分层时间记忆（HTM）是一种无监督的学习算法，其灵感来自Neocortex的功能，可用于连续处理流数据并检测异常，而无需大量数据进行培训，也不需要标记数据。 HTM还能够从样本中不断学习，提供一个始终是关于观察的模型。这些特性使HTM特别适用于支持云系统中的在线故障预测，这是具有动态变化行为的系统必须监视以预测问题。本文介绍了在故障预测的背景下评估HTM的第一个系统研究。考虑到72个HTM配置所获得的HTM配置到Clearwater云系统中引入的12种不同类型的故障表明，HTM可以帮助预测具有足够有效性（F-Measure = 0.76）的失败，代表有趣的实际替代方案（半 - ）监督算法。

Anomaly detection is an active research topic in many different fields such as intrusion detection, network monitoring, system health monitoring, IoT healthcare, etc. However, many existing anomaly detection approaches require either human intervention or domain knowledge, and may suffer from high computation complexity, consequently hindering their applicability in real-world scenarios. Therefore, a lightweight and ready-to-go approach that is able to detect anomalies in real-time is highly sought-after. Such an approach could be easily and immediately applied to perform time series anomaly detection on any commodity machine. The approach could provide timely anomaly alerts and by that enable appropriate countermeasures to be undertaken as early as possible. With these goals in mind, this paper introduces ReRe, which is a Real-time Ready-to-go proactive Anomaly Detection algorithm for streaming time series. ReRe employs two lightweight Long Short-Term Memory (LSTM) models to predict and jointly determine whether or not an upcoming data point is anomalous based on short-term historical data points and two long-term self-adaptive thresholds. Experiments based on real-world time-series datasets demonstrate the good performance of ReRe in real-time anomaly detection without requiring human intervention or domain knowledge.

Time series anomaly detection has applications in a wide range of research fields and applications, including manufacturing and healthcare. The presence of anomalies can indicate novel or unexpected events, such as production faults, system defects, or heart fluttering, and is therefore of particular interest. The large size and complex patterns of time series have led researchers to develop specialised deep learning models for detecting anomalous patterns. This survey focuses on providing structured and comprehensive state-of-the-art time series anomaly detection models through the use of deep learning. It providing a taxonomy based on the factors that divide anomaly detection models into different categories. Aside from describing the basic anomaly detection technique for each category, the advantages and limitations are also discussed. Furthermore, this study includes examples of deep anomaly detection in time series across various application domains in recent years. It finally summarises open issues in research and challenges faced while adopting deep anomaly detection models.

现代云计算系统包含数百到数千个计算和存储服务器。这种规模与不断增长的系统复杂性相结合，对可靠云计算的失败和资源管理导致关键挑战。自主失败检测是了解系统级可靠性保证的紧急，云现象和自我管理云资源的重要技术。要检测到失败，我们需要监控云执行并收集运行时性能数据。这些数据通常是未标记的，因此在生产云中并不总是可用的现有故障历史。在本文中，我们提出了一种\ emph {自我不断发展的异常检测}（SEAD）框架，用于云可靠性保证。我们的框架通过递归探索新验证的异常记录并在线持续更新异常探测器。作为我们框架的鲜明优势，云系统管理员只需要检查少量检测到的异常，并且它们的决定可以利用以更新探测器。因此，探测器在升级系统硬件，软件堆栈的更新和用户工作负载的更改之后演变。此外，我们设计了两种类型的探测器，一个用于一般异常检测，另一类用于特异性异常检测。在自我不断发展的技术的帮助下，我们的探测器可以平均达到88.94 \％的灵敏度和94.60 \％，这使得它们适合现实世界部署。

日志是确保许多软件系统的可靠性和连续性，尤其是大规模分布式系统的命令。他们忠实地录制运行时信息，以便于系统故障排除和行为理解。由于现代软件系统的大规模和复杂性，日志量已达到前所未有的水平。因此，对于基于逻究的异常检测，常规的手动检查方法甚至传统的基于机器学习的方法变得不切实际，这是一种不切实际的是，作为基于深度学习的解决方案的快速发展的催化剂。然而，目前在诉诸神经网络的代表性日志的异常探测器之间缺乏严格的比较。此外，重新实现过程需要不琐碎的努力，并且可以轻易引入偏差。为了更好地了解不同异常探测器的特性，在本文中，我们提供了六种最先进的方法使用的五种流行神经网络的全面审查和评估。特别是，4种所选方法是无监督的，并且剩下的两个是监督的。这些方法是用两个公开的日志数据集进行评估，其中包含近1600万日志消息和总共有04万个异常实例。我们相信我们的工作可以作为这一领域的基础，为未来的学术研究和工业应用做出贡献。

A Digital Twin (DT) is a simulation of a physical system that provides information to make decisions that add economic, social or commercial value. The behaviour of a physical system changes over time, a DT must therefore be continually updated with data from the physical systems to reflect its changing behaviour. For resource-constrained systems, updating a DT is non-trivial because of challenges such as on-board learning and the off-board data transfer. This paper presents a framework for updating data-driven DTs of resource-constrained systems geared towards system health monitoring. The proposed solution consists of: (1) an on-board system running a light-weight DT allowing the prioritisation and parsimonious transfer of data generated by the physical system; and (2) off-board robust updating of the DT and detection of anomalous behaviours. Two case studies are considered using a production gas turbine engine system to demonstrate the digital representation accuracy for real-world, time-varying physical systems.

现代高性能计算（HPC）系统的复杂性日益增加，需要引入自动化和数据驱动的方法，以支持系统管理员为增加系统可用性的努力。异常检测是改善可用性不可或缺的一部分，因为它减轻了系统管理员的负担，并减少了异常和解决方案之间的时间。但是，对当前的最新检测方法进行了监督和半监督，因此它们需要具有异常的人体标签数据集 - 在生产HPC系统中收集通常是不切实际的。基于聚类的无监督异常检测方法，旨在减轻准确的异常数据的需求，到目前为止的性能差。在这项工作中，我们通过提出RUAD来克服这些局限性，RUAD是一种新型的无监督异常检测模型。 Ruad比当前的半监督和无监督的SOA方法取得了更好的结果。这是通过考虑数据中的时间依赖性以及在模型体系结构中包括长短期限内存单元的实现。提出的方法是根据tier-0系统（带有980个节点的Cineca的Marconi100的完整历史）评估的。 RUAD在半监督训练中达到曲线（AUC）下的区域（AUC）为0.763，在无监督的训练中达到了0.767的AUC，这改进了SOA方法，在半监督训练中达到0.747的AUC，无需训练的AUC和0.734的AUC在无处不在的AUC中提高了AUC。训练。它还大大优于基于聚类的当前SOA无监督的异常检测方法，其AUC为0.548。

新的纳米级技术的出现对辐射环境中的可靠电子系统造成了重大挑战。少数种类的辐射等全电离剂量（TID）效应通常导致在这种纳米级电子设备上的永久性损坏，以及当前最先进的技术，以使用昂贵的辐射硬化装置。本文重点介绍了一种新颖且不同的方法：在消费者电子级现场可编程门阵列（FPGA）上使用机器学习算法来解决TID效果并在停止工作之前监控它们替换。这种情况有一个研究挑战，以期待电路板因TID效应而导致总失效。我们观察到γ辐射下FPGA板的内部测量，并使用了三种不同的异常检测机学习（ML）算法来检测伽马辐射环境中的传感器测量中的异常。统计结果表明伽马辐射曝光水平与板测量之间的高度显着关系。此外，我们的异常检测结果表明，具有径向基函数内核的单级支持向量机的平均召回得分为0.95。此外，在电路板停止工作之前，可以检测到所有异常。

自动日志文件分析可以尽早发现相关事件，例如系统故障。特别是，自我学习的异常检测技术在日志数据中捕获模式，随后向系统操作员报告意外的日志事件事件，而无需提前提供或手动对异常情况进行建模。最近，已经提出了越来越多的方法来利用深度学习神经网络为此目的。与传统的机器学习技术相比，这些方法证明了出色的检测性能，并同时解决了不稳定数据格式的问题。但是，有许多不同的深度学习体系结构，并且编码由神经网络分析的原始和非结构化日志数据是不平凡的。因此，我们进行了系统的文献综述，概述了部署的模型，数据预处理机制，异常检测技术和评估。该调查没有定量比较现有方法，而是旨在帮助读者了解不同模型体系结构的相关方面，并强调未来工作的开放问题。

使用虚拟机或虚拟机监视器（VMM）的虚拟机（VM）的服务器虚拟化是云计算技术的重要组成部分，提供基础架构 - AS-Service（IAAS）。 VMM中的故障或异常可以传播到托管的VMS上，并最终影响在这些VM上运行的应用程序的可用性和可靠性。因此，识别并最终识别它非常重要。然而，由于用户无法访问VMM，异常VMM检测是云环境中的挑战。本文通过引入名为IAD的新机器学习的算法，解决了基于云的环境中的异常VMM检测在基于云的环境中的这种挑战。该算法仅使用VM的资源利用率数据托管在那些VMMS上进行异常VMMS检测。在包括合成和实际的四个数据集上测试了发达的算法的准确性，并与四个其他流行算法进行比较，这也可以用于所描述的问题。结果发现，所提出的IAD算法的平均F1分数为83.7％，在四个数据集上平均平均，并且也优于其他算法，平均f1分数为11 \％。

机器学习（ML）代表了当前和未来信息系统的关键技术，许多域已经利用了ML的功能。但是，网络安全中ML的部署仍处于早期阶段，揭示了研究和实践之间的显着差异。这种差异在当前的最新目的中具有其根本原因，该原因不允许识别ML在网络安全中的作用。除非广泛的受众理解其利弊，否则ML的全部潜力将永远不会释放。本文是对ML在整个网络安全领域中的作用的首次尝试 - 对任何对此主题感兴趣的潜在读者。我们强调了ML在人类驱动的检测方法方面的优势，以及ML在网络安全方面可以解决的其他任务。此外，我们阐明了影响网络安全部署实际ML部署的各种固有问题。最后，我们介绍了各种利益相关者如何为网络安全中ML的未来发展做出贡献，这对于该领域的进一步进步至关重要。我们的贡献补充了两项实际案例研究，这些案例研究描述了ML作为对网络威胁的辩护的工业应用。

During the past decade, many anomaly detection approaches have been introduced in different fields such as network monitoring, fraud detection, and intrusion detection. However, they require understanding of data pattern and often need a long off-line period to build a model or network for the target data. Providing real-time and proactive anomaly detection for streaming time series without human intervention and domain knowledge is highly valuable since it greatly reduces human effort and enables appropriate countermeasures to be undertaken before a disastrous damage, failure, or other harmful event occurs. However, this issue has not been well studied yet. To address it, this paper proposes RePAD, which is a Real-time Proactive Anomaly Detection algorithm for streaming time series based on Long Short-Term Memory (LSTM). RePAD utilizes short-term historic data points to predict and determine whether or not the upcoming data point is a sign that an anomaly is likely to happen in the near future. By dynamically adjusting the detection threshold over time, RePAD is able to tolerate minor pattern change in time series and detect anomalies either proactively or on time. Experiments based on two time series datasets collected from the Numenta Anomaly Benchmark demonstrate that RePAD is able to proactively detect anomalies and provide early warnings in real time without human intervention and domain knowledge.

Unsupervised anomaly detection in time-series has been extensively investigated in the literature. Notwithstanding the relevance of this topic in numerous application fields, a complete and extensive evaluation of recent state-of-the-art techniques is still missing. Few efforts have been made to compare existing unsupervised time-series anomaly detection methods rigorously. However, only standard performance metrics, namely precision, recall, and F1-score are usually considered. Essential aspects for assessing their practical relevance are therefore neglected. This paper proposes an original and in-depth evaluation study of recent unsupervised anomaly detection techniques in time-series. Instead of relying solely on standard performance metrics, additional yet informative metrics and protocols are taken into account. In particular, (1) more elaborate performance metrics specifically tailored for time-series are used; (2) the model size and the model stability are studied; (3) an analysis of the tested approaches with respect to the anomaly type is provided; and (4) a clear and unique protocol is followed for all experiments. Overall, this extensive analysis aims to assess the maturity of state-of-the-art time-series anomaly detection, give insights regarding their applicability under real-world setups and provide to the community a more complete evaluation protocol.

Concept drift primarily refers to an online supervised learning scenario when the relation between the input data and the target variable changes over time. Assuming a general knowledge of supervised learning in this paper we characterize adaptive learning process, categorize existing strategies for handling concept drift, overview the most representative, distinct and popular techniques and algorithms, discuss evaluation methodology of adaptive algorithms, and present a set of illustrative applications. The survey covers the different facets of concept drift in an integrated way to reflect on the existing scattered state-of-the-art. Thus, it aims at providing a comprehensive introduction to the concept drift adaptation for researchers, industry analysts and practitioners.

异常检测是识别数据中意外事件或AB差异的过程，并且已在许多不同领域（例如系统监控，欺诈检测，医疗保健，入侵检测等）应用。提供实时，轻量级和主动的异常情况对于人类干预和领域知识的时间序列的检测，由于它减少了人类的努力，并在发生灾难性事件发生之前可以进行适当的对策，因此既不具有人为干预和领域知识。据我们所知，Repad（实时主动的异常检测算法）是所有上述特征的通用方法。为了实现实时和轻质检测，重新使用长期记忆（LSTM）来检测每个即将到来的数据点是否基于短期历史数据点是异常的。但是，目前尚不清楚不同数量的历史数据点如何影响续期的性能。因此，在本文中，我们通过引入一组涵盖新颖的检测准确性措施，时间效率，准备和资源消耗等的绩效指标来研究不同历史数据对重新播放的影响。进行时间序列数据集以评估不同情况下的重新播放，并提出和讨论实验结果。

对于由硬件和软件组件组成的复杂分布式系统而言，异常检测是一个重要的问题。对此类系统的异常检测的要求和挑战的透彻理解对于系统的安全性至关重要，尤其是对于现实世界的部署。尽管有许多解决问题的研究领域和应用领域，但很少有人试图对这种系统进行深入研究。大多数异常检测技术是针对某些应用域的专门开发的，而其他检测技术则更为通用。在这项调查中，我们探讨了基于图的算法在复杂分布式异质系统中识别和减轻不同类型异常的重要潜力。我们的主要重点是在分布在复杂分布式系统上的异质计算设备上应用时，可深入了解图。这项研究分析，比较和对比该领域的最新研究文章。首先，我们描述了现实世界分布式系统的特征及其在复杂网络中的异常检测的特定挑战，例如数据和评估，异常的性质以及现实世界的要求。稍后，我们讨论了为什么可以在此类系统中利用图形以及使用图的好处。然后，我们将恰当地深入研究最先进的方法，并突出它们的优势和劣势。最后，我们评估和比较这些方法，并指出可能改进的领域。

及时，准确地检测功率电子中的异常，对于维持复杂的生产系统而变得越来越重要。强大而可解释的策略有助于减少系统的停机时间，并抢占或减轻基础设施网络攻击。这项工作从解释当前数据集和机器学习算法输出中存在的不确定性类型开始。然后引入和分析三种打击这些不确定性的技术。我们进一步介绍了两种异常检测和分类方法，即矩阵曲线算法和异常变压器，它们是在电源电子转换器数据集的背景下应用的。具体而言，矩阵配置文件算法被证明非常适合作为检测流时间序列数据中实时异常的概括方法。迭代矩阵配置文件的结构python库实现用于创建检测器。创建了一系列自定义过滤器并将其添加到检测器中，以调整其灵敏度，回忆和检测精度。我们的数值结果表明，通过简单的参数调整，检测器在各种故障场景中提供了高精度和性能。

The Internet of Things (IoT) is a system that connects physical computing devices, sensors, software, and other technologies. Data can be collected, transferred, and exchanged with other devices over the network without requiring human interactions. One challenge the development of IoT faces is the existence of anomaly data in the network. Therefore, research on anomaly detection in the IoT environment has become popular and necessary in recent years. This survey provides an overview to understand the current progress of the different anomaly detection algorithms and how they can be applied in the context of the Internet of Things. In this survey, we categorize the widely used anomaly detection machine learning and deep learning techniques in IoT into three types: clustering-based, classification-based, and deep learning based. For each category, we introduce some state-of-the-art anomaly detection methods and evaluate the advantages and limitations of each technique.

在智能交通系统中，交通拥堵异常检测至关重要。运输机构的目标有两个方面：监视感兴趣领域的一般交通状况，并在异常拥堵状态下定位道路细分市场。建模拥塞模式可以实现这些目标，以实现全市道路的目标，相当于学习多元时间序列（MTS）的分布。但是，现有作品要么不可伸缩，要么无法同时捕获MTS中的空间信息。为此，我们提出了一个由数据驱动的生成方法组成的原则性和全面的框架，该方法可以执行可拖动的密度估计来检测流量异常。我们的方法在特征空间中的第一群段段，然后使用条件归一化流以在无监督的设置下在群集级别识别异常的时间快照。然后，我们通过在异常群集上使用内核密度估计器来识别段级别的异常。关于合成数据集的广泛实验表明，我们的方法在召回和F1得分方面显着优于几种最新的拥塞异常检测和诊断方法。我们还使用生成模型来采样标记的数据，该数据可以在有监督的环境中训练分类器，从而减轻缺乏在稀疏设置中进行异常检测的标记数据。

System logs are a common source of monitoring data for analyzing computing systems' behavior. Due to the complexity of modern computing systems and the large size of collected monitoring data, automated analysis mechanisms are required. Numerous machine learning and deep learning methods are proposed to address this challenge. However, due to the existence of sensitive data in system logs their analysis and storage raise serious privacy concerns. Anonymization methods could be used to clean the monitoring data before analysis. However, anonymized system logs, in general, do not provide adequate usefulness for the majority of behavioral analysis. Content-aware anonymization mechanisms such as PaRS preserve the correlation of system logs even after anonymization. This work evaluates the usefulness of anonymized system logs taken from the Taurus HPC cluster anonymized using PaRS, for behavioral analysis via recurrent neural network models.