• Journal of KIBIM
• /
• v.13 no.3
• /
• pp.12-20
• /
• 2023

Deep learning-based anomaly detection technology is used in various fields such as computer vision, speech recognition, and natural language processing. In particular, this technology is applied in various fields such as monitoring manufacturing equipment abnormalities, detecting financial fraud, detecting network hacking, and detecting anomalies in medical images. However, in the field of construction and architecture, research on deep learning-based data anomaly detection technology is difficult due to the lack of digitization of domain knowledge due to late digital conversion, lack of learning data, and difficulties in collecting and processing field data in real time. This study acquires necessary data through IoT (Internet of Things) from the viewpoint of monitoring for environmental management of architectural spaces, converts them into a database, learns deep learning, and then supports anomaly patterns using AI (Artificial Infelligence) deep learning-based anomaly detection. We propose an implementation process. The results of this study suggest an effective environmental anomaly pattern detection solution architecture for environmental management of architectural spaces, proving its feasibility. The proposed method enables quick response through real-time data processing and analysis collected from IoT. In order to confirm the effectiveness of the proposed method, performance analysis is performed through prototype implementation to derive the results.

• Journal of Environmental Science International
• /
• v.2 no.3
• /
• pp.179-191
• /
• 1993

This paper aims to know the characteristics of occurrence of the anomaly level and variability of the monthly precipitation in Kyeongnam, Korea. For this study, it was investigated 주e distribution of the annual and cont비y mean precipitation, the precipitation variability and its annual change, and the characteristics of occurrence of the anomaly level in Kyeongnam area the results were summarized as follows : 1) she mean of annual total precipitation averaged over Kyeongnam area is 1433.3mm. I'he spatial distribution of the annual total precipitation shows that in Kyeongnam area, the high rainfall area locates in the southwest area and south coast and the low rainfall area in an inland area. 2) Monthly mean precipitation in llyeongnam area was the highest in July(266.4mm) 각lowed by August(238.0mm), June(210.2mm) in descending order. In summer season, rainfall was concentrated and accounted for 49.9 percent of the annual total precipitation. Because convergence of the warm and humid southwest current which was influenced by Changma and typhoon took place well in this area. 3) The patterns of annual change of precipitaion variability can be divided into two types; One is a coast type and the other an inland type. The variability of precipitation generally appears low in spring and summer season and high in autumn and winter season. This is in accord with the large and small of precipitation. 4) The high frequency of anomaly level was N( Normal)-level and the next was LN( Low Informal) -level and 25(Extremely Subnormal)-level was not appeared in all stations. The occurrence frequency of N level was high in high rainfall area and distinguish성 in spring and summer season but the low rainfall area was not. hey Words : anomaly level, variability, precipitation, coast type, inland type.

• Journal of Applied Reliability
• /
• v.18 no.1
• /
• pp.20-32
• /
• 2018

Purpose: The purpose of this study is to set up an anomaly detection criteria for sensor data coming from a motorcycle. Methods: Five sensor values for accelerator pedal, engine rpm, transmission rpm, gear and speed are obtained every 0.02 second from a motorcycle. Exploratory data analysis is used to find any pattern in the data. Traditional process control methods such as X control chart and time series models are fitted to find any anomaly behavior in the data. Finally unsupervised learning algorithm such as k-means clustering is used to find any anomaly spot in the sensor data. Results: According to exploratory data analysis, the distribution of accelerator pedal sensor values is very much skewed to the left. The motorcycle seemed to have been driven in a city at speed less than 45 kilometers per hour. Traditional process control charts such as X control chart fail due to severe autocorrelation in each sensor data. However, ARIMA model found three abnormal points where they are beyond 2 sigma limits in the control chart. We applied a copula based Markov chain to perform statistical process control for correlated observations. Copula based Markov model found anomaly behavior in the similar places as ARIMA model. In an unsupervised learning algorithm, large sensor values get subdivided into two, three, and four disjoint regions. So extreme sensor values are the ones that need to be tracked down for any sign of anomaly behavior in the sensor values. Conclusion: Exploratory data analysis is useful to find any pattern in the sensor data. Process control chart using ARIMA and Joe's copula based Markov model also give warnings near similar places in the data. Unsupervised learning algorithm shows us that the extreme sensor values are the ones that need to be tracked down for any sign of anomaly behavior.

• Journal of KIISE
• /
• v.45 no.3
• /
• pp.294-302
• /
• 2018

With the emergence of the new service industry due to the development of information and communication technology, cyber space risks such as personal information infringement and industrial confidentiality leakage have diversified, and the security problem has emerged as a critical issue. In this paper, we propose a behavior-based anomaly detection method that is suitable for real-time and large-volume data analysis technology. We show that the proposed detection method is superior to existing signature security countermeasures that are based on large-capacity user log data according to in-company personal information abuse and internal information leakage. As the proposed behavior-based anomaly detection method requires a technique for processing large amounts of data, a real-time search engine is used, called Elasticsearch, which is based on an inverted index. In addition, statistical based frequency analysis and preprocessing were performed for data analysis, and the DBSCAN algorithm, which is a density based clustering method, was applied to classify abnormal data with an example for easy analysis through visualization. Unlike the existing anomaly detection system, the proposed behavior-based anomaly detection technique is promising as it enables anomaly detection analysis without the need to set the threshold value separately, and was proposed from a statistical perspective.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.14 no.7
• /
• pp.3093-3115
• /
• 2020

Network anomaly detection system plays an essential role in detecting network anomaly and ensuring network security. Anomaly detection system based machine learning has become an increasingly popular solution. However, due to the unbalance and high-dimension characteristics of network traffic, the existing methods unable to achieve the excellent performance of high accuracy and low false alarm rate. To address this problem, a new network anomaly detection method based on data balancing and recursive feature addition is proposed. Firstly, data balancing algorithm based on improved KNN outlier detection is designed to select part respective data on each category. Combination optimization about parameters of improved KNN outlier detection is implemented by genetic algorithm. Next, recursive feature addition algorithm based on correlation analysis is proposed to select effective features, in which a cross contingency test is utilized to analyze correlation and obtain a features subset with a strong correlation. Then, random forests model is as the classification model to detection anomaly. Finally, the proposed algorithm is evaluated on benchmark datasets KDD Cup 1999 and UNSW_NB15. The result illustrates the proposed strategies enhance accuracy and recall, and decrease the false alarm rate. Compared with other algorithms, this algorithm still achieves significant effects, especially recall in the small category.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.34 no.3B
• /
• pp.311-317
• /
• 2009

The traditional network anomaly detection systems execute the threshold-based detection without considering dynamic network environments, which causes false positive and limits an effective resource utilization. To overcome the drawbacks, we present the adaptive network anomaly detection model based on artificial immune system (AIS) in centralized network. AIS is inspired from human immune system that has learning, adaptation and memory. In our proposed model, the interaction between dendritic cell and T-cell of human immune system is adopted. We design the main components, such as central node and router node, and define functions of them. The central node analyzes the anomaly information received from the related router nodes, decides response policy and sends the policy to corresponding nodes. The router node consists of detector module and responder module. The detector module perceives the anomaly depending on learning data and the responder module settles the anomaly according to the policy received from central node. Finally we evaluate the possibility of the proposed detection model through simulation.

• Smart Structures and Systems
• /
• v.30 no.6
• /
• pp.661-671
• /
• 2022

Stayed cables are the key components for transmitting loads in cable-stayed bridges. Therefore, it is very important to evaluate the cable force condition to ensure bridge safety. An online condition assessment and anomaly localization method is proposed for cables based on the spatiotemporal correlation of grouped cable forces. First, an anomaly sensitive feature index is obtained based on the distribution characteristics of grouped cable forces. Second, an adaptive anomaly detection method based on the k-nearest neighbor rule is used to perform dissimilarity measurements on the extracted feature index, and such a method can effectively remove the interference of environment factors and vehicle loads on online condition assessment of the grouped cable forces. Furthermore, an online anomaly isolation and localization method for stay cables is established, and the complete decomposition contributions method is used to decompose the feature matrix of the grouped cable forces and build an anomaly isolation index. Finally, case studies were carried out to validate the proposed method using an in-service cable-stayed bridge equipped with a structural health monitoring system. The results show that the proposed approach is sensitive to the abnormal distribution of grouped cable forces and is robust to the influence of interference factors. In addition, the proposed approach can also localize the cables with abnormal cable forces online, which can be successfully applied to the field monitoring of cables for cable-stayed bridges.

• Economic and Environmental Geology
• /
• v.31 no.1
• /
• pp.59-68
• /
• 1998

Gravity, magnetic and VLF surveys were carried out to investigate the dimension, nature and stability of the waste materials filled in the Seokdae landfill, Pusan. The Seokdae landfill, which is located in a former valley, was used as a dump for mainly domestic-type waste materials for 6 years from 1987. The landfill site is classfied into A, B, C and D areas according to the sequence of dumping period. The Bouguer gravity anomaly map shows maximum variation of 3.1 mgals on the landfill and its general appearance has close relation with the thickness of waste filled. The local variation of anomaly, however, reflect the degree of compactness of waste materials which may be affected by the nature of waste and dumping time. In the case of area A, where dumping process was terminated at the very last stage, most part show negative anomaly compared to other areas. We think that the composition of the waste materials in the area A is high in leftover food and paper trash and they are still in uncompacted condition. In area B, the general trend of variation of gravity anomaly is appeared to be high anomaly in northern part and decrease to the southern part. This is well matched with the prelandfill topography of the landfill site. The southern part of area B is located in the center of valley and its present surface is comparatively rugged, which may be due to the differential settlement of deep burried waste. The thickness of waste in area C is relatively thin, but the gravity anomaly appears to be low. Considering the present condition of surface, it can be inferred that low density wastes such as leftover food were mainly filled in this area. Area D, as in the case of area B, shows gravity anomaly that has close relation with the prelandfill topography. Magnetic data show the variation of total field intensity varies in the range of 46600~51000 nT, and reach maximum anomaly of 4400 nT. The overall pattern of magnetic anomaly well reflects the distribution of magnetic materials in the landfill. The result of VLF survey reveals several low resistivity zones, which may serve as underground passages for contaminant flow, in the area C located near the small Village.

• Journal of Intelligence and Information Systems
• /
• v.28 no.2
• /
• pp.101-125
• /
• 2022

Recently, with the development of computing technology and the improvement of the cloud environment, deep learning technology has developed, and attempts to apply deep learning to various fields are increasing. A typical example is anomaly detection, which is a technique for identifying values or patterns that deviate from normal data. Among the representative types of anomaly detection, it is very difficult to detect a contextual anomaly that requires understanding of the overall situation. In general, detection of anomalies in image data is performed using a pre-trained model trained on large data. However, since this pre-trained model was created by focusing on object classification of images, there is a limit to be applied to anomaly detection that needs to understand complex situations created by various objects. Therefore, in this study, we newly propose a two-step pre-trained model for detecting abnormal situation. Our methodology performs additional learning from image captioning to understand not only mere objects but also the complicated situation created by them. Specifically, the proposed methodology transfers knowledge of the pre-trained model that has learned object classification with ImageNet data to the image captioning model, and uses the caption that describes the situation represented by the image. Afterwards, the weight obtained by learning the situational characteristics through images and captions is extracted and fine-tuning is performed to generate an anomaly detection model. To evaluate the performance of the proposed methodology, an anomaly detection experiment was performed on 400 situational images and the experimental results showed that the proposed methodology was superior in terms of anomaly detection accuracy and F1-score compared to the existing traditional pre-trained model.

• Journal of Positioning, Navigation, and Timing
• /
• v.2 no.1
• /
• pp.33-40
• /
• 2013

In this paper, GPS signal anomaly generation software is proposed which can be used for the analysis of GPS signal anomaly effect and the design, verification, and operation test of anomalous signal monitoring technique. For the implementation of anomalous signal generation technique, anomalous signals are generated using a commercial signal generation simulator, and their effects and characteristics are analyzed. An error model equation is proposed from the result of analysis, and the anomalous signal generation software is constructed based on this equation. The proposed anomalous signal generation software has high scalability so that users can easily utilize and apply, and is economical as the additional cost for purchasing equipment is not necessary. Also, it is capable of anomalous signal generation based on real-time signal by comparing with the commercial signal generation simulator.