Online unsupervised detection of anomalies is crucial to guarantee the
correct operation of cyber-physical systems and the safety of humans
interacting with them. State-of-the-art approaches based on deep learning via
neural networks achieve outstanding performance at anomaly recognition,
evaluating the discrepancy between a normal model of the system (with no
anomalies) and the real-time stream of sensor time series. However, large
training data and time are typically required, and explainability is still a
challenge to identify the root of the anomaly and implement predictive
maintainance. In this paper, we use causal discovery to learn a normal causal
graph of the system, and we evaluate the persistency of causal links during
real-time acquisition of sensor data to promptly detect anomalies. On two
benchmark anomaly detection datasets, we show that our method has higher
training efficiency, outperforms the accuracy of state-of-the-art neural
architectures and correctly identifies the sources of $>10$ different
anomalies. The code for experimental replication is at
this http URL

利用因果发现学习系统的正常因果图，通过实时传感器数据的因果连接持久性评估来及时检测异常。在两个基准异常检测数据集上，我们的方法具有更高的训练效率，超越了最先进神经网络架构的准确性，并准确地识别了 10 种以上不同的异常。

基于时序因果发现的可解释在线无监督异常检测方法研究

Explainable Online Unsupervised Anomaly Detection for Cyber-Physical  Systems via Causal Discovery from Time Series

Anomaly detection in dynamic graphs presents a significant challenge due to
the temporal evolution of graph structures and attributes. The conventional
approaches that tackle this problem typically employ an unsupervised learning
framework, capturing normality patterns with exclusive normal data during
training and identifying deviations as anomalies during testing. However, these
methods face critical drawbacks: they either only depend on proxy tasks for
general representation without directly pinpointing normal patterns, or they
neglect to differentiate between spatial and temporal normality patterns,
leading to diminished efficacy in anomaly detection. To address these
challenges, we introduce a novel Spatial-Temporal memories-enhanced graph
autoencoder (STRIPE). Initially, STRIPE employs Graph Neural Networks (GNNs)
and gated temporal convolution layers to extract spatial features and temporal
features, respectively. Then STRIPE incorporates separate spatial and temporal
memory networks, which capture and store prototypes of normal patterns, thereby
preserving the uniqueness of spatial and temporal normality. After that,
through a mutual attention mechanism, these stored patterns are then retrieved
and integrated with encoded graph embeddings. Finally, the integrated features
are fed into the decoder to reconstruct the graph streams which serve as the
proxy task for anomaly detection. This comprehensive approach not only
minimizes reconstruction errors but also refines the model by emphasizing the
compactness and distinctiveness of the embeddings in relation to the nearest
memory prototypes. Through extensive testing, STRIPE has demonstrated a
superior capability to discern anomalies by effectively leveraging the distinct
spatial and temporal dynamics of dynamic graphs, significantly outperforming
existing methodologies, with an average improvement of 15.39% on AUC values.

通过引入一种新颖的空间 - 时间记忆增强图自编码器 (STRIPE)，该论文解决了动态图中异常检测面临的挑战，通过有效利用动态图的空间和时间动态特性，成功实现了异常识别，并在 AUC 值上取得了 15.39% 的平均改进。

空时记忆增强的图自编码器用于动态图的异常检测

Spatial-temporal Memories Enhanced Graph Autoencoder for Anomaly  Detection in Dynamic Graphs

In weakly supervised video anomaly detection (WVAD), where only video-level
labels indicating the presence or absence of abnormal events are available, the
primary challenge arises from the inherent ambiguity in temporal annotations of
abnormal occurrences. Inspired by the statistical insight that temporal
features of abnormal events often exhibit outlier characteristics, we propose a
novel method, BN-WVAD, which incorporates BatchNorm into WVAD. In the proposed
BN-WVAD, we leverage the Divergence of Feature from Mean vector (DFM) of
BatchNorm as a reliable abnormality criterion to discern potential abnormal
snippets in abnormal videos. The proposed DFM criterion is also discriminative
for anomaly recognition and more resilient to label noise, serving as the
additional anomaly score to amend the prediction of the anomaly classifier that
is susceptible to noisy labels. Moreover, a batch-level selection strategy is
devised to filter more abnormal snippets in videos where more abnormal events
occur. The proposed BN-WVAD model demonstrates state-of-the-art performance on
UCF-Crime with an AUC of 87.24%, and XD-Violence, where AP reaches up to
84.93%. Our code implementation is accessible at
this https URL

在弱监督视频异常检测（WVAD）中，我们提出了一种新方法 BN-WVAD，它将 BatchNorm 技术应用于 WVAD 中，利用来自 BatchNorm 的均值向量差异（DFM）作为可靠的异常判据来区分异常视频中的潜在异常片段，并且使用 DFM 作为额外的异常分数修正对异常分类器的预测，同时设计了一种批级选择策略以过滤更多异常片段，实验结果表明，BN-WVAD 模型在 UCF-Crime 数据集上达到了 87.24% 的 AUC， 在 XD-Violence 数据集上达到了 84.93% 的 AP。