With the wide applications of the unmanned aerial vehicle (UAV), operating safety becomes a critical issue. Thus, fault detection (FD) has been focused, which can realize fault alarm and schedule maintenance in time. Since the accurate physical model of UAV is usually difficult to obtain and flight data with random noise has both spatial and temporal correlation, a huge challenge is posed to FD. In this article, a data-driven multivariate regression approach based on long short-term memory with residual filtering (LSTM-RF) is proposed to fulfill UAV flight data FD and recovery. First, an LSTM network is designed as a regression model, which can extract the spatial–temporal features from the flight data and obtain an estimation of the monitored parameter. Second, a filter is utilized to smooth the residuals between real flight data and estimated values, which mitigates the effect of random noise and dramatically improves the detection performance. Finally, FD is achieved by comparing the smoothed residual with a statistical threshold. Then, fault recovery is fulfilled by replacing fault data with the estimated value. To validate the effectiveness of the proposed method, experiments are conducted based on simulation data and real flight data. The experimental results demonstrate that the proposed method has good performance in FD and recovery of UAV flight data.

With the advent of pervasive cloud computing technologies, service reliability and availability are becoming major concerns,especially as we start to integrate cyber-physical systems with the cloud networks. A number of smart and connected community systems such as emergency response systems utilize cloud networks to analyze real-time data streams and provide context-sensitive decision support.Improving overall system reliability requires us to study all the aspects of the end-to-end of this distributed system,including the backend data servers. In this paper, we describe a bi-layered prognostic architecture for predicting the Remaining Useful Life (RUL) of components of backend servers,especially those that are subjected to degradation. We show that our architecture is especially good at predicting the remaining useful life of hard disks. A Deep LSTM Network is used as the backbone of this fast, data-driven decision framework and dynamically captures the pattern of the incoming data. In the article, we discuss the architecture of the neural network and describe the mechanisms to choose the various hyper-parameters. We describe the challenges faced in extracting effective training sets from highly unorganized and class-imbalanced big data and establish methods for online predictions with extensive data pre-processing, feature extraction and validation through test sets with unknown remaining useful lives of the hard disks. Our algorithm performs especially well in predicting RUL near the critical zone of a device approaching failure.The proposed architecture is able to predict whether a disk is going to fail in next ten days with an average precision of 0.8435.In future, we will extend this architecture to learn and predict the RUL of the edge devices in the end-to-end distributed systems of smart communities, taking into consideration context-sensitive external features such as weather.

We present a precise and scalable verifier for recurrent neural networks, called R2. The verifier is based on two key ideas: (i) a method to compute tight linear convex relaxations of a recurrent update function via sampling and optimization, and (ii) a technique to optimize convex combinations of multiple bounds for each neuron instead of a single bound as previously done. Using R2, we present the first study of certifying a non-trivial use case of recurrent neural networks, namely speech classification. This required us to also develop custom convex relaxations for the general operations that make up speech preprocessing. Our evaluation across a number of recurrent architectures in computer vision and speech domains shows that these networks are out of reach for existing methods as these are an order of magnitude slower than R2, while R2 successfully verified robustness in many cases.

We describe the approach – submitted as part of the 2018 PHM Data Challenge – for estimating time-to-failure or Remaining Useful Life (RUL) of Ion Mill Etching Systems in an online fashion using data from multiple sensors. RUL estimation from multi-sensor data can be considered as learning a regression function that maps a multivariate time series to a real-valued number, i.e. the RUL. We use a deep Recurrent Neural Network (RNN) to learn the metric regression function from multivariate time series. We highlight practical aspects of the RUL estimation problem in this data challenge such as i) multiple operating conditions, ii) lack of knowledge of exact onset of failure or degradation, iii) different operational behavior across tools in terms of range of values of parameters, etc. We describe our solution in the context of these challenges. Importantly, multiple modes of failure are possible in an ion mill etching system; therefore, it is desirable to estimate the RUL with respect to each of the failure modes. The data challenge considers three such modes of failures and requires estimating RULs with respect to each one, implying learning three metric regression functions - one corresponding to each failure mode. We propose a simple yet effective extension to existing methods of RUL estimation using RNN based regression to learn a single deep RNN model that can simultaneously estimate RULs corresponding to all three failure modes. Our best model is an ensemble of two such RNN models and achieves a score of 1:91 X 10^7 on the final validation set..

We continue to develop our neural network (NN) based forecasting approach to anomaly detection (AD) using the Secure Water Treatment (SWaT) industrial control system (ICS) testbed dataset. We propose genetic algorithms (GA) to find the best NN architecture for a given dataset, using the NAB metric to assess the quality of different architectures. The drawbacks of the F1-metric are analyzed. Several techniques are proposed to improve the quality of AD: exponentially weighted smoothing, mean p-powered error measure, individual error weight for each variable, disjoint prediction windows. Based on the techniques used, an approach to anomaly interpretation is introduced.

We consider the problem of estimating the remaining useful life (RUL) of a system or a machine from sensor data. Many approaches for RUL estimation based on sensor data make assumptions about how machines degrade. Additionally, sensor data from machines is noisy and often suffers from missing values in many practical settings. We propose Embed-RUL: a novel approach for RUL estimation from sensor data that does not rely on any degradation-trend assumptions, is robust to noise, and handles missing values. Embed-RUL utilizes a sequence-to-sequence model based on Recurrent Neural Networks (RNNs) to generate embeddings for multivariate time series subsequences. The embeddings for normal and degraded machines tend to be different, and are therefore found to be useful for RUL estimation. We show that the embeddings capture the overall pattern in the time series while filtering out the noise, so that the embeddings of two machines with similar operational behavior are close to each other, even when their sensor readings have significant and varying levels of noise content. We perform experiments on publicly available turbofan engine dataset and a proprietary real-world dataset, and demonstrate that Embed-RUL outperforms the previously reported state-of-the-art on several metrics.

Understanding our marine ecosystems is important to protect the environment and promote the sustainable use of resources. Coastal processes are of of particular interest as the coastal regions have the largest maritime traffic and marine life. Observing these processes is a difficult task due to the harsh environmental conditions and the size of the area to be covered. To solve this task, arrays of robust sensors are required that can handle storms, saltwater, and the daily wear caused by the tides. The resulting amount of data is not manually processable and the chance that a sensor fails increases with growing infrastructure. This thesis proposes an approach to build virtual sensors based on machine learning to replace broken physical sensors. These virtual sensors are trained with sensor data from the Time Series Station Spiekeroog (TSS) and the Biodiversity-Ecosystem Functioning across marine and terrestrial ecosystems (BEFmate) project in the Wadden Sea (German Bight). In the first part of my work, I begin by explaining the data and its preprocessing. Next, an unsupervised extreme event detection task on the TSS data with a subsequent expert evaluation is presented. Then I propose an imputation method for longer consecutively missing values as they appear in our datasets. The method utilizes linear interpolation as its first step, but penalizes these interpolated values based on the length of the gaps with a k-nearest neighbors approach (penalized DTWkNN ensemble). In the second part, I design a neural network architecture to model broken sensors from the BEFmate project. The foundation is a bidirectional recurrent neural network with long short-term memory (bLSTM) that utilizes my time dimensionality reduction method exponential piecewise approximate aggregation (exPAA). Then, I introduce convolutional layers, uncertainty predictions, and my input quality based dropout layer (qDrop) to the architecture, which proves to outperform the architecture with only bLSTM layers. The final architecture has no fully connected layer and allows to determine the impact of individual time series steps on the prediction. This last update also removes a hyper-parameter by learning the noise function for the heteroscedastic uncertainy in separate learning run with a new loss function. Stefan Oehmcke Deep Learning of Virtual Marine Sensors Zusammenfassung Das Verständnis unserer Meeresökosysteme ist wichtig, um die Umwelt zu schützen und die nachhaltige Nutzung von Ressourcen zu fördern. Insbesondere sind Küstenprozesse interessant, da die Küstenregionen den größten Seeverkehr und das meiste Meeresleben aufweisen. Diese Prozesse zu beobachten ist eine schwierige Aufgabe aufgrund der harten Unweltbedingungen und der Größe des abzudeckenden Bereichs. Um diese Aufgabe zu lösen, werden robuste Sensoren benötigt, welche Stürme, Salzwasser und den täglichen Verschleiß der Gezeiten bewältigen können. Durch die wachsende Sensorinfrastruktur sind die anfallenden Datenmengen nicht mehr manuell verarbeitbar und die Wahrscheinlichkeit, dass ein Sensor ausfällt, steigt ebenfalls. Diese Arbeit stellt einen Ansatz vor, wie virtuelle Sensoren basierend auf maschinellem Lernen erstellt werden können, um nicht funktionierende physikalische Sensoren zu ersetzen. Diese virtuellen Sensoren werden mit Sensordaten von der Time Series Station Spiekeroog (TSS) und dem Biodiversity-Ecosystem Functioning across marine and terrestrial ecosystems (BEFmate)-Projekt im Wattenmeer (Deutsche Bucht) trainiert. Im ersten Teil meiner Arbeit erkläre ich zunächst die Daten und deren Vorverarbeitung. Als nächstes wird eine unüberwachte Extremereigniserkennungsaufgabe auf den TSS-Daten mit einer nachfolgenden Expertenauswertung präsentiert. Dann schlage ich eine Imputationsmethode für längere, fortlaufend fehlende Werte vor, wie sie in unseren Datensätzen vorkommen. Das Verfahren verwendet als ersten Schritt eine lineare Interpolation, aber bestraft diese interpolierten Werte basierend auf der Länge der Lücken mit einem k-nächste-Nachbarn-Verfahren (penalized DTWkNN ensemble). Im zweiten Teil entwickle ich eine neuronale Netzwerkarchitektur, um ausgefallene Sensoren aus dem BEFmate-Projekt zu modellieren. Die Grundlage ist ein bidirektionales rekurrentes neuronales Netzwerk mit LangzeitKurzzeitgedächtnis (bLSTM), welches meine zeitliche Dimensionalitätsreduktionsmethode exponential piecewise approximate aggregation (exPAA) verwendet. Dann führe ich Schichten mit Konvolutionen, Unsicherheitsvorhersagen und meine auf Eingangsqualität basierende Dropout-Schicht (qDrop) in die Architektur ein, welche bessere Ergebnisse erziehlt als die Architektur nur mit bLSTM-Schichten. Die finale Architektur hat keine vollständig verbundenen Netzwerkschichten und erlaubt es, die Auswirkung einzelner Zeitreihenschritte auf die Vorhersage zu bestimmen. Außerdem wird ein Hyperparameter entfernt, indem die Rauschfunktion für die heteroskedastische Unsicherheit in einem separaten Lernlauf mit einer neuen Verlustfunktion gelernt wird.

Traditional approaches to building attack detection systems, such as a signature-based approach, do not allow detecting zero-day attacks. To improve the performance of attack detection, one resort to use methods of machine learning, in particular, neural networks. This paper considers the problem of detecting cyber attacks in Industrial Control Systems (ICS) using digital signal processing (DSP) technology. By processing signals from sensors using a comb of digital low-pass filters (LPF), additional informative features, that describe the control system, have been created. Experimental studies were conducted on the Secure Water Treatment (SWaT) dataset, which showed that the use of additional features obtained using DSP technologies improves the accuracy of detecting cyberattacks on ACS by reducing errors of the second kind.

Time series anomaly detection plays a critical role in automated monitoring systems. Most previous deep learning efforts related to time series anomaly detection were based on recurrent neural networks (RNN). In this paper, we propose a time series segmentation approach based on convolutional neural networks (CNN) for anomaly detection. Moreover, we propose a transfer learning framework that pretrains a model on a large-scale synthetic univariate time series data set and then fine-tunes its weights on small-scale, univariate or multivariate data sets with previously unseen classes of anomalies. For the multivariate case, we introduce a novel network architecture. The approach was tested on multiple synthetic and real data sets successfully.

This paper provides an approach to the detection of information security breaches in automated process control systems (APCS), which consists in forecasting multivariate time series formed from the values of the operating parameters of the end system devices. Using an experimental model of water treatment, a comparison was made of the forecasting results for the parameters characterizing the operation of the entire model, and for the parameters characterizing the flow of individual subprocesses implemented by the model. For forecasting, GRU-neural network training was performed.

This paper proposes a generic memory-efficient framework for realtime stochastic extreme events prediction in complex time series systems such as intrusion detection, Internet of Things (IoT), social networks, stock markets etc. Ideally we exploit the expressiveness of deep neural networks and temporal nature of sequence-to-sequence structures (parallel Convolutional and recurrent neural networks) glued on Convolutional Quantile Loss and memory network to model explicitly extreme events. Convolutional Quantile Loss is used to predict future extreme events, while memory network is used to memorize extreme events in future observations. We show that the approach can capture long and short-term temporal effects as well as other non-linear dynamic patterns across multiple probabilistic time series with reliable principled uncertainty estimates. We demonstrate and validate empirically the effectiveness of the proposed framework via extensive experiments and rigorous evaluation on large-scale real world datasets. The experimental results showcase that the proposed method is fast, robust, accurate and has superior performance compared to the well-known prediction methods.

This paper presents a neural network-based anomaly detection system for vehicular communications. The proposed system is able to detect in-vehicle data tampering in order to avoid the transmission of bogus or harmful information. We investigate the use of Long Short-term Memory (LSTM) and Multilayer Perceptron (MLP) neural networks to build two prediction models. For each model, an efficient architecture is designed based on appropriate hardware requirements. Then, a comparative performance analysis is provided to recommend the most efficient neural network model. Finally, a set of metrics are selected to show the accuracy of the proposed detection system under several types of security attacks.

The research on breakdown detection in mechanisms using machine learning methods is described. The problem is reduced to anomaly detection. The review of modern approaches to anomaly detection is made, all of them have been approved on real data. Аs a result, the algorithm for online breakdown detection in complicated mechanisms is constructed. By its nature the algorithm also detects any abnormal behavior: emergency start, work in the dangerous mode, incorrect operation, etc.

The majority of monitoring systems control technological parameters changes independently of one another. However, some signals could have an impact on other. Therefore, a complex evaluation of dynamical system variables should be made. It allows monitoring the system state that could be normal or abnormal. In this paper, we propose a method of data conversion to feature vector for outlier detection and we describe an algorithm of emergency situation prediction. The relevance of the approach is conditioned by the importance of the early anomaly detection, especially in monitoring of technological parameters and industrial safety domain. The experimental results demonstrate the effectiveness of the approach and show the necessity of further research.

The integrity of industrial control systems (ICS) found in utilities, oil and natural gas pipelines, manufacturing plants and transportation is critical to national wellbeing and security. Such systems depend on hundreds of field devices to manage and monitor a physical process. Previously, these devices were specific to ICS but they are now being replaced by general purpose computing technologies and, increasingly, these are being augmented with Internet of Things (IoT) nodes. Whilst there are benefits to this approach in terms of cost and flexibility, it has attracted a wider community of adversaries. These include those with significant domain knowledge, such as those responsible for attacks on Iran’s Nuclear Facilities, a Steel Mill in Germany, and Ukraine’s power grid; however, non-specialist attackers are becoming increasingly interested in the physical damage it is possible to cause. At the same time, the approach increases the number and range of vulnerabilities to which ICS are subject; regrettably, conventional techniques for analysing such a large attack space are inadequate, a cause of major national concern. In this thesis we introduce a generalisable approach based on evolutionary multiobjective algorithms to assist in identifying vulnerabilities in complex heterogeneous ICS systems. This is both challenging and an area that is currently lacking research. Our approach has been to review the security of currently deployed ICS systems, and then to make use of an internationally recognised ICS simulation testbed for experiments, assuming that the attacking community largely lack specific ICS knowledge. Using the simulator, we identified vulnerabilities in individual components and then made use of these to generate attacks. A defence against these attacks in the form of novel intrusion detection systems were developed, based on

The harsh environmental conditions in a marine area make continuous observations of it challenging. To temporally or permanently replace faulty hardware sensors, reliable virtual sensors are getting more and more important. This paper introduces a deep learning architecture for a marine virtual sensor application that is able to utilize input quality information. We propose a novel input quality based dropout layer to take advantage of Information about the quality of the input sensors. The virtual sensor models are built upon convolutional and recurrent long short-term memory layers. We apply a time dimensionality reduction method called exPAA that retains finer details from recent values, but past information with less details are also available to the model. As interpretable reliability is important virtual sensors, we include predictive uncertainty based on dropout and Monte Carlo predictions into our neural network. Experimental results show that we perform better than the baseline and our input quality based dropout layer improves on these results even further. We also provide insights on the learned uncertainty intervals as well as the utilized linear and non-linear correlations of the first convolutional layer.

The distinctive features and key areas of analytical tools application for the operational monitoring and security analysis of cyber-physical systems of critical information infrastructure are highlighted. Problems of applying data analytics methods and technologies to ensure the security of cyber-physical systems at enterprises of the fuel and energy industries are described. The architectural solutions of the advanced security analytics platform are proposed. The chapter discusses the use of data analysis methods and technologies to ensure the security of cyber-physical systems at enterprises of the fuel and energy complex. Identified the distinctive features and highlighted the key areas of application of analytical tools of the system of operational monitoring and security analysis of cyber-physical systems of critical information infrastructure. Problem questions are formulated, the possibilities and limitations of advanced analytics tools in solving the tasks of ensuring the security of cyber-physical systems at the enterprises of the fuel and energy complex are defined. Architectural solutions of the advanced cybersecurity analytics platform are described. The presented results are based on the analysis of information from open sources: materials of scientific-practical conferences, analytical and technical reviews on the subject of security of industrial systems, and generalization of practical experience in the development, implementation, and support of integrated security systems at enterprises of the fuel and energy complex.

The development of industrial revolution 4.0 in industrial sector opened a cyber gap for outsiders to pose a threat to the system. Industrial control systems initially designed to meet SRA (Safety, Reliability, and Availability) priorities are now beginning to be pressed to consider security aspects related to the magnitude of the impact that can be caused due to external attacks. In making a safe Cyber Physical System (CPS) based automation, risk assessment will be used to determine the level risk of threat. Mini distillation column batch based CPS will be implemented as the approach of CPS in industrial sector. Anomaly detection based data-driven model and data recovery method is proposed to lower the impact of attack on this system.

The deployment of Internet of Things (IoT) devices in cyber-physical applications has introduced a new set of vulnerabilities. The new security and reliability challenges require a holistic solution due to the cross-domain, cross-layer, and interdisciplinary nature of IoT systems. However, the majority of works presented in the literature primarily focus on the cyber aspect, including the network and application layers, and the physical layer is often overlooked. In this paper, we utilize IoT sensors that capture the physical properties of the system to ensure the integrity of IoT sensors data and identify anomalous incidents in the environment. We propose an adaptive context-aware anomaly detection method that is optimized to run on a fog computing platform. In this approach, we devise a novel sensor association algorithm that generates fingerprints of sensors, clusters them, and extracts the context of the system. Based on the contextual information, our predictor model, which comprises an Long-Short Term Memory (LSTM) neural network and Gaussian estimator, detects anomalies, and a consensus algorithm identifies the source of the anomaly. Furthermore, our model updates itself to adapt to the variation in the environment and system. The results demonstrate that our model detects the anomaly with 92.0% precision in 532ms, which meets the real-time constraint of the system under test.

The data validity of safe driving in the Internet of Vehicles (IoV) is the basis of improving the safety of vehicles. Different from a traditional information systems, the data anomaly analysis of vehicle safety driving faces the diversity of data anomaly and the randomness and subjectivity of the driver’s driving behavior. How to combine the characteristics of the IOV data with the driving style analysis to provide effective real-time anomaly data detection has become an important issue in the IOV applications. This paper aims at the critical safety data analysis, considering the large computing cost generated by the real-time anomaly detection of all data in the data package. We preprocess it through the traffic cellular automata model which is built to achieve the ideal abnormal detection effect with limited computing resources. On the basis of this model, the Anomaly Detection based on Driving style (ADD) algorithm is proposed to realize real-time and online detection of anomaly data related to safe driving. Firstly, this paper designs the driving coefficient and proposes a driving style quantization model to represent the driving style of the driver. Then, based on driving style quantization model and vehicle driving state information, a data anomaly detection algorithm is developed by using Gaussian mixture model (GMM). Finally, combining with the application scenarios of multi-vehicle collaboration in the Internet of Vehicles, this paper uses real data sets and simulation data sets to analyze the effectiveness of the proposed ADD algorithm.