily and hourly space weather parameters. A series of statistical analyses made it possible to quantify, for different satellite orbits, space weather conditions on the days characterized by anomaly occurrences. In particular, very intense fluxes (>1000 pfu at energy >10 MeV of solar protons are linked to anomalies registered by satellites in high-altitude (>15000 km, near-polar (inclination >55° orbits typical for navigation satellites, such as those used in the GPS network, NAVSTAR, etc. (the rate of anomalies increases by a factor ~20, and to a much smaller extent to anomalies in geostationary orbits, (they increase by a factor ~4. Direct and indirect connections between anomaly occurrence and geomagnetic perturbations are also discussed.

  1. The accrual anomaly: Evidence from Borsa Istanbul

    Directory of Open Access Journals (Sweden)

    Nasif Ozkan

    2015-06-01

    Full Text Available In this study, we seek to answer whether stock prices fully reflect information in accruals and cash flows about future earnings. Following prior research, we perform Mishkin test and hedge portfolio analysis. The results based on full sample do not indicate mispricing in the components of earnings on Borsa Istanbul. When we exclude loss firms from the full sample, mispricing of total accruals and its components, and thus the presence of accrual anomaly on Borsa Istanbul, is revealed. Using trading strategy based on total accruals of profit firms, investors may generate abnormal returns of 18.58%. These results may suggest that Borsa Istanbul is not efficient in semi-strong form.

  2. Template fitting and the large-angle CMB anomalies

    CERN Document Server

    Land, K; Land, Kate; Magueijo, Joao

    2006-01-01

    We investigate two possible explanations for the large-angle anomalies in the Cosmic Microwave Background (CMB): an intrinsically anisotropic model and an inhomogeneous model. We take as an example of the former a Bianchi model (which leaves a spiral pattern in the sky) and of the latter a background model that already contains a non-linear long-wavelength plane wave (leaving a stripy pattern in the sky). We make use of an adaptation of the ``template'' formalism, previously designed to detect galactic foregrounds, to recognize these patterns and produce confidence levels for their detection. The ``corrected'' maps, from which these patterns have been removed, are free of anomalies, in particular their quadrupole and octupole are not planar and their intensities not low. We stress that although the ``template'' detections are not found to be statistically significant they do correct statistically significant anomalies.

  3. Anomalies of abdominal organs in polysplenia syndrome: Multidetector computed tomography findings

    Energy Technology Data Exchange (ETDEWEB)

    Kim, Sung Won; Lee, Yong Seok; Jung, Jin Hee [Dept. of Radiology, Dongguk University Ilsan Hospital, Dongguk University School of Medicine, Goyang (Korea, Republic of)

    2016-02-15

    Polysplenia syndrome is a rare situs ambiguous anomaly associated with multiple spleens and anomalies of abdominal organs. Because most of the minor anomalies do not cause clinical symptoms, polysplenia syndrome is detected incidentally in the adults. Anomalies of abdominal organs may include multiple spleens of variable size or right-sided spleen, large midline or left-sided liver, midline gallbladder, biliary tract anomalies, short pancreas, right-sided stomach, intestinal malrotation, inferior vena cava interruption with azygos or hemiazygos continuation, and a preduodenal portal vein. As the multidetector computed tomography is increasingly used, situs anomalies will likely to be found with greater frequency in the adults. Therefore, radiologists should become familiar with these rare and peculiar anomalies of abdominal organs in polysplenia syndrome.

  4. MODIS/AQUA MYD14 Thermal Anomalies & Fire 5-Min L2 Swath 1km

    Data.gov (United States)

    U.S. Geological Survey, Department of the Interior — MODIS Thermal Anomalies/Fire products are primarily derived from MODIS 4- and 11-micrometer radiances. The fire detection strategy is based on absolute detection of...

  5. MODIS/TERRA MOD14 Thermal Anomalies & Fire 5-Min L2 Swath 1km

    Data.gov (United States)

    U.S. Geological Survey, Department of the Interior — MODIS Thermal Anomalies/Fire products are primarily derived from MODIS 4- and 11-micrometer radiances. The fire detection strategy is based on absolute detection of...

  6. MODIS/TERRA MOD14A1 Thermal Anomalies & Fire Daily L3 Global 1km

    Data.gov (United States)

    U.S. Geological Survey, Department of the Interior — MODIS Thermal Anomalies/Fire products are primarily derived from MODIS 4- and 11-micrometer radiances. The fire detection strategy is based on absolute detection of...

  7. MODIS/AQUA MYD14A1 Thermal Anomalies & Fire Daily L3 Global 1km

    Data.gov (United States)

    U.S. Geological Survey, Department of the Interior — MODIS Thermal Anomalies/Fire products are primarily derived from MODIS 4- and 11-micrometer radiances. The fire detection strategy is based on absolute detection of...

  8. Imaging evaluation of fetal vascular anomalies

    Energy Technology Data Exchange (ETDEWEB)

    Calvo-Garcia, Maria A.; Kline-Fath, Beth M.; Koch, Bernadette L.; Laor, Tal [MLC 5031 Cincinnati Children' s Hospital Medical Center, Department of Radiology, Cincinnati, OH (United States); Adams, Denise M. [Cincinnati Children' s Hospital Medical Center, Department of Pediatrics and Hemangioma and Vascular Malformation Center, Cincinnati, OH (United States); Gupta, Anita [Cincinnati Children' s Hospital Medical Center, Department of Pathology, Cincinnati, OH (United States); Lim, Foong-Yen [Cincinnati Children' s Hospital Medical Center, Pediatric Surgery and Fetal Center of Cincinnati, Cincinnati, OH (United States)

    2015-08-15

    Vascular anomalies can be detected in utero and should be considered in the setting of solid, mixed or cystic lesions in the fetus. Evaluation of the gray-scale and color Doppler US and MRI characteristics can guide diagnosis. We present a case-based pictorial essay to illustrate the prenatal imaging characteristics in 11 pregnancies with vascular malformations (5 lymphatic malformations, 2 Klippel-Trenaunay syndrome, 1 venous-lymphatic malformation, 1 Parkes-Weber syndrome) and vascular tumors (1 congenital hemangioma, 1 kaposiform hemangioendothelioma). Concordance between prenatal and postnatal diagnoses is analyzed, with further discussion regarding potential pitfalls in identification. (orig.)

  9. Accommodating Uncertainty in Prior Distributions

    Energy Technology Data Exchange (ETDEWEB)

    Picard, Richard Roy [Los Alamos National Lab. (LANL), Los Alamos, NM (United States); Vander Wiel, Scott Alan [Los Alamos National Lab. (LANL), Los Alamos, NM (United States)

    2017-01-19

    A fundamental premise of Bayesian methodology is that a priori information is accurately summarized by a single, precisely de ned prior distribution. In many cases, especially involving informative priors, this premise is false, and the (mis)application of Bayes methods produces posterior quantities whose apparent precisions are highly misleading. We examine the implications of uncertainty in prior distributions, and present graphical methods for dealing with them.

  10. Expanding the spectrum of human ganglionic eminence region anomalies on fetal magnetic resonance imaging

    Energy Technology Data Exchange (ETDEWEB)

    Righini, Andrea; Parazzini, Cecilia; Izzo, Giana [Children' s Hospital ' ' V. Buzzi' ' , Department of Radiology and Neuroradiology, Milan (Italy); Cesaretti, Claudia [Children' s Hospital ' ' V. Buzzi' ' , Department of Radiology and Neuroradiology, Milan (Italy); Ospedale Maggiore Policlinico, Medical Genetics Unit, Fondazione I.R.C.C.S. Ca' Granda, Milan (Italy); Conte, Giorgio [Children' s Hospital ' ' V. Buzzi' ' , Department of Radiology and Neuroradiology, Milan (Italy); University of Milan, Department of Health Sciences, Milan (Italy); Frassoni, Carolina; Inverardi, Francesca [Fondazione I.R.C.C.S. Istituto Neurologico ' ' C. Besta' ' , Clinical Epileptology and Experimental Neurophysiology Unit, Milan (Italy); Bulfamante, Gaetano; Avagliano, Laura [San Paolo Hospital, Division of Human Pathology, Milan (Italy); Rustico, Mariangela [Children' s Hospital ' ' V. Buzzi' ' , Department of Obstetrics and Gynaecology, Prenatal Diagnosis, Milan (Italy)

    2016-03-15

    Ganglionic eminence (GE) is a transient fetal brain structure that harvests a significant amount of precursors of cortical GABA-ergic interneurons. Prenatal magnetic resonance (MR) imaging features of GE anomalies (i.e., cavitations) have already been reported associated with severe micro-lissencephaly. The purpose of this report was to illustrate the MR imaging features of GE anomalies in conditions other than severe micro-lissencephalies. Among all the fetuses submitted to prenatal MR imaging at our center from 2005 to 2014, we collected eight cases with GE anomalies and only limited associated brain anomalies. The median gestational age at the time of MR imaging was 21 weeks ranging from 19 to 29 weeks. Two senior pediatric neuroradiologists categorized the anomalies of the GE region in two groups: group one showing cavitation in the GE region and group two showing enlarged GE region. For each fetal case, associated cranial anomalies were also reported. Five out of the eight cases were included in group one and three in group two. Besides the GE region abnormality, all eight cases had additional intracranial anomalies, such as mild partial callosal agenesis, vermian hypoplasia and rotation, cerebellar hypoplasia, ventriculomegaly, enlarged subarachnoid spaces, molar tooth malformation. Ultrasound generally detected most of the associated intracranial anomalies, prompting the MR investigation; on the contrary in none of the cases, GE anomalies had been detected by ultrasound. Our observation expands the spectrum of human GE anomalies, demonstrating that these may take place also without associated severe micro-lissencephalies. (orig.)

  11. Electromagnetic Signatures of the Chiral Anomaly in Weyl Semimetals

    Science.gov (United States)

    Barnes, Edwin; Heremans, J. J.; Minic, Djordje

    2016-11-01

    Weyl semimetals are predicted to realize the three-dimensional axial anomaly first discussed in particle physics. The anomaly leads to unusual transport phenomena such as the chiral magnetic effect in which an applied magnetic field induces a current parallel to the field. Here we investigate diagnostics of the axial anomaly based on the fundamental equations of axion electrodynamics. We find that materials with Weyl nodes of opposite chirality and finite energy separation immersed in a uniform magnetic field exhibit an anomaly-induced oscillatory magnetic field with a period set by the chemical potential difference of the nodes. In the case where a chemical potential imbalance is created by applying parallel electric and magnetic fields, we find a suppression of the magnetic-field component parallel to the electric field inside the material for rectangular samples, suggesting that the chiral magnetic current opposes this imbalance. For cylindrical geometries, we instead find an enhancement of this magnetic-field component along with an anomaly-induced azimuthal component. We propose experiments to detect such magnetic signatures of the axial anomaly.

  12. Shortening Anomalies in Supersymmetric Theories

    CERN Document Server

    Gomis, Jaume; Ooguri, Hirosi; Seiberg, Nathan; Wang, Yifan

    2016-01-01

    We present new anomalies in two-dimensional ${\\mathcal N} =(2, 2)$ superconformal theories. They obstruct the shortening conditions of chiral and twisted chiral multiplets at coincident points. This implies that marginal couplings cannot be promoted to background super-fields in short representations. Therefore, standard results that follow from ${\\mathcal N} =(2, 2)$ spurion analysis are invalidated. These anomalies appear only if supersymmetry is enhanced beyond ${\\mathcal N} =(2, 2)$. These anomalies explain why the conformal manifolds of the K3 and $T^4$ sigma models are not K\\"ahler and do not factorize into chiral and twisted chiral moduli spaces and why there are no ${\\mathcal N} =(2, 2)$ gauged linear sigma models that cover these conformal manifolds. We also present these results from the point of view of the Riemann curvature of conformal manifolds.

  13. Electromagnetic Duality and Entanglement Anomalies

    CERN Document Server

    Donnelly, William; Wall, Aron

    2016-01-01

    Duality is an indispensable tool for describing the strong-coupling dynamics of gauge theories. However, its actual realization is often quite subtle: quantities such as the partition function can transform covariantly, with degrees of freedom rearranged in a nonlocal fashion. We study this phenomenon in the context of the electromagnetic duality of abelian $p$-forms. A careful calculation of the duality anomaly on an arbitrary $D$-dimensional manifold shows that the effective actions agree exactly in odd $D$, while in even $D$ they differ by a term proportional to the Euler number. Despite this anomaly, the trace of the stress tensor agrees between the dual theories. We also compute the change in the vacuum entanglement entropy under duality, relating this entanglement anomaly to the duality of an "edge mode" theory in two fewer dimensions. Previous work on this subject has led to conflicting results; we explain and resolve these discrepancies.

  14. Conformal Anomalies and Gravitational Waves

    CERN Document Server

    Meissner, Krzysztof A

    2016-01-01

    We argue that the presence of conformal anomalies in gravitational theories can lead to observable modifications to Einstein's equations via the induced anomalous effective actions, whose non-localities can overwhelm the smallness of the Planck scale. The fact that no such effects have been seen in recent cosmological or gravitational wave observations therefore imposes strong restrictions on the field content of possible extensions of Einstein's theory: all viable theories should have vanishing conformal anomalies. We then show that, among presently known theories, a complete cancellation of conformal anomalies in $D=4$ for both the $C^2$ invariant and the Euler (Gauss-Bonnet) invariant $E_4$ can only be achieved for $N$-extended supergravities with $N\\geq 5$, as well as for M theory compactified to four dimensions.

  15. Boundary terms of conformal anomaly

    Directory of Open Access Journals (Sweden)

    Sergey N. Solodukhin

    2016-01-01

    Full Text Available We analyze the structure of the boundary terms in the conformal anomaly integrated over a manifold with boundaries. We suggest that the anomalies of type B, polynomial in the Weyl tensor, are accompanied with the respective boundary terms of the Gibbons–Hawking type. Their form is dictated by the requirement that they produce a variation which compensates the normal derivatives of the metric variation on the boundary in order to have a well-defined variational procedure. This suggestion agrees with recent findings in four dimensions for free fields of various spins. We generalize this consideration to six dimensions and derive explicitly the respective boundary terms. We point out that the integrated conformal anomaly in odd dimensions is non-vanishing due to the boundary terms. These terms are specified in three and five dimensions.

  16. Boundary terms of conformal anomaly

    Energy Technology Data Exchange (ETDEWEB)

    Solodukhin, Sergey N., E-mail: Sergey.Solodukhin@lmpt.univ-tours.fr

    2016-01-10

    We analyze the structure of the boundary terms in the conformal anomaly integrated over a manifold with boundaries. We suggest that the anomalies of type B, polynomial in the Weyl tensor, are accompanied with the respective boundary terms of the Gibbons–Hawking type. Their form is dictated by the requirement that they produce a variation which compensates the normal derivatives of the metric variation on the boundary in order to have a well-defined variational procedure. This suggestion agrees with recent findings in four dimensions for free fields of various spins. We generalize this consideration to six dimensions and derive explicitly the respective boundary terms. We point out that the integrated conformal anomaly in odd dimensions is non-vanishing due to the boundary terms. These terms are specified in three and five dimensions.

  17. Boundary Anomalies and Correlation Functions

    CERN Document Server

    Huang, Kuo-Wei

    2016-01-01

    It was shown recently that boundary terms of conformal anomalies recover the universal contribution to the entanglement entropy and also play an important role in the boundary monotonicity theorem of odd-dimensional quantum field theories. Motivated by these results, we investigate relationships between boundary anomalies and the stress tensor correlation functions in conformal field theories. In particular, we focus on how the conformal Ward identity and the renormalization group equation are modified by boundary central charges. Renormalized stress tensors induced by boundary Weyl invariants are also discussed, with examples in spherical and cylindrical geometries.

  18. A Study of the Method for the Recognition of Anomalies in Geochemical Hydrocarbon Exploration

    Institute of Scientific and Technical Information of China (English)

    1998-01-01

    The greatest difficulties in recognizing geochemical hydrocarbon anomalies are: (1) how to objectively and accurately separate anomalies from background; (2) how to distinguish hydrocarbon-pool-related apical anomalies from lateral anomalies controlled by faults; and (3) how to eliminate interferences. These uncertainties are serious obstacles for the wide acceptance and use of geochemical techniques in hydrocarbon exploration. In this paper, the features of hydrocarbon anomalies were analyzed based on the micro-migration mechanisms. In most cases, there are two anomalous populations or point groups, which are produced by two distinct mechanisms: (1) a population that directly reflects oil and gas fields, and (2) one that is related to structures such as faults. Statistical studies show that background anomalous populations and the boundaries between them can be described by the population means, prior probabilities, which are the proportions of population sizes, and covariance matrices, when background and anomalous populations have normal distributions. When this normality condition is met, a series of formulas can be derived. The method is designed on the basis of these allows: (1) univariate anomaly recognition, (2) elimination of interferences, (3) multivariate anomaly recognition, and (4) multivariate anomaly combination which depicts a more representative picture of morphology of the anomalous target than individual anomalies. The univariate and multivariate anomaly recognition can not only separate anomalies from background objectively, but also simultaneously distinguish the two types of anomalies objectively. This method was applied to the hydrocarbon data in Yangshuiwu region, Hebei Province. The interferences from regional variation of background were eliminated, and the interpretation uncertainty was reduced greatly as the anomalous populations were separated. The method was also used in Daxing region within the confines of Beijing City, and Aershan

  19. The Importance of Prior Knowledge.

    Science.gov (United States)

    Cleary, Linda Miller

    1989-01-01

    Recounts a college English teacher's experience of reading and rereading Noam Chomsky, building up a greater store of prior knowledge. Argues that Frank Smith provides a theory for the importance of prior knowledge and Chomsky's work provided a personal example with which to interpret and integrate that theory. (RS)

  20. Menarche: Prior Knowledge and Experience.

    Science.gov (United States)

    Skandhan, K. P.; And Others

    1988-01-01

    Recorded menstruation information among 305 young women in India, assessing the differences between those who did and did not have knowledge of menstruation prior to menarche. Those with prior knowledge considered menarche to be a normal physiological function and had a higher rate of regularity, lower rate of dysmenorrhea, and earlier onset of…

  1. Is plagioclase removal responsible for the negative Eu anomaly in the source regions of mare basalts?

    Science.gov (United States)

    Shearer, C. K.; Papike, J. J.

    1989-01-01

    The nearly ubiquitous presence of a negative Eu anomaly in the mare basalts has been suggested to indicate prior separation and flotation of plagioclase from the basalt source region during its crystallization from a lunar magma ocean (LMO). Are there any mare basalts derived from a mantle source which did not experience prior plagioclase separation? Crystal chemical rationale for REE substitution in pyroxene suggests that the combination of REE size and charge, M2 site characteristics of pyroxene, fO2, magma chemistry, and temperature may account for the negative Eu anomaly in the source region of some types of primitive, low TiO2 mare basalts. This origin for the negative Eu anomaly does not preclude the possibility of the LMO as many mare basalts still require prior plagioclase crystallization and separation and/or hybridization involving a KREEP component.

  2. CMB anomalies after Planck

    Science.gov (United States)

    Schwarz, Dominik J.; Copi, Craig J.; Huterer, Dragan; Starkman, Glenn D.

    2016-09-01

    Several unexpected features have been observed in the microwave sky at large angular scales, both by WMAP and by Planck. Among those features is a lack of both variance and correlation on the largest angular scales, alignment of the lowest multipole moments with one another and with the motion and geometry of the solar system, a hemispherical power asymmetry or dipolar power modulation, a preference for odd parity modes and an unexpectedly large cold spot in the Southern hemisphere. The individual p-values of the significance of these features are in the per mille to per cent level, when compared to the expectations of the best-fit inflationary ΛCDM model. Some pairs of those features are demonstrably uncorrelated, increasing their combined statistical significance and indicating a significant detection of CMB features at angular scales larger than a few degrees on top of the standard model. Despite numerous detailed investigations, we still lack a clear understanding of these large-scale features, which seem to imply a violation of statistical isotropy and scale invariance of inflationary perturbations. In this contribution we present a critical analysis of our current understanding and discuss several ideas of how to make further progress.

  3. CMB Anomalies after Planck

    CERN Document Server

    Schwarz, Dominik J; Huterer, Dragan; Starkman, Glenn D

    2015-01-01

    Several unexpected features have been observed in the microwave sky at large angular scales, both by WMAP an by Planck. Among those features is a lack of both variance and correlation on the largest angular scales, alignment of the lowest multipole moments with one another and with the motion and geometry of the Solar System, a hemispherical power asymmetry or dipolar power modulation, a preference for odd parity modes and an unexpectedly large cold spot in the Southern hemisphere. The individual p-values of the significance of these features are in the per mille to per cent level, when compared to the expectations of the best-fit inflationary $\\Lambda$CDM model. Some pairs of those features are demonstrably uncorrelated, increasing their combined statistical significance and indicating a significant detection of CMB features at angular scales larger than a few degrees on top of the standard model. Despite numerous detailed investigations, we still lack a clear understanding of these large-scale features, whi...

  4. 矿井工作面地质异常综合探测技术应用%Application of Integrated Detection Techniques for Geologic Anomaly in Coalmine Working Faces

    Institute of Scientific and Technical Information of China (English)

    杨华忠; 邱德生; 陈兴海; 宋清波

    2013-01-01

    矿井工作面内煤层厚度变化、异常体、小构造等地质问题是煤炭回采过程中迫切需要解决的关键问题.以淮南某矿1410(1)工作面探测煤层变薄带为例,介绍了综合利用无线电波透视技术和地震槽波技术圈定煤层厚度异常区域的方法.解释结果与工作面回采揭露的煤层变薄区域进行对比,结果表明综合物探方法探测的异常区域与实际揭露的煤层变薄区域较为吻合,特别是无线电波解释的异常区域1、2、3、5与实际揭露的变薄异常区域1、2、5、6吻合较好,而地震槽波解释的1、2号异常区域与实际揭露的1、2、3号异常在位置上也较吻合,且异常区域的大小差别也较小.在该探测实例中,无线电波透视技术以吸收系数0.04作为异常边界、地震槽波以波速2200m/s作为异常边界进行解释时,其结果较为准确,且地震槽波技术分辨力较无线电波透视技术更为细致.%Issues of coal seam thickness variation, anomalous bodies and minor structures in coalmine working faces are the key problems actively demanded to be solved during coal winning. Taking the detection of coal seam thinning zone in the No.1410 (1) working face in a Huainan coalmine as an example, introduced a method of integrated radio-wave penetration and in-seam seismic techniques to delineate coal thickness abnormal area. The contrast of interpreted result and the coal thinning zone revealed by working face winning has shown both are rather tally with. Especially the abnormal areas Nos.l, 2, 3 and 5 interpreted by radio-wave penetration tally with actually revealed thinning areas Nos.l, 2, 5 and 6 better; while in-seam seismic interpreted abnormal areas Nos. 1 and 2 tally with practically revealed thinning areas Nos.l, 2 and 3 better on location, and less area differences. In the example, when radio-wave penetration takes the absorption coefficient 0.04 as the boundary of anomaly, in-seam seismic takes well

  5. Microwave radiometric signatures of temperature anomalies in tissue

    Science.gov (United States)

    Kelly, Patrick; Sobers, Tamara; St. Peter, Benjamin; Siqueira, Paul; Capraro, Geoffrey

    2012-03-01

    Because of its ability to measure the temperature-dependent power of electromagnetic radiation emitted from tissue down to several centimeters beneath the skin, microwave radiometry has long been of interest as a means for identifying the internal tissue temperature anomalies that arise from abnormalities in physiological parameters such as metabolic and blood perfusion rates. However, the inherent lack of specificity and resolution in microwave radiometer measurements has limited the clinical usefulness of the technique. The idea underlying this work is to make use of information (assumed to be available from some other modality) about the tissue configuration in the volume of interest to study and improve the accuracy of anomaly detection and estimation from radiometric data. In particular, knowledge of the specific anatomy and the properties of the overall measurement system enable determination of the signatures of localized physiological abnormalities in the radiometry data. These signatures are used to investigate the accuracy with which the location of an anomaly can be determined from radiometric measurements. Algorithms based on matches to entries in a signature dictionary are developed for anomaly detection and estimation. The accuracy of anomaly identification is improved when the coupling of power from the body to the sensor is optimized. We describe the design of a radiometer waveguide having dielectric properties appropriate for biomedical applications.

  6. Prior Information in Inverse Boundary Problems

    DEFF Research Database (Denmark)

    Garde, Henrik

    This thesis gives a threefold perspective on the inverse problem of inclusion detection in electrical impedance tomography: depth dependence, monotonicitybased reconstruction, and sparsity-based reconstruction. The depth dependence is given in terms of explicit bounds on the datum norm, which shows...... into how much noise that can be allowed in the datum before an inclusion cannot be detected. The monotonicity method is a direct reconstruction method that utilizes a monotonicity property of the forward problem in order to characterize the inclusions. Here we rigorously prove that the method can...... of the method. Sparsity-based reconstruction is an iterative method, that through an optimization problem with a sparsity prior, approximates the inhomogeneities. Here we make use of prior information, that can cheaply be obtained from the monotonicity method, to improve both the contrast and resolution...

  7. First branchial cleft anomalies: presentation, variability and safe surgical management.

    Science.gov (United States)

    Magdy, Emad A; Ashram, Yasmine A

    2013-05-01

    First branchial cleft (FBC) anomalies are uncommon. The aim of this retrospective clinical study is to describe our experience in dealing with these sporadically reported lesions. Eighteen cases presenting with various FBC anomalies managed surgically during an 8-year period at a tertiary referral medical institution were included. Ten were males (56 %) and eight females (44 %) with age range 3-18 years. Anomaly was right-sided in 12 cases (67 %). None were bilateral. Nine patients (50 %) had prior abscess incision and drainage procedures ranging from 1 to 9 times. Two also had previous unsuccessful surgical excisions. Clinical presentations included discharging tract openings in external auditory canal/conchal bowl (n = 9), periauricular (n = 6), or upper neck (n = 4); cystic postauricular, parotid or upper neck swellings (n = 5); and eczematous scars (n = 9). Three distinct anatomical types were encountered: sinuses (n = 7), fistulas (n = 6), and cysts (n = 5). Complete surgical excision required superficial parotidectomy in 11 patients (61 %). Anomaly was deep to facial nerve (FN) in three cases (17 %), in-between its branches in two (11 %) and superficial (but sometimes adherent to the nerve) in remaining cases (72 %). Continuous intraoperative electrophysiological FN monitoring was used in all cases. Two cases had postoperative temporary lower FN paresis that recovered within 2 months. No further anomaly manifestation was observed after 49.8 months' mean postoperative follow-up (range 10-107 months). This study has shown that awareness of different presentations and readiness to identify and protect FN during surgery is essential for successful management of FBC anomalies. Intraoperative electrophysiological FN monitoring can help in that respect.

  8. Bony anomaly of Meckel's cave.

    Science.gov (United States)

    Tubbs, R Shane; Salter, E George; Oakes, W Jerry

    2006-01-01

    This study describes the seemingly rare occurrence of bone formation within the proximal superior aspect of Meckel's cave thus forming a bony foramen for the proximal trigeminal nerve to traverse. The anatomy of Meckel's cave is reviewed and the clinical potential for nerve compression from this bony anomaly discussed.

  9. Anomalies and noncommutative index theory

    CERN Document Server

    Perrot, D

    2006-01-01

    These are the notes of a lecture given during the summer school "Geometric and Topological Methods for Quantum Field Theory", Villa de Leyva, Colombia, july 11 - 29, 2005. We review basic facts concerning gauge anomalies and discuss the link with the Connes-Moscovici index formula in noncommutative geometry.

  10. Thermal anomalies in stressed Teflon.

    Science.gov (United States)

    Lee, S. H.; Wulff, C. A.

    1972-01-01

    In the course of testing polytetrafluoroethylene (Teflon) as a calorimetric gasketing material, serendipity revealed a thermal anomaly in stressed film that occurs concomitantly with the well-documented 25 C transition. The magnitude of the excess energy absorption - about 35 cal/g - is suggested to be related to the restricted thermal expansion of the film.

  11. Global gravitational anomalies and transport

    Science.gov (United States)

    Chowdhury, Subham Dutta; David, Justin R.

    2016-12-01

    We investigate the constraints imposed by global gravitational anomalies on parity odd induced transport coefficients in even dimensions for theories with chiral fermions, gravitinos and self dual tensors. The η-invariant for the large diffeomorphism corresponding to the T transformation on a torus constraints the coefficients in the thermal effective action up to mod 2. We show that the result obtained for the parity odd transport for gravitinos using global anomaly matching is consistent with the direct perturbative calculation. In d = 6 we see that the second Pontryagin class in the anomaly polynomial does not contribute to the η-invariant which provides a topological explanation of this observation in the `replacement rule'. We then perform a direct perturbative calculation for the contribution of the self dual tensor in d = 6 to the parity odd transport coefficient using the Feynman rules proposed by Gaumé and Witten. The result for the transport coefficient agrees with that obtained using matching of global anomalies.

  12. Anomaly Monitoring Method for Key Components of Satellite

    Directory of Open Access Journals (Sweden)

    Jian Peng

    2014-01-01

    Full Text Available This paper presented a fault diagnosis method for key components of satellite, called Anomaly Monitoring Method (AMM, which is made up of state estimation based on Multivariate State Estimation Techniques (MSET and anomaly detection based on Sequential Probability Ratio Test (SPRT. On the basis of analysis failure of lithium-ion batteries (LIBs, we divided the failure of LIBs into internal failure, external failure, and thermal runaway and selected electrolyte resistance (Re and the charge transfer resistance (Rct as the key parameters of state estimation. Then, through the actual in-orbit telemetry data of the key parameters of LIBs, we obtained the actual residual value (RX and healthy residual value (RL of LIBs based on the state estimation of MSET, and then, through the residual values (RX and RL of LIBs, we detected the anomaly states based on the anomaly detection of SPRT. Lastly, we conducted an example of AMM for LIBs, and, according to the results of AMM, we validated the feasibility and effectiveness of AMM by comparing it with the results of threshold detective method (TDM.

  13. Comparison of Methods of Height Anomaly Computation

    Science.gov (United States)

    Mazurova, E.; Lapshin, A.; Menshova, A.

    2012-04-01

    As of today, accurate determination of height anomaly is one of the most difficult problems of geodesy, even with sustainable perfection of mathematical methods, computer possibilities. The most effective methods of height anomaly computation are based on the methods of discrete linear transformations, such as the Fast Fourier Transform (FFT), Short-Time Fourier Transform (STFT), Fast Wavelet Transform (FWT). The main drawback of the classical FFT is weak localization in the time domain. If it is necessary to define the time interval of a frequency presence the STFT is used that allows one to detect the presence of any frequency signal and the interval of its presence. It expands the possibilities of the method in comparison with the classical Fourier Transform. However, subject to Heisenberg's uncertainty principle, it is impossible to tell precisely what frequency signal is present at a given moment of time (it is possible to speak only about the range of frequencies); and it is impossible to tell at what precisely moment of time the frequency signal is present (it is possible to speak only about a time span). A wavelet-transform gives the chance to reduce the influence of the Heisenberg's uncertainty principle on the obtained time-and-frequency representation of the signal. With its help low frequencies have more detailed representation relative to the time, and high frequencies - relative to the frequency. The paper summarizes the results of height anomaly calculations done by the FFT, STFT, FWT methods and represents 3-D models of calculation results. Key words: Fast Fourier Transform(FFT), Short-Time Fourier Transform (STFT), Fast Wavelet Transform(FWT), Heisenberg's uncertainty principle.

  14. The Association of H1N1 Pandemic Influenza with Congenital Anomaly Prevalence in Europe

    DEFF Research Database (Denmark)

    Luteijn, Johannes Michiel; Addor, Marie-Claude; Arriola, Larraitz

    2015-01-01

    BACKGROUND: In the context of the European Surveillance of Congenital Anomalies (EUROCAT) surveillance response to the 2009 influenza pandemic, we sought to establish whether there was a detectable increase of congenital anomaly prevalence among pregnancies exposed to influenza seasons in general...

  15. Determining surface wave arrival angle anomalies

    Science.gov (United States)

    Larson, Erik W. F.; Ekström, Göran

    2002-06-01

    A new method for measuring arrival angles of teleseismic Love and Rayleigh waves is developed. The new method utilizes estimates of surface wave dispersion to create a phase-matched filter to isolate the Love or Rayleigh wave in three-component recordings. The polarization of the filtered wave group is determined in the time domain by application of a variation of the complex polarization method of Vidale [1986]. Orientation, linearity, and ellipticity of particle motion are estimated in several frequency bands to determine the frequency-dependent polarization. The method employs an iterative scheme, by which a predicted Love wave, based on the estimated dispersion and polarization, is subtracted from the three-component data prior to the estimation of Rayleigh wave polarization, and vice versa. The method is applied to an extensive set of Global Seismographic Network data covering the years 1989-1998. Between 4244 and 15,075 measurements are collected for fundamental mode Love and Rayleigh waves at nine different periods (37 to 150 s). Measurement uncertainties are estimated using the statistics of observations for pairwise similar paths and are generally of the order of 15-50% of the total signal, depending on the period and the wave type. Large and azimuthally invariant angle anomalies are documented for several stations and are consistent with misorientation of the horizontal seismometers. Two schemes are employed to determine the misorientations: (1) an azimuthally weighted average at each station, and (2) a joint inversion for seismometer misorientation and globally heterogeneous phase velocities. The determined corrections are robust and correlate well with those reported in earlier studies. Azimuthally varying arrival angle anomalies are shown to agree qualitatively with predictions of wave refraction calculated for recent phase velocity maps, which explain up to 30% of the variance in the new measurements.

  16. Thermal Anomalies and Earthquakes: Evidence from Wenchuan, China

    Institute of Scientific and Technical Information of China (English)

    Yang Guoan; Mi Yuqin

    2009-01-01

    Earthquake prediction is a difficult problem in Earth sciences. Unsuccessful predictions one after another urged people to explore more synthetic and comprehensive methods for earthquake prediction. The Lithosphere-Atmosphere-Ionosphere (LAI) coupling theory pays great attention to the processes taking place within the near ground layer of atmosphere. It has achieved great results recently, and can enlighten us about the nature of an earthquake's precursor. Based on the NCEP reaualysis dataset, this paper attempts to track the anomalies of the surface's upward long wave radiation flux (ULWRF), the temperature at the depth of 10cm~20cm below ground surface layer (BGL) and the air temperature at 2 meters above ground surface (AIR) around the time of the strong Wenchuan earthquake. Thermal anomalies were observed before and after May 12, 2008, the time of the Wenchuan earthquake. Perhaps the thermal anomaly that occurred prior to the earthquake can be taken as indicators of the earthquake, hut in view of the complexity of the earthquake phenomena, using thermal anomaly as a precursor should be done with caution.

  17. Universal Prior Prediction for Communication

    CERN Document Server

    Lomnitz, Yuval

    2011-01-01

    We consider the problem of communicating over an unknown and arbitrarily varying channel, using feedback. This paper focuses on the problem of determining the input behavior, or more specifically, a prior which is used to randomly generate a codebook. We pose the problem of setting the prior as a universal sequential prediction problem using information theoretic abstractions of the communication channel. For the case where the channel is block-wise constant, we show it is possible to asymptotically approach the best rate that can be attained by any system using a fixed prior. For the case where the channel may change on each symbol, we combine a rateless coding scheme with a prior predictor and asymptotically approach the capacity of the average channel universally for every sequence of channels.

  18. [Frequency of congenital anomalies at the Instituto Materno Infantil, Bogota, Colombia].

    Science.gov (United States)

    García, Herbert; Salguero, Gustavo Andrés; Moreno, Jeffer; Arteaga, Clara; Giraldo, Alejandro

    2003-06-01

    At the Instituto Materno Infantil (IMI) in Bogotá (Colombia), 5,686 births (5,597 live births and 89 stillbirths) were analyzed during two periods: from October, 1997, to April, 1998, and from July to November, 2000 (12 months). Congenital anomalies were detected in 4.4% of live newborn babies and in 7.8% of stillbirths. Major anomalies corresponded to 69% and mild anomalies to 31% (3% and 1.4% of all live births, respectively). The newborn babies with major anomalies, in comparison to the normal controls, had higher mortality at hospital discharge (p = 0.0001), lower average birth weight (p = 0.003), and family history of congenital anomalies (p = 0.0001). The only significant association for mild anomalies was with family history of congenital anomalies (p = 0.0001). The frequency of congenital anomalies was similar to that in other studies, although certain kinds of anomalies showed noticeable frequency differences. This may be a consequence of differences in record keeping or in detection methods.

  19. Hydrothermal plume anomalies along the Central Indian Ridge

    Institute of Scientific and Technical Information of China (English)

    ZHU Jian; LIN Jian; GUO ShiQin; CHEN YongShun

    2008-01-01

    Water column turbidity and temperature were investigated along the Central Indian Ridge (CIR) from 25°19'S to 23°48'S during a December 2005 cruise on board Chinese P/V DayangYihao.Measurements were made using NOAA's MAPR (Miniature Autonomous Plume Recorder) sensors during CTD casts,TV grabber operations,and tow-yo profiles,yielding the following results on hydrothermal plume anomalies:(1) Strong hydrothermal turbidity and temperature anomalies were recorded over the pre-viously discovered Kairei (25°19.2'S,70°02.4'E) and Edmond (23°52.7'S,69°35.8"E) vent fields,with the plume anomalies concentrated at depths of 2150-2300 m and 2700-2900 m,respectively.The maxi-mum height of the turbidity anomalies near the Kairei vent field recorded in December 2005 was slightly below 2100 m,which is consistent with the plume depth measured in June 2001,indicating that the Kairei plume may have maintained its buoyancy flux in the intervening 4.5 years.(2) The water column beneath the Kairei plume has background anomalies of about 0.005△NTU,whereas no such back-ground turbidity anomalies were observed below the Edmond hydrothermal plume.(3) No visible tur-bidity anomalies were detected from 24°42'S to 24°12'S including the Knorr Seamount.Thus 24°12'S marks the southern end of the hydrothermal plume.(4) Significant turbidity anomalies were observed at four individual sections from 24°12'S to 23°56'S at the depth of 2500-3000 m along the eastern rift valley wall.Whether the individual sections of anomalies are connected is still unknown due to the absence of data at the intervening gaps.If the four sections are connected with each other and are linked to the Edmond vent field farther to the north,the total along-axis length of the plume anomaly would be more than 37 km,implying a plume incidence value Ph of 0.38,greater than the predicted Ph of 0.21-0.25 based on the spreading rate of the Central Indian Ridge.

  20. Recruiting for Prior Service Market

    Science.gov (United States)

    2008-06-01

    perceptions, expectations and issues for re-enlistment • Develop potential marketing and advertising tactics and strategies targeted to the defined...01 JUN 2008 2. REPORT TYPE N/A 3. DATES COVERED - 4. TITLE AND SUBTITLE Recruiting for Prior Service Market 5a. CONTRACT NUMBER 5b. GRANT...Command First Handshake to First Unit of Assignment An Army of One Proud to Be e e to Serve Recruiting for Prior Service Market MAJ Eric Givens / MAJ Brian