Results for “anomalies detection” — Page 6

DOE OSTI2022

Event-Based Anomaly Detection for Searches for New Physics

This paper discusses model-agnostic searches for new physics at the Large Hadron Collider using anomaly-detection techniques for the identification of event signatures that deviate from the Standard Model (SM). We investigate anomaly detection in the context of a machine-learning approach based on autoencoders. The analysis uses Monte Carlo simulations for the SM background and several selected exotic models. We also investigate the input space for the event-based anomaly detection and illustrate the shapes of invariant masses in the outlier region which will be used to perform searches for resonant phenomena beyond the SM. Challenges and conceptual limitations of this approach are discussed.

72 PHYSICS OF ELEMENTARY PARTICLES AND FIELDS↗

NASA NTRS2014

A Model-Based Anomaly Detection Approach for Analyzing Streaming Aircraft Engine Measurement Data

This paper presents a model-based anomaly detection architecture designed for analyzing streaming transient aircraft engine measurement data. The technique calculates and monitors residuals between sensed engine outputs and model predicted outputs for anomaly detection purposes. Pivotal to the performance of this technique is the ability to construct a model that accurately reflects the nominal operating performance of the engine. The dynamic model applied in the architecture is a piecewise linear design comprising steady-state trim points and dynamic state space matrices. A simple curve-fitting technique for updating the model trim point information based on steadystate information extracted from available nominal engine measurement data is presented. Results from the application of the model-based approach for processing actual engine test data are shown. These include both nominal fault-free test case data and seeded fault test case data. The results indicate that the updates applied to improve the model trim point information also improve anomaly detection performance. Recommendations for follow-on enhancements to the technique are also presented and discussed.

Propulsion System Performance↗

NASA NTRS2015

A Model-Based Anomaly Detection Approach for Analyzing Streaming Aircraft Engine Measurement Data

This paper presents a model-based anomaly detection architecture designed for analyzing streaming transient aircraft engine measurement data. The technique calculates and monitors residuals between sensed engine outputs and model predicted outputs for anomaly detection purposes. Pivotal to the performance of this technique is the ability to construct a model that accurately reflects the nominal operating performance of the engine. The dynamic model applied in the architecture is a piecewise linear design comprising steady-state trim points and dynamic state space matrices. A simple curve-fitting technique for updating the model trim point information based on steadystate information extracted from available nominal engine measurement data is presented. Results from the application of the model-based approach for processing actual engine test data are shown. These include both nominal fault-free test case data and seeded fault test case data. The results indicate that the updates applied to improve the model trim point information also improve anomaly detection performance. Recommendations for follow-on enhancements to the technique are also presented and discussed.

Propulsion System Performance↗

DOE OSTI2025

Incorporating Physical Priors into Weakly Supervised Anomaly Detection

We propose a new machine-learning-based anomaly detection strategy for comparing data with a background-only reference (a form of weak supervision). The sensitivity of previous strategies degrades significantly when the signal is too rare or there are many unhelpful features. Our prior-assisted weak supervision (PAWS) method incorporates information from a class of signal models to significantly enhance the search sensitivity of weakly supervised approaches. As long as the true signal is in the prespecified class, PAWS matches the sensitivity of a dedicated, fully supervised method without specifying the exact parameters ahead of time. On the benchmark LHC Olympics anomaly detection dataset, our mix of semisupervised and weakly supervised learning is able to extend the sensitivity over previous methods by a factor of 10 in cross section. Furthermore, if we add irrelevant (noise) dimensions to the inputs, classical methods degrade by another factor of 10 in cross section while PAWS remains insensitive to noise. This new approach could be applied in a number of scenarios and pushes the frontier of sensitivity between completely model-agnostic approaches and fully model-specific searches.

artificial neural networks↗

DOE OSTI2021

Data-Driven Probabilistic Anomaly Detection for Electricity Market under Cyber Attacks

Information and communication technologies have been widely used in smart grid for efficient operation. However, these technologies are vulnerable to malicious cyber attacks, which may lead to severe reliability and economic issues. Recently, a variety of data-driven anomaly detection approaches have been explored to detect potential cyber attacks in smart grids. In this paper, we researched on the electricity market data aiming to identify anomalies from the locational marginal prices (LMPs) and provide a new indicator for potential cyber attacks in power grids. Specifically, a novel data-driven probabilistic anomaly detection framework is proposed for electricity market, which consists of three major components: long short-term memory (LSTM) based deterministic electricity price forecasting, probabilistic electricity price forecasting and anomaly detection. This framework is tested on a model-based electricity market simulator under two types of cyber attacks, i.e., load redistribution attack (LRA) and price responsive attack (PRA). Numerical results on the simulated LMPs show that the proposed framework is capable of detecting data anomalies over these attacks.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

DOE OSTI2023

Anomaly Detection in Liquid Sodium Cold Trap Operation with Multisensory Data Fusion Using Long Short-Term Memory Autoencoder

Sodium-cooled fast reactors (SFR), which use high temperature fluid near ambient pressure as coolant, are one of the most promising types of GEN IV reactors. One of the unique challenges of SFR operation is purification of high temperature liquid sodium with a cold trap to prevent corrosion and obstructing small orifices. We have developed a deep learning long short-term memory (LSTM) autoencoder for continuous monitoring of a cold trap and detection of operational anomaly. Transient data were obtained from the Mechanisms Engineering Test Loop (METL) liquid sodium facility at Argonne National Laboratory. The cold trap purification at METL is monitored with 31 variables, which are sensors measuring fluid temperatures, pressures and flow rates, and controller signals. Loss-of-coolant type anomaly in the cold trap operation was generated by temporarily choking one of the blowers, which resulted in temperature and flow rate spikes. The input layer of the autoencoder consisted of all the variables involved in monitoring the cold trap. The LSTM autoencoder was trained on the data corresponding to cold trap startup and normal operation regime, with the loss function calculated as the mean absolute error (MAE). The loss during training was determined to follow log-normal density distribution. During monitoring, we investigated a performance of the LSTM autoencoder for different loss threshold values, set at a progressively increasing number of standard deviations from the mean. The anomaly signal in the data was gradually attenuated, while preserving the noise of the original time series, so that the signal-to-noise ratio (SNR) averaged across all sensors decreased below unity. Results demonstrate detection of anomalies with sensor-averaged SNR < 1.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

DOE OSTI2024

Efficient Anomaly Detection Driven By Different Machine Learning Architectures And Models

The rapid growth and ubiquitous adoption of the internet and cyber-physical systems (CPS) have fundamentally transformed modern communication, work, and human-system interactions. While networks now form the backbone of critical digital ecosystems, enabling seamless data transmission across diverse, interconnected systems, this increased connectivity also expands the attack surface, making real-time detection of network intrusions and anomalies a pressing challenge. Detecting unusual activities within network infrastructure requires advanced data traffic analysis to differentiate between legitimate and malicious interactions. Traditional approaches to network anomaly detectionâ??such as rule-based and signature-based systemsâ??often depend on predefined patterns to identify known anomalies, limiting their effectiveness against emerging, stealthy, or previously unseen threats. These conventional methods suffer from high false alarm rates and fail to adapt to the ever-evolving nature of network traffic, particularly in large-scale, decentralized environments where data volume, velocity, and variety are constantly increasing. This dissertation presents artificial intelligence (AI)-driven approaches to anomaly detection that leverage graphics processing unit (GPU)-enabled high-performance computing (HPC) platforms for processing massive network traffic data and monitoring the components of cyber-physical systems (CPS) for potentially hazardous conditions. The research advances several key contributions: (1) Designing efficient machine learning techniques for CPS condition monitoring and anomaly detection; (2) enabling federated learning (FL) frameworks that enable distributed detection while preserving data privacy and system resilience; (3) exploring graph-based methodologies combining graph neural networks (GNN) and graph machine learning (ML) approaches for the Internet of Things (IoT) and automotive network security, and (4) performing distributed edge computing optimizations that integrate FL with scalable technologies for reduced communication overhead. Through extensive experiments, these methodologies demonstrate that complex anomaly detection and condition monitoring tasks can be achieved while balancing computational efficiency and detection accuracy through fine-grained network information processing. The frameworks developed in this research establish a robust foundation for network anomaly detection, providing scalable, adaptive, and privacy-preserving solutions for safeguarding CPS and IoT networks in an increasingly interconnected digital landscape. The practical implications of these research findings are significant, as they can inform the development of next-generation network security systems and contribute to the protection of critical infrastructure against sophisticated cyber attacks.

Marfo, William↗

DOE OSTI2023

Classification based anomaly detection

An example device includes processing circuitry and a memory. The memory includes instructions that cause the device to perform various functions. The functions include receiving datastreams from a plurality of sensors of a high performance computing system, classifying each datastream of the each sensor to one of a plurality of datastream models, selecting an anomaly detection algorithm from a plurality of anomaly detection algorithms for each datastream, determining parameters of the each anomaly detection algorithm, determining an anomaly threshold for each datastream, and generating an indication that the sensor associated with the datastream is acting anomalously.

Serebryakov, Sergey↗

DOE OSTI2021

Anomaly Detection, Localization and Classification using Drifting Synchrophasor Data Streams

With ongoing automation and digitization of the electric power system, several Phasor Measurement Units(PMUs) have been deployed for monitoring and control. PMU data can have multiple anomalies, and many of the researchers in the past have concentrated on training machine/deep learning algorithms offline for anomaly detection over PMU data (i.e., not in real time). These machine/deep learning algorithms, when trained offline on a sample rather than a population of the dataset, fail to consider the dynamic behavior of the power grid in real-time, resulting in low accuracy. Considering the dynamic behavior of the power grid (e.g., change in load, generation, distributed energy resources (DERs) switching, network, controls), the definition of data anomalies varies in time and requires online training. A fundamental challenge is to enable online (i.e., real-time) training of machine/deep learning algorithms for anomaly detection over streaming PMU data. While machine/deep learning is often desirable to manage data streams, training a deep learning algorithm over streaming PMU data is nontrivial due to changes in data statistics caused by dynamic streaming data. This paper proposes PMUNET: a novel device-level deep learning-based data-driven approach for anomaly detection, localization, and classification over streaming PMU data, using online learning and multivariate data-drift detection algorithm .Two variants of PMUNET, Dynamic data Change Driven Learning (DCDL) and Continuity Driven Learning (CDL), are proposed and compared. DCDL aims to train the deep learning algorithm whenever the definition of anomaly changes due to the power grid dynamics. On the other hand, CDL continuously trains the deep learning algorithm over the PMU data-stream. The experimental results verify that DCDL outperforms CDL and other efficient anomaly detection methods over multiple events such as faults and load/ generator/capacitor/DERs variations/switching for IEEE 14 and 39 Bus test system as well as real PMU industrial data. The result verifies that DCDL variant of PMUNET improves over existing approach with a gain of 2% - 10% in terms of accuracy, false-positive rate, and false-negative rate.

adversarial deep learning↗

DOE OSTI2024

Efficiency of ML Anomaly Detection Triggers for Emerging Jets

Novel machine learning-based anomaly detection Level 1 (L1) triggers are currently under development at CMS, namely AXOL1TL and CICADA. The former employs a variational autoencoder, while the latter utilizes a convolutional autoencoder. These triggers aim to balance rate reduction with model independence, enabling the selection of potentially significant events that might be overlooked by traditional triggers relying on basic kinematic variable selections. Consequently, they have the potential to enhance signals indicative of physics beyond the Standard Model, such as those associated with emerging jets. Such signals are predicted by models featuring a composite dark sector where long-lived particles decay into Standard Model jets with displaced tracks and numerous vertices. This study evaluates the efficiency of these anomaly detection triggers in selecting events with emerging jets produced via the s-channel production of two dark quarks.

72 PHYSICS OF ELEMENTARY PARTICLES AND FIELDS↗

DOE OSTI2024

Efficiency of ML Anomaly Detection Triggers for Emerging Jets

Novel machine learning-based anomaly detection Level 1 (L1) triggers are currently under development at CMS, namely AXOL1TL and CICADA. The former employs a variational autoencoder, while the latter utilizes a convolutional autoencoder. These triggers aim to balance rate reduction with model independence, enabling the selection of potentially significant events that might be overlooked by traditional triggers relying on basic kinematic variable selections. Consequently, they have the potential to enhance signals indicative of physics beyond the Standard Model, such as those associated with emerging jets. Such signals are predicted by models featuring a composite dark sector where long-lived particles decay into Standard Model jets with displaced tracks and numerous vertices. This study evaluates the efficiency of these anomaly detection triggers in selecting events with emerging jets produced via the s-channel production of two dark quarks.

72 PHYSICS OF ELEMENTARY PARTICLES AND FIELDS↗

DOE OSTI2024

Efficiency of ML Anomaly Detection Triggers for Emerging Jets

Novel machine learning-based anomaly detection Level 1 (L1) triggers are currently under development at CMS, namely AXOL1TL and CICADA. The former employs a variational autoencoder, while the latter utilizes a convolutional autoencoder. These triggers aim to balance rate reduction with model independence, enabling the selection of potentially significant events that might be overlooked by traditional triggers relying on basic kinematic variable selections. Consequently, they have the potential to enhance signals indicative of physics beyond the Standard Model, such as those associated with emerging jets. Such signals are predicted by models featuring a composite dark sector where long-lived particles decay into Standard Model jets with displaced tracks and numerous vertices. This study evaluates the efficiency of these anomaly detection triggers in selecting events with emerging jets produced via the s-channel production of two dark quarks.

43 PARTICLE ACCELERATORS↗

DOE OSTI2022

Bayesian Estimation of Oscillator Parameters: Toward Anomaly Detection and Cyber-Physical System Security

Cyber-physical system security presents unique challenges to conventional measurement science and technology. Anomaly detection in software-assisted physical systems, such as those employed in additive manufacturing or in DNA synthesis, is often hampered by the limited available parameter space of the underlying mechanism that is transducing the anomaly. As a result, the formulation of anomaly detection for such systems often leads to inverse or ill-posed problems, requiring statistical treatments. Here, we present Bayesian inference of unknown parameters associated with a generic actuator considered as a representative vital element of a cyber-physical system. Via a series of experimental input-output measurements, a transfer function for the actuator is obtained numerically, which serves as our model for the proposed method. Linear, nonlinear, and delayed dynamics may be assumed for the actuator response. By devising a code-based malicious signal, we study the efficacy of Bayesian inference for its potential to produce a detection, including uncertainty quantification, with a remarkably small number of input data points. Our approach should be adaptable to a variety of real-time cyber-physical anomaly detection scenarios.

47 OTHER INSTRUMENTATION↗

DOE OSTI2025

Edge AI-Enhanced Traffic Monitoring and Anomaly Detection Using Multimodal Large Language Models

This paper addresses the challenge of traffic monitoring and incident detection in remote areas, utilizing multimodal large language models (LLMs) deployed on edge AI devices. The key novelty of the LLM is to convert real-time video streams into descriptive texts, enabling low-bandwidth transmissions and reliable detection of anomalies and incidents in environments of intermittent connectivity. The model is developed based on fine-tuning open-source LLMs and extending it with multi-modal capabilities to analyze video frames. Our work also involves deploying this model on edge devices such as Nvidia IGX Orin and is planned to be tested in realistic environments in future work. The methodology includes data set curation, iterative model fine-tuning and compression, and hardware-based optimization. This approach aims to enhance traffic safety and response speed in remote areas, marking a significant advancement in the application of AI for traffic monitoring and safety management.

Peruski, Ryan [University of Tennessee, Knoxville ↗

NASA NTRS2004

Dual Use Corrosion Inhibitor and Penetrant for Anomaly Detection in Neutron/X Radiography

A dual purpose corrosion inhibitor and penetrant composition sensitive to radiography interrogation is provided. The corrosion inhibitor mitigates or eliminates corrosion on the surface of a substrate upon which the corrosion inhibitor is applied. In addition, the corrosion inhibitor provides for the attenuation of a signal used during radiography interrogation thereby providing for detection of anomalies on the surface of the substrate.

Hall, Phillip B.↗

DOE OSTI2022

Systems and methods for powder bed additive manufacturing anomaly detection

Detection and classification of anomalies for powder bed metal additive manufacturing. Anomalies, such as recoater blade impacts, binder deposition issues, spatter generation, and some porosities, are surface-visible at each layer of the building process. A multi-scaled parallel dynamic segmentation convolutional neural network architecture provides additive manufacturing machine and imaging system agnostic pixel-wise semantic segmentation of layer-wise powder bed image data. Learned knowledge is easily transferrable between different additive manufacturing machines. The anomaly detection can be conducted in real-time and provides accurate and generalizable results.

Scime, Luke R.↗

DOE OSTI2024

OT Operational Anomaly Detection (OAD) T&D + DER

The growth of utility-scale renewable energy resources, distributed energy resources (DER), and transportation electrification has increased uncertainty and cybersecurity risks in power grids. The Purdue Enterprise Reference Architecture model which is widely adopted by the utility industry is now insufficient to protect the power grid against cyber-attacks. There is a need to identify what cybersecurity model is effective on Energy Management System (EMS), Advanced Distribution Management System (ADMS), and DER Management System (DERMS) to address the fundamental cybersecurity challenges in the age of increasing renewable energy and DER share as well as consumer participation in the electric energy industry. The next generation of cybersecurity model for OT network should be able to detect inside attackers, mitigate the cybersecurity risks arising from the new grid participants including DER aggregators, electric vehicle owners, and behind-the-meter consumers outside the utility company, and develop the strategy to trust consumer measurement data. This panel will discuss the challenges and pathways for the development of an ensemble cybersecurity model based on predictive state estimation to detect cybersecurity anomalies in OT network including EMS, ADMS, and DERMS.

cybersecurity↗

DOE OSTI2025

Anomaly Detection Based on Machine Learning for the CMS Electromagnetic Calorimeter Online Data Quality Monitoring

Using a semi-supervised machine learning approach we present a real-time anomaly detection system based on an autoencoder used for online data quality monitoring of the CMS electromagnetic calorimeter operating at the CERN LHC. We introduce a novel method that maximizes the anomaly detection performance making use of the time-dependence of anomalies and the spatial variations in the detector response. The autoencoder-based system efficiently detects anomalies in real time and maintains a very low false discovery rate. We validate the performance of this novel system with anomalies from LHC collision data taken in 2018 and 2022. In addition, results are presented after deploying the autoencoder-based system in the CMS online Data Quality Monitoring workflow at the beginning of LHC Run 3 resulting in the system to detect issues that were missed by the existing system.

Harilal, Abhirami [Carnegie Mellon University, Pit↗