Covariate shift may impact the operational safety performance of neural
networks. A re-evaluation of the safety performance, however, requires
collecting new operational data and creating corresponding ground truth labels,
which often is not possible during operation. We are therefore proposing to
reshape the initial test set, as used for the safety performance evaluation
prior to deployment, based on an approximation of the operational data. This
approximation is obtained by observing and learning the distribution of
activation patterns of neurons in the network during operation. The reshaped
test set reflects the distribution of neuron activation values as observed
during operation, and may therefore be used for re-evaluating safety
performance in the presence of covariate shift. First, we derive conservative
bounds on the values of neurons by applying finite binning and static dataflow
analysis. Second, we formulate a mixed integer linear programming (MILP)
constraint for constructing the minimum set of data points to be removed in the
test set, such that the difference between the discretized test and operational
distributions is bounded. We discuss potential benefits and limitations of this
constraint-based approach based on our initial experience with an implemented
research prototype.

基于神经网络的激活模式和操作数据的近似分布，我们提出了一种基于约束的方法，通过重塑初始测试集来重新评估神经网络的安全性能，以解决协变量转移对操作安全性能的影响问题。

神经网络在协变量转换下的安全性能

Safety Performance of Neural Networks in the Presence of Covariate Shift

Secure and reliable data communication in optical networks is critical for
high-speed internet. We propose a data driven approach for the anomaly
detection and faults identification in optical networks to diagnose physical
attacks such as fiber breaks and optical tapping. The proposed methods include
an autoencoder-based anomaly detection and an attention-based bidirectional
gated recurrent unit algorithm for the fiber fault identification and
localization. We verify the efficiency of our methods by experiments under
various attack scenarios using real operational data.

提出了基于数据驱动的方法，包括自编码器的异常检测和注意力机制的双向门控循环单元算法，以诊断物理攻击如光纤断裂和光学窃听对光网络的影响，并在各种攻击方案下使用实际运行数据验证了该方法的有效性。

基于机器学习的光纤监测异常检测

ML-based Anomaly Detection in Optical Fiber Monitoring

This study proposes an anomaly detection method for operational data of
industrial control systems (ICSs). Sequence-to-sequence neural networks were
applied to train and predict ICS operational data and interpret their
time-series characteristic. The proposed method requires only a normal dataset
to understand ICS's normal state and detect outliers. This method was evaluated
with SWaT (secure water treatment) dataset, and 29 out of 36 attacks were
detected. The reported method also detects the attack points, and 25 out of 53
points were detected. This study provides a detailed analysis of false
positives and false negatives of the experimental results.

本研究提出了一种工业控制系统（ICS）操作数据的异常检测方法，采用序列到序列的神经网络进行训练与预测，解读其时间序列特征。该方法仅需要正常数据集，即可了解 ICS 的正常状态并检测异常。使用 SWaT 数据集进行评估，并检测出了 36 次攻击中的 29 次和 53 个攻击点中的 25 个，对实验结果的误警与漏警进行了详细分析。