• 异常行为检测

    2016-05-27 14:52:37
    根据物体移动的速度和大小检测物体的异常行为 opencv
  • 网络异常行为检测综述,王雪宁,李小勇,本文总结了基于机器学习和深度学习的网络异常行为检测算法,包括决策树(DT)、贝叶斯分类、支持向量机(SVM)、K最近邻(KNN)、主
  • 异常行为检测算法Anomaly detection is a critical problem that has been researched within diverse research areas and application disciplines. This article aims to construct a structured and ...


    Anomaly detection is a critical problem that has been researched within diverse research areas and application disciplines. This article aims to construct a structured and comprehensive overview of the selected algorithms for anomaly detection by targeting data scientists, data analysts, and machine learning specialists as an audience.

    异常检测是已在各种研究领域和应用学科中研究的一个关键问题。 本文旨在通过将数据科学家,数据分析师和机器学习专家作为受众,针对所选的异常检测算法构建结构全面的概述。

    异常检测的概念 (Concept of Anomaly Detection)

    An unexpected change that performs highly divergent attitudes from other observations in a time period can be represented as abnormal behavior. In other words, Anomaly Detection can be defined as the measure of specifying the outliers in the existing dataset which acts considerably different from the rest of the data points by profiling them as non-conforming normal points.

    在一段时间内与其他观察结果表现出高度分歧的意外变化可以表示为异常行为。 换句话说,异常检测 可以定义为在现有数据集中指定离群值的度量,该离群通过将它们配置为不合格的法线点而与其余数据点有很大不同。

    Anomalous points might be produced by errors in the data; however, it could point out to a historically or currently existing unidentified or hidden process or behavior by Hawkins.

    异常点可能是由数据错误产生的; 但是,它可能指出了Hawkins在历史上或当前存在的未识别或隐藏的过程或行为

    As the publicly available data volume reaches in mass amounts, outlier detecting algorithms are modified to run on these data sets to be able to predict the unusual patterns. For instance, a “suspiciously high” count of login trials might outline a possible cyber intrusion or a considerable increase in incoming network traffic can be pointed to malicious activity in network systems. Considering these activities, they hold a shared aspect that they are “appealing” and “unusual” to the data scientists and data analysts. The “curiosity” or real-life applicability of anomalies is an essential element of anomaly detection.

    随着公开可用数据量的大量增加,离群值检测算法已修改为在这些数据集上运行,以便能够预测异常模式。 例如,登录试验的“可疑数量可能概述了可能的网络入侵,或者传入网络流量的显着增加可能表明网络系统中存在恶意活动。 考虑到这些活动,它们具有一个共同的方面,即它们对数据科学家和数据分析师“具有吸引力”“不同寻常” 。 异常的“好奇心”或现实适用性是异常检测的基本要素。

    异常类型 (Types of Anomalies)

    There exist three different kinds of anomalies in the literature.


    Image for post
    Figure 1. Types & Examples of Anomaly Detection. (Image by the author)图1.异常检测的类型和示例。 (图片由作者提供)

    Descriptions can be found below:


    1. Point Anomaly: An anomaly when a distinct item in a dataset is largely dissimilar from others corresponding to its attributes.


    Image for post
    Figure 2. The point anomaly is marked with red. (Image by the author)图2.点异常标记为红色。 (图片由作者提供)

    2. Contextual Anomalies: An anomaly which has a divergence that points to a context-based knowledge. This kind of anomaly may not be recognized when the contextual information is absent.

    2.上下文异常:具有差异的异常,该异常指向基于上下文的知识。 当缺少上下文信息时,可能无法识别这种异常。

    Image for post
    Figure 3. The contextual anomalous point that can be explained in its context. (Image by Author)图3.可以在上下文中解释的上下文异常点。 (图片由作者提供)

    3. Collective Anomalies: Anomalies that are composed of multiple related instances of elements that may not constitute an anomalous point individually. The collective summation of specific events is considered while analyzing outlier behaviors.

    3.集体异常:由元素的多个相关实例组成的异常,这些元素可能不会单独构成异常点。 在分析异常行为时,应考虑特定事件的集体汇总。

    Image for post
    Figure 4. Collective Anomaly Detection highlighted in the red line. (Image by the author)图4.红线中突出显示的集体异常检测。 (图片由作者提供)

    目录 (Table of Contents)

    1. Statistical Approach1.1. Minimum Covariance Determinant (MCD)1.2. Principle Component Analysis (PCA)

    1.统计方法1.1。 最小协方差决定因素(MCD) 1.2。 主成分分析(PCA)

    2. Distance-based Approach
    Local Outlier Factor (LOF)
    Novelty Detection Local Outlier Factor (ND LOF)
    Mahalanobis Distance (MDist)

    2.基于距离的方法2.1。 局部离群因子(LOF) 2.2。 新奇检测局部离群因子(ND LOF) 2.3。 马氏距离(MDist)

    3. Density-based Approach
    Density-Based Spatial Clustering of Applications with Noise (DBSCAN)
    Ordering Points To Identify the Clustering Structure (OPTICS)

    3.基于密度的方法3.1。 基于密度的噪声应用空间聚类(DBSCAN) 3.2。 识别聚类结构的排序点(OPTICS)

    4. Isolation-based Approach
    Isolation Forest (iForest)

    4.基于隔离的方法4.1。 隔离林(iForest)

    5. Classification-based Approach
    One-Class SVM

    5.基于分类的方法5.1。 一类SVM


    1.1。 最小协方差行列式(MCD) (1.1. Minimum Covariance Determinant (MCD))

    Minimum Covariance Determinant (MCD) acts as the covariance estimator that is to be applied to Gaussian-distributed data. It basically searches for the subset of a specified number of data points whose covariance matrix contains the lowest determinant.

    最小协方差行列式(MCD) 用作将应用于高斯分布数据的协方差估计器。 它基本上搜索指定数量的数据点的子集,这些数据点的协方差矩阵包含最低的行列式。

    Because of the geometrical representation of the covariance matrix, the MCD algorithm tends to learn a rotationally symmetrical shape and works best with elliptically symmetric unimodal distributions. For this reason, it would be more performant to apply this algorithm while detecting outliers on the dataset which belongs to a unimodal distribution, so it is not advised to be used with multi-modal data. The more the size of the data and unimodality gets lower, the more the performance of the algorithm diminishes.

    由于协方差矩阵的几何表示,MCD算法倾向于学习旋转对称的形状,并且最适合椭圆对称的单峰分布。 因此,在检测属于单峰分布的数据集上的离群值时,应用该算法会更有性能,因此不建议与多数据一起使用。 数据的大小和单峰性越小,算法的性能下降的幅度就越大。

    For the formulation and the detailed parameter explanations, please kindly visit this article.

    有关配方和详细的参数说明,请访问 这篇文章

    Image for post
    Figure 5. Classical Covariance Matrix (red) vs MCD Matrix (blue). (Image by the author)图5.经典协方差矩阵(红色)与MCD矩阵(蓝色)。 (图片由作者提供)

    用于实现的Python库: (Python Library for Implementation:)

    算法: (Algorithm:)

    H: random subsample from X,
    [(I + J + 1) / 2 <= H <= I]

    By using XH, the column-wise row vector mean can be computed as µH
    For the covariance:: SH = (XH.T * XH) * (H -1)^(-1)The determinant of SH can be computed.
    The squared Mahalanobis Distance for each observation in X as
    mi = (xi - µH)*SH^(-1) * (xi - µH).TAfter the computations, XH can be assigned as the subset of H observations with the smallest Mahalanobis Distance.

    1.2。 主成分分析(PCA) (1.2. Principal Component Analysis (PCA))

    This statistical methodology builds up the essentials of multivariate data analysis that uses an orthogonal transformation to apply on a set of observations of probably correlated variables into a set of values of uncorrelated variables in a linear way. It serves a multivariate table as a smaller set of variables to be able to inspect trends, bounces, and outliers. This type of high-level analysis may expose the interconnection between observations and variables.

    这种统计方法建立了多元数据分析的基础 它使用正交变换以线性方式将一组可能的相关变量的观测值应用于一组不相关变量的值。 它将多变量表用作较小的变量集,以便能够检查趋势,反弹和离群值。 这种类型的高级分析可能会暴露观测值和变量之间的相互联系。

    As one of the statistical anomaly detection approaches, it can be applied to, for instance, mark fraudulent transactions by evaluating applicable features to define what establishes as normal observation and assigning distance metrics to detect possible cases that serve as outliers/anomalies. This kind of approach allows training a model using the present unbalanced dataset.

    作为统计异常检测方法之一,它可以通过评估适用的功能以定义确定为正常观察值的特征并分配距离度量以检测可能用作异常值/异常的情况,例如将其标记为欺诈性交易。 这种方法允许使用当前的不平衡数据集训练模型。

    Image for post
    Figure 6. 2D PCA plot of clusters. (Image by the author)图6.群集的2D PCA图。 (图片由作者提供)

    用于实现的Python库: (Python Library for Implementation:)


    X = N × m    # Sample Covariance Matrixfor each data point xi
    X = subtract mean x from each column vector xi in X
    Σ = (X*X).T
    return { λi, ui }i=(1..k)* Top-k vectors are more crucial eigenvectors


    2.1。 基于密度的噪声应用空间聚类(DBSCAN) (2.1. Density-Based Spatial Clustering of Applications with Noise (DBSCAN))

    The Density-Based Spatial Clustering of Applications with Noise (DBSCAN) aims to detect anomalous data points with the help of the density of its encircled space that is detached by regions of low-density observations.

    带有噪声的应用程序的基于密度的空间聚类(DBSCAN) 旨在借助低密度观测区域所分离的环绕空间密度来检测异常数据点。

    Major concepts of this methodology can be listed as density and connectivity which are calculated in terms of local distribution of their nearest neighbors.


    There exists two key parameters of the algorithm are:


    • distance threshold — epsilon (ɛ): The given radius of the neighborhoods around a data point

      距离阈值— epsilon(ɛ):数据点附近的给定半径

    • min_samples: The minimum number of data points in a neighborhood to create a cluster


    With the help of these parameters, the algorithm can be broken down in the following steps:


    • Detecting the points in the ε (eps neighborhood of every point and identify the core points with more than minimum points neighbors.

      每个点ε (eps邻域)中检测点,并标识与多个最小点相邻的核心点。

    • Find the connected components of inlier points on the neighbor graph, ignoring all non-core points.


    • Assign each non-inlier point to a nearby cluster if the cluster is an ε (eps neighbor, otherwise assign it to noise.


    A naive implementation of this requires storing the neighborhoods in step 1, thus requiring substantial memory. The original DBSCAN algorithm does not require this by performing these steps for one point at a time.

    幼稚的实现需要在步骤1中存储邻域,因此需要大量内存。 原始DBSCAN算法不需要一次只执行一次这些步骤。

    There are two parameters in the DBSCAN algorithm:


    1. ε (epsilon): A point p is a core point if it has neighbors within a given radius


    2. MinPts (minimum number of points): The least number of neighbors to form a cluster

      最小点数 (最小点数):形成簇的最少邻居数

    用于实现的Python库:(Python Library for Implementation:)

    算法 (Algorithm:)

    DBSCAN(Data, Epsilon, MinPts)
    Cluster_Label = 0
    for each unvisited observation Point in dataset Data
    assign Point as visited
    Neighbors = getNeighbors (Point, Epsilon)
    if sizeof(Neighbors) < MinPts
    assign Point as Outlier
    Cluster_Label = next cluster
    extendClusterSize(Point, Neighbors, Cluster_Label, Epsilon, MinPts)

    extendClusterSize(Point, Neighbors, Cluster_Label, Epsilon, MinPts)
    add Point to cluster Cluster_Label
    for each point Point' in Neighbors
    if Point' is not visited
    assign Point' as visited
    Neighbors' = getNeighbors(Point', Epsilon)
    if sizeof(Neighbors') >= MinPts
    Neighbors = Neighbors joined with Neighbors'
    if Point' is not yet member of any cluster
    add Point' to cluster Cluster_Label

    2.2。 识别聚类结构的排序点(OPTICS) (2.2. Ordering Points To Identify the Clustering Structure (OPTICS))

    Ordering points to identify the clustering structure (OPTICS) can be defined as an algorithm for outlying density-based groups in dimensional data.

    可以将识别聚类结构( OPTICS )的排序点定义为一种在尺寸数据中使基于密度的组离群的算法。

    It is an approach for detecting density-based clusters in spatial data. Its algorithm methodology is not only related to DBSCAN but also it labels one of DBSCAN algorithm’s crucial gap in identifying differing density-based useful clusters.

    它是一种用于检测空间数据中基于密度的聚类的方法。 它的算法方法不仅与DBSCAN有关,而且标记了DBSCAN算法在识别不同的基于密度的有用聚类中的关键差距之一。

    There are some key points in the descriptions of the parameters of DBSCAN, and OPTICS as core point, core distance, and reachability distance:


    • Core point: A point that resides at the center of the cluster can be accepted as a core point by providing minimally MinPts data points are located within its neighbors.


    • Core Distance: The minimum length of radius required to group provided observations as a core point.


    • Reachability Distance: This distance metric represents the shortest length that is defined with respect to the cluster’s central point to another data point which cannot be smaller than the core distance. In the below depiction, the reachability distance between (c, a) is assigned as x, since their distance is smaller than the core distance which is not acceptable.

      可达距离:此距离度量表示相对于群集中心点到另一个数据点的最短长度,该长度不能小于核心距离。 在下面的描述中, (c,a)之间的可到达距离被指定为x ,因为它们的距离小于不可接受的核心距离。

    Image for post
    Figure 7. Metrics depictions. (Image by the author)图7.指标描述。 (图片由作者提供)

    用于实现的Python库: (Python Library for Implementation:)

    算法: (Algorithm:)

    OPTICS(DB, Epsilon, MinPts)
    for each observation Point in dataset DB
    Point.reachabilityDistance = UNDEFINED
    for each unprocessed point Point of DB
    Neighbors = getNeighbors(Point, Epsilon)
    assign Point as visited
    output Point to the ordered list
    if coreDistance(Point, Epsilon, MinPts) != UNDEFINED then
    Queue = empty priority queue
    updateCluster(Neighbors, Point, Queue, Epsilon, MinPts)
    for each next Q in Queue
    Neighbors' = getNeighbors(Q, Epsilon)
    assign Q as visited
    output Q to the ordered list
    if coreDistance(Q, Epsilon, MinPts) != UNDEFINED do
    updateCluster(Neighbors', Q, Queue, Epsilon, MinPts)updateCluster(N, Point, Queue, Epsilon, MinPts) is
    coreDist = coreDistance(Point, Epsilon, MinPts)
    for each Observation in N
    if Observation is not visited then
    newReachabilityDistance = max(coreDist, dist(Point, Observation))
    if Observation.reachabilityDistance == UNDEFINED then
    Observation.reachabilityDistance = newReachabilityDistance
    Queue.insert(Observation, newReachabilityDistance)
    if newReachabilityDistance < Observation.reachabilityDistance then
    Observation.reachabilityDistance = newReachabilityDistance
    Queue.moveObservation(Observation, newReachabilityDistance)


    3.1。 局部离群因子(LOF) (3.1. Local Outlier Factor (LOF))

    The Local Outlier Factor can be described as the calculation that scans through the neighbors of a certain point to discover its density and examine this to the density of other points to measure the distance between them.


    It calculates a score matching the degree of irregularity of the observations and measures the local density differentiation of a specified data point comparing to its neighbors. The logic is to identify the samples that have a considerably minor density than their surrounded-points.

    它计算与观察结果的不规则程度相匹配的分数,并测量指定数据点与其相邻点的局部密度差异。 逻辑是识别密度比其包围点小得多的样本。

    Image for post
    Figure 8. Point P has a higher LOF score since its density is lower than its surrounded densities. (Image by the author)
    图8.点P的LOF得分较高,因为其密度低于其周围的密度。 (作者提供的图片)

    Inlier points are local in the local outlier factor score builds upon how detached a single data node is regarding the encircling region. More accurately, the condition of being local is assigned by k-nearest neighbors, whose gap between points is used to calculate the local density.

    内在点在本地离群因素评分中是本地的,这取决于单个数据节点与周围区域的分离程度。 更准确地说,存在局部的条件由k个最近的邻居分配,其点之间的间隙用于计算局部密度。

    By contrasting the inner density of a point to the local densities of its neighbors, one can specify samples which allocates a distinctively lower density than their neighbors can be called as outliers.


    Image for post
    Figure 9. LOF score visualization. (Image by the author)图9. LOF分数可视化。 (图片由作者提供)

    用于实现的Python库: (Python Library for Implementation:)

    算法: (Algorithm:)

    LOF = null
    for each observation Point in DB
    KNNeighbors = kDistance(Distance, K)
    LocalReacbilityDistance = reachDistanceK(KNNeighbors, K)
    for each Point in KNNeighbors
    tempLOF[i] = sum((LocalReacbilityDistance[Obs ∈ N (Point)]) / LocalReacbilityDistance[i]) / |N(Point)|
    LOF = max(LOF, tempLOF)
    return top(LOF)

    3.2。 具有局部异常因素的新颖性检测 (3.2. Novelty Detection with Local Outlier Factor)

    Novelty detection can be accepted as the description of a novel (new) or undiscovered patterns in the data. The novelties revealed are not considered as anomalous data points; instead, they are been practiced to the data model.

    新颖性检测 可以接受作为对数据中新颖(新)或未发现模式的描述。 所揭示的新颖性不被视为异常数据点; 而是将它们实践到数据模型中。

    The complicatedness of present highly integrated systems is similar to a restricted comprehension of the connections between the different system components that can be collected. An unavoidable effect of this situation is the presence of an enormous number of potential unusual forms, some of which may not be established as rational which causes regular multi-class classification schemes improper for these operations. A possible resolution to this issue is proposed by the algorithm of novelty detection, in which a definition of being an inlier is trained by creating a model with various examples depicting positive states. Formerly undiscovered patterns are then tested by contrasting them with the model of accepted-inliers, usually proceeded in some mode of novelty score. A novelty score may be generated for these formerly unseen data points with the help of a decision threshold score. The points which substantially diverge from this decision threshold may be treated as outliers.

    当前高度集成的系统的复杂性类似于对可收集的不同系统组件之间的连接的有限理解。 这种情况的不可避免的后果是存在大量潜在的异常形式,其中某些形式可能无法确定为合理形式,从而导致常规的多类分类方案不适用于这些操作。 通过新颖性检测算法提出了解决此问题的可能方法,其中通过创建一个模型来训练一个内部人的定义,该模型带有各种描述正状态的示例。 然后,通过将先前未发现的模式与可接受的内部模式进行对比来测试这些模式,通常以某种新颖性评分模式进行处理。 借助于决策阈值分数,可以为这些以前看不见的数据点生成新奇分数。 实质上偏离该决策阈值的点可被视为离群值。

    In other words, novelty detection can be described as the process of acknowledging that test data deviates in some way from the training data. Its practical influence and challenging essence have guided many suggestions for being proposed. These approaches are mostly applied to datasets in which a huge number of cases of the inlier or positive state is available and where there are scarce data to define outlier or negative state.

    换句话说,新颖性检测 可以描述为确认测试数据以某种方式偏离训练数据的过程。 它的实际影响力和挑战性本质引导了许多建议被提出。 这些方法大多应用于数据集,其中所述巨大或内点正状态的病例数可用,并且其中存在稀少数据来定义异常值或负状态。

    Image for post
    Figure 10. One-class (left) and multi-class (right) novelty detection. (Image by the author)图10.一类(左)和多类(右)新颖性检测。 (图片由作者提供)

    用于实现的Python库: (Python Library for Implementation:)

    3.3。 马氏距离 (3.3. Mahalanobis Distance)

    For the given data source that holds standard normal distribution, the corresponding mean shall be zero while variance shall be observed as 1.


    The standard normal distribution has differentiative specifications from the normal distribution that can be expressed by means of the normal distribution having two distinct parameters as μ=0 and σ=1 with a representation of N(μ,σ) → N(0,1).

    标准正态分布具有从分化规格正态分布可以由来表示正态分布 具有两个不同的参数,分别为μ= 0σ= 1 ,表示为N(μ,σ)→N(0,1)

    Image for post
    Figure 11. Normal Distribution (left) vs Standard Normal Distribution (right). (Image by the author)图11.正态分布(左)与标准正态分布(右)。 (图片由作者提供)

    Mahalanobis Distance is one of the outlier detection approaches which provides a simple means of detecting outliers in multidimensional data where the distance is between a point and a distribution and not between two distinct points.


    Image for post
    Figure 12. A point and a distribution. (Image by author)图12.点和分布。 (作者提供的图片)

    用于实现的Python库: (Python Library for Implementation:)

    算法: (Algorithm:)

    First Version:

    Mahalanobis = [(Y – X)T * SampCov -1 * (Y – X)] ^ 0.5- X, Y : Pair of observations
    - SampCov : Sample covariance matrix
    Alternative Version:

    Distance_n = [((xn – x̄)^t)*(C)^(-1) * (xn – x̄)] ^ 0.5

    - xn = an observation vector
    - x̄ = arithmetic mean vector


    4.1。 隔离林 (4.1. Isolation Forest)

    Isolation Forest also called iForest recognizes abnormal activities as opposed to profiling typical data points. Isolation Forest, similar to any tree ensemble methodology, is based on decision trees. Among these trees, partitions are generated by first arbitrarily choosing a component and afterward choosing a randomly selected value in the scope of min and max of in a specified feature set. The algorithm is based on the idea that outliers represent data points that are few and different.

    隔离林 也称为iForest,它可以识别异常活动,而不是分析典型数据点。 类似于任何树集成方法,隔离林都基于决策树。 在这些树中,首先通过任意选择一个组件,然后在指定特征集中的min和max of范围内随机选择一个值来生成分区。 该算法基于离群值表示很少且不同的数据点的思想。

    There exist two variables in this algorithm. One is the number of trees to be built and the size of sub-sampling which enables the following subjects:

    该算法中存在两个变量。 其中之一是要建造的树木数量子采样的大小,可实现以下主题:

    (i) to accomplish a low time-complexity with a reduced memory necessity (ii) to carry out the impacts of swamping, labeling nonoutlier as an outlier, and masking, an unidentified outlier


    With the help of these parameters, the isolation forest method does not take into consideration the distance and density metrics to catch anomalous behavior. This approach adds an advantage to iForest over distance-centered or density-centered methodologies since it excludes an extensive load of distance measurement.

    在这些参数的帮助下,隔离林方法不考虑距离和密度度量来捕获异常行为。 与以距离为中心密度为中心的方法相比,此方法为iForest添加了一个优势,因为它排除了大量的距离测量负担。

    Isolation forest works very efficiently in case of having a narrow-sized data set to profile outliers.


    Below, the left-hand side graph shows the formed tree after the algorithm is executed. The blue line represents the normal data points while the red line can be accepted as the tree with anomalous data points. On the second graph, a schematic example of a tree and a plotted forest is shown with red-colored lines out abnormal data point existence while blue ones are normal ones.

    下面,左侧图显示了执行算法后形成的树。 蓝线代表正常数据点,而红线可以被接受为具有异常数据点的树。 在第二张图上,以红色线条表示一棵树和一个绘制的森林的示意图,其中红色线条表示存在异常数据点,而蓝色线条表示正常数据点。

    Image for post
    Figure 13. Isolation Forest visualization with outlier and inlier points. (Image by the author)图13.带有离群点和离群点的Isolation Forest可视化。 (图片由作者提供)

    4.2。 公式: (4.2. Formulation:)

    Step 1: Sampling for training a model Step 2: Random selection of a value that is between minimum and maximum of chosen data pointsStep 3: Repeating of step 2 of binary splitting to continue create a forestStep 4: Continuous feed of data resource to calculate anomaly score for every generated tree and their corresponding average path lengths


    At the end of the average path sizes, an outlier is expected to have a shorter path length compared to an inlier.


    Image for post
    Figure 14. Average steps to generate an isolation forest by detecting inliers and outliers. (Image by the author)图14.通过检测离群值和离群值来生成隔离林的平均步骤。 (图片由作者提供)

    用于实现的Python库: (Python Library for Implementation:)

    算法: (Algorithm:)

    t = null (the empty tree)if numberOfRow(Leaf) == 1 then return t
    Randomly select li a feature of Leaf
    Randomly select a split observation O ∈ (min(li), max(li))
    Add to t the node N li,Point
    Assign Leaf_l and Leaf_R as the matrix
    Repeat the looping with Leaf = Leaf_l
    Add the obtained tree as the left child of main tree t
    Repeat the looping with Leaf = Leaf_r
    Add the obtained tree as the right child of main tree t


    5.1。 一类SVM (5.1. One-Class SVM)

    The One-Class SVM can be accepted as sensitive to anomalous points which leads to poor performance outlier detection by using the training data with outliers. This predictor is correctly matched for novelty detection when the training set is not surrounded by outlier data points which aim to detect new observation as an outlier instead of detecting the noisy data in the existing data.

    可以将一类SVM对异常点敏感,这可以通过将训练数据与离群值结合使用,从而导致较差的离群值检测。 当训练集没有被异常数据点包围时,该预测变量正确匹配以进行新颖性检测,该异常数据点旨在将新的观测值检测为异常值,而不是检测现有数据中的嘈杂数据。

    A One-Class SVM might give beneficial results in multi-dimensional situations depending on the value of its hyperparameters. The aim of this algorithm to detach data points from the origin to maximize the distance between the subspace dimension to the origin.

    一类SVM根据其超参数的值在多维情况下可能会产生有益的结果。 该算法的目的是将数据点与原点分离,以使子空间维度到原点之间的距离最大。

    This situation proceeds in a result set of binary outputs which grab areas in the input space in which the probability density of the data locates.


    In this way, the function returns +1 for inliers in a limited region which contains the space by occupying training observations and −1 for outliers.

    通过这种方式,该函数通过占用训练观测值,对于包含空间的有限区域中的孤立点返回+1 ,而对于孤立点则返回-1

    Image for post
    Figure 15. Outlier SVM Classifier with (1) for inliers, (-1) for outliers. (Image by the author)图15.离群值SVM分类器,其中(1)代表离群值,(-1)代表离群值。 (图片由作者提供)

    用于实现的Python库: (Python Library for Implementation:)

    算法: (Algorithm:)

    X = {x1, x2....xm, z}, X ∈ R^d                # Observation VectorK(φ(xi), φ(xj ))                              # Feature Mapping
    ρ = sum(k=1 to Ns) k=1 α(k) K(Φ(x̄)Φ(xk̄)) # Bias calculation
    f(z̄) = sum(k=1 to Ns) k=1 α(k) K(Φ(xk̄)Φ(z̄))# Score Calculation

    if f(z̄) > ρ then
    return 1
    return 0
    end if

    Questions and comments are highly appreciated!


    翻译自: https://towardsdatascience.com/outlier-or-inlier-types-of-algorithms-to-detect-anomalous-behavior-ac15576823da


  • 基于泊松方程的异常行为检测
  • MATLAB异常行为检测.zip

    2021-04-07 16:01:03
    MATLAB异常行为检测,该课题运用群体整体异常行为建模是群体整体表现出异常行为, 识别过程中不关注个体行为。整体分析方法把人群作为一个实体来估计速度、方向和运动异常, 涵盖中高密度人群场景.整体分析方法是对整个...
  • 行人异常行为检测

    千次阅读 2020-03-09 02:01:22






    群殴、踩踏, 游 行、骚乱、聚集、奔跑、恐慌逃散、人群中异常事件(如 步行街上的骑车、轮滑、轿车、急停急跑、检票口的 逆行、逃票和徘徊等)等等




    群密度或人数是异常人群的一个重要特征, 不少人群异常检测算法都依赖人群密度进行检测。
    通常表现在人群的运动异常, 如人群混乱等, 人群运动特征的提取就可以表示人群异 常. 运动模式特征通常分为运动速度和运动方向两类,

























    像素级特征提取方法:基于像素的特征通常通过边缘检测和背景/前景 减法获取, 且通常只关注底层的密度估计信息.



    基于对象特征提取:通过确认场景中的 对象个体, 从而可以获取更加准确的结果




    群体中局部异常行为识别是针对人群中单个或者几个个体表现出的非从众 行为, 这些行为的识别需要关注个体行为, 而不需要 关注群体的环境.
    基于个体对象的方法, 以个人的集合来处理分析估计其速度、方向和运动异常. 以个人对象进行行为 的识别, 可以准确定位出场景中异常发生位置及异常 类型, 是目前研究的热点. 然而, 当遮挡存在时, 会影 响对象检测、跟踪, 从而增加识别的复杂程度.
    基于局部的方法可以定位场景中的典型活动和互 动, 检测正常和异常, 并支持活动和交互的高层语义 查询. 然而, 这些方法不能处理密集拥挤的场面, 因 单个个体无法检测, 且人群的动力学是混乱的. 在这 种情况下, 低层次视觉特征的空间分布也是混乱的, 随后的聚类程序也将无法正常工作


    群体整体异常行为建模是群体整体表现出异常行为, 识别过程中不关注个体行为。
    整体分析方法把人群作为一个实体来估计速度、方向和运动异常, 涵盖中高密度人群场景.
    整体分析方法是对整个人流分类为正常、异常或预定义行为, 是把人群作为一个单一的实体, 适合分 析中高密度人群的结构化场景, 以及高密度人群中行 为特征很少或者小到无法提取的场景. 这种方法会忽 略个体差异, 并认为人群中所有个体都有类似的运动 特性, 从而从系统角度分析人群行为. 但是, 由于没 有对象检测和跟踪的信息, 同时发生的人群其他活动 无法区分开, 且非结构化场景的局部行为也无法处理.


    (1) 算法鲁棒性问题. 由于人群行为发生的场景通常较为复杂, 切伴随着场景变化(光照、遮挡、距离等), 目前算法识别的稳定性需要进一步提高.
    (2) 智能化问题. 目前的人群行为识别, 通常针对单一行为分析其行为识别特征, 从而也只能识别单一异常行为, 无法对异常进行统一建模识别.
    (3) 目前基于机器学习是人群行为识别的主流方 法, 该方法需要大量训练样本, 且由于群行为的发生通常是多样式的, 很难有统一的学习模型.

    (1) 多传感器融合下的行为识别. 单一传感器获取的信息量是有限的, 通常存在遮挡、信息缺失等问题, 通过融合多个监控信息, 就可以全面提取人群行为. 同时, 语言包含了更多的人类情感信息, 视频结合语音的人群行为识别技术, 将是未来的研究方向之一.
    (2) 人群的高层次行为建模是具有挑战性的研究方向. 人群是一个复杂的群体, 人群行为不能单纯通过视频特征进行描述, 需要更深层的理解人的个体行为、个体与个体之间的行为影响、人与环境之间的相互关系等, 从而建立人群行为的语义知识模型, 从根本上理解是否真的人群中有异常事件存在.
    (3) 实时处理和泛化. 随着高清及智能监控网络的发展需要, 更大更多的数据需要及时处理, 并对其 中问题进行及时告警.
    (4) 大数据下行为识别技术. 大数据是未来的发展趋势, 如何利用大数据对人群行为进行建模识别, 摆脱单一视频识别技术的依赖, 从而更加系统地对人 群行为进行定义及预测预警, 是一个开拓性的研究方 向.







  • 针对监控视频中人体异常行为的复杂多样难检测问题,提出了基于YOLO网络模型的异常行为检测方法。根据对监控场景的异常行为定义需求,将标定的异常行为通过YOLO网络模型进行训练,不进行人体目标的提取而将其放到神经...
  • 比较成熟的若干网络异常行为检测技术后,发现目前网络异常行为检测的技术还有些方面 考虑比较片面,检测的焦点集中于用户行为,没有全面地分析所有网络行为模式。而且, 用户易受周围环境的影响,行为具有不稳定性,...
  • 针对Tiny YOLOv3算法在扶梯异常行为检测时存在高漏检率和低准确率的问题,提出一种改进的Tiny YOLOv3网络结构用于扶梯异常行为检测。利用K-means++算法对数据集中的目标边框进行聚类,根据聚类结果优化网络的先验框...
  • 基于角点动能的视频群体异常行为检测
  • 面向IaaS云平台的用户异常行为检测方法
  • 为此,介绍了网络异常行为检测方法的现状;分析了基于统计学习的检测方法的技术路线和体系架构,并以命令控制通道、获取行为等APT攻击中的典型环节为例,介绍了相关的参数提取和统计分析建模方法;总结了基于大数据...
  • 视频异常行为检测网络

    千次阅读 2020-05-26 22:06:02
    方法一:基于YOLO的二分类异常行为检测 此方法其实就是强行把异常行为进行二分,此方法只可以应用于特殊场景: -- 比如在实验室,穿了实验服就是正常,没穿就是异常 -- 或者在流水线,戴头盔就是正常,没带就是...




    -- 比如在实验室,穿了实验服就是正常,没穿就是异常
    -- 或者在流水线,戴头盔就是正常,没带就是异常
    -- 这种方法的目的就是为了方便进行数据标注


    但此方法检测场景有限,对于更通用的场景,如果要进行异常行为检测, 一个很大的难点是异常行为数据过少,比如要进行ATM机监控视频的异常行为检测,但并不是很常有抢劫、偷盗等情况发生。
    由此,我们可以设计一个 编码器-解码器对抗网络+双流网络来构建异常行为检测模型。


    -- 图片,就是一个多维矩阵,所谓重构图片,就是基于已有特征,重构一个多维矩阵
    -- 编码器的作用在于从高纬度总结特征
    -- 解码器作为在于把总结的高纬度特征解码为低纬度矩阵
    -- 最终通过解码器的上采样,完成维度降低和规模增大(上采样与池化相对)
    -- 编码器-解码器网络的学习过程,同样最重要的在于构建损失,此处的损失可以是重构图像与输入图像的向量差

    -- 一个网络进行像素检测,利用像素检测抽取空间特征
    -- 另外一个网络进行姿态检测,利用姿态检测缩小检测范围,锁定人的行为特征
    -- 最终将这两部分,加权为编码器网络的输出

    -- 利用这个规律,可以在异常行为数据很少的情况下,通过对抗网络重构图像完成模型的训练
    -- 此方法不用进行异常行为的标注,全部是正常行为的视频既可以完成训练





    -- 可以看出,网络并不能很好地重构包含异常行为的帧。 其差异较大。通过对比其特征向量的差异,则能检测出是否存在异常行为。


    [1] 基于 YOLO 网络模型的异常行为检测方法研究 刘雪奇 ,孙胜利

    [2] 利用姿态信息实现异常行为检测 郑爽,张轶

  • 在基于轨迹分析的异常行为检测方法中,被标记为异常的轨迹往往仅在整条轨迹的某个局部存在异常,轨迹的其余部分都是正常行为.然而,传统的基于整条轨迹建模的方法很难检测轨迹的局部异常.针对上述问题,提出一种在多示例...
  • 基于轨迹的异常行为检测,用于智能交通监控
  • 基于三支决策粗糙集的视频异常行为检测
  • 使用系统调用序列的分布式应用程序异常行为检测方法
  • 基于轨迹梯度(EI)的人群异常行为检测技术研究
  • 异常行为检测论文学习综述

    万次阅读 2017-10-19 10:17:29
    近来找了几篇异常行为检测的论文,先大概浏览了一下摘要,记录主要内容,以便后续查看。1、Abnormal behavior detection using hybrid agents in crowded scenesKeywords: Visual surveillance Abnormal behavior ...


    1、Abnormal behavior detection using hybrid agents in crowded scenes

    Visual surveillance
    Abnormal behavior detection
    Event detection
    Behavior recognition



    2、Activity Recognition and Abnormal Behaviour Detection with Recurrent Neural Networks

    Smart Homes
    Sensor based Activity Recognition
    Recurrent Neural Networks
    Abnormal Behaviour Detection

    在这篇文章中,作者研究了关于痴呆症的老年人的动作识别和异常行为检测的问题。几乎很少的研究试图处理这个问题,因为缺少痴呆病症的实验数据。特别的,这篇论文验证了RNN的三个变体: Vanilla RNNs (VRNN),Long Short Term RNNs (LSTM) and Gated Recurrent Unit RNNs (GRU)。本文中,活动识别被认为是一个序列标签问题,而异常行为是基于与正常模式脱离标记的。在本文中,为了对RNN性能的讨论提供一个适当的讨论,作者将它们与最先进水平的方法进行了比较,如Support Vector Machines (SVMs),Na¨ıve Bayes (NB),Hidden Markov Models (HMMs),Hidden Semi-Markov Models (HSMM) 和Conditional Random Fields (CRFs)。获得的结果表明,RNN与这些先进水平的方法相比是有竞争力的。更进一步,由于在真实世界,难以获得痴呆症病人的行为数据,本文提出一个生成合成数据的方法。


    3、Modeling Representation of Videos for Anomaly Detection using DeepLearning: A Review



    4、Predicting Human Behavior from Public Cameras with Convolutional Neural Networks



    5、Soft + Hardwired Attention_ An LSTM Framework for Human Trajectory Prediction and Abnormal Event Detection

    human trajectory prediction
    social navigation
    deep feature learning
    attention models



    6、Adaptive weighted imbalance learning with application to abnormal activity recognition

    Imbalance learning

    异常行为识别在医疗健康和其他相关领域已经引起了很大的关注,特别是对老年人的身心健康,坠落事故的高风险,它导致的疾病已经引起越来越多的关注。目前,本文开发的基于坠落检测技术的设备可以有效实时地监控坠落事件的发生,并帮助受伤人员接受急救。然而,对于坠落检测和监控,传统方法的内置分类器尽管可以达到一个相对高的检测正确率,但是其误报率过高,进一步地,由于异常行为的传感器数据在真实应用中很稀少,这种方法必须面对这种不平衡问题。为了处理这个难题,作者提出了一种对于眼睛、手表等可穿戴物品的two-stage adaptive weighted extreme learning machine(AWELM)的方法来检测和监控坠落。实验结果验证并证实了这个方法的高效性,并且展示出,首先,这种方法,通过两阶段识别计划,实现了高检测准确度和误检率之间的平衡;其次,通过两阶段自适应权重方法,使得对于稀少的异常行为数据的不平衡学习方法变得有效;第三,使用极值学习机,提出一种轻型的分类方法,处理可穿戴设备的资源限制,来加速训练和更好的泛化,这使得大范围的健康应用成为可能,特别是最终帮助老年人减少坠落事件的风险。


    7、A Depth Camera-based Human Activity Recognition via Deep Learning Recurrent Neural Network for Health and Social Care Services

    Human Activity Recognition
    Depth Imaging Sensor
    Deep Learning
    Recurrent Neural Network,
    Health Care

    由于技术所提供的对于病人或者居民的自动监控和行为理解,人类活动识别(HAR)在健康和社会保健领域已经是一个相对活跃的研究课题。基于HAR的深度摄像机,使用从人类深度轮廓,通过传统的分类器,比如Hidden Markov Model (HMM),Conditional Random Fields等抽取的特征,识别人类活动。在这篇文章中,作者提出一种新的,使用了循环神经网络(RNN,深度学习算法的一种)的HAR系统。作者利用多个随时间变化的身体关节的关节角度,这些关节角度表示时空特征矩阵(即时间上的多个身体关节角度)。有了这些导出的特征,作者训练并测试了关于HAR的RNN模型。为了验证这个系统,作者将这个RNN模型与传统的HMM、深度信度网络(DBN)在Microsoft Research Cambridge-12(MSRC-12)数据集上进行了比较。测试结果显示,作者提出的RNN模型能够可靠地识别12中人类活动,并且比HMM和DBN的性能要好。平均识别性能达到了99.55%,比HMM多7.06%。比DBN多2.01%的准确度。


    8、Human Behavior Prediction for Smart Homes Using Deep Learning


  • Generate training sample images of TSN algorithm \ TSN异常行为检测训练样本生成C 代码
  • 对公共场所中人群监控准确性和实时性低的问题,提出一种基于运动显著图的人群异常行为检测方法。该方法首先利用Lucas-Kanade法计算稀疏特征点的光流场,并对光流场进行时间和空间上的滤波处理,然后计算特征点的运动...
  • 今天看到了Yi Zhu 朱毅 大佬的文章,是关于视频中异常行为检测。感觉是对cvpr18年那篇文章做了特征和MIL的提升。[请移步两位大佬 林天威学长和Kiwi之前写过的文章回顾一下]:林天威:[CVPR 2018论文笔记] 真实监控...
  • 针对公共场合人群异常行为检测准确率不高和训练样本缺乏的问题,提出一种基于深度时空卷积神经网络 的人群异常行为检测和定位的方法。首先针对监控视频中人群行为的特点,综合利用静态图像的空间特征和前后帧 的时间...
  • 针对公共重点区域的智能监视问题,研究了一种基于运动历史图像(motion history image,MHI)的行人异常行为检测方法。利用运动图像序列得到的MHI获取视频帧中运动目标的运动方向,由运动方向的变化分类确定人体运动...
  • 人群异常行为检测数据集汇总

    千次阅读 2019-02-11 21:40:00
    人群异常行为检测数据集汇总   Dataset size description UCSD Anomaly Detection Dataset 98 video clips The UCSD anomaly detection annotated dataset was acquired with a stationary camera ...
  • 这篇文章比较特殊,因为它打破了以往异常行为检测默认的无监督套路,对异常行为进行了人为定义,即规定了几个需要检测的异常行为,而且都是在日常生活中比较常见的,并给出了一个他们自己构建的真实监控场景下的异常...
  • 本系统为人体异常行为检测系统 本文件夹下共包含12个文件 其中matlab代码文件9个,视频源文件夹1个(内含4个视频),指导视频一个,说明文档一个 其中仅需要打开Main_Test.fig文件,点击运行即可使用
  • 基于Web资源聚类分析的异常行为检测,谢逸,余顺争,本文针对大型活动网站的入侵检测,提出一种基于隐半马尔可夫模型(HSMM)的Web资源聚类方法,与传统的基于Web页面内容的聚类不同,该方
  • 基于应用描述的Android应用异常行为检测研究,王然,王浩宇,移动应用是否恶意,与用户对该应用的应用的期望相关。然而,Android应用的一个特点是广泛使用第三方库,第三方库的使用会对应用异常�



1 2 3 4 5 ... 20
收藏数 1,131
精华内容 452