Learning and Adapting to Spatio-Temporal Anomalies

异常检测对于从医疗保健和环境保护到国土安全和制造业等领域的广泛安全、监视和监控问题至关重要。然而，由于系统和数据的日益复杂，以及对手的日益复杂，传统的异常检测方法已经不再足够。这些方法假设异常看起来与正常测量有很大的不同，或者它们的特征随着时间的推移保持不变。然而，在许多令人感兴趣的实际应用中，异常只能通过细微的时空特征来区分。例如，网络安全事件可能涉及一系列流量模式，其中每个模式本身都是无害的，但当一起查看时，它们占据了局部或较低维度的空间域。或者，异常可能表现出由缓慢但稳定的从正常行为到异常行为的漂移引起的时间结构。这个项目开发了新的理论和算法方法来检测这种时空异常。这项研究将影响对包括环境系统、医疗保健网络、电网和通信网络在内的广泛关键基础设施和应用领域的监测。该项目重点关注时空异常，这些时空异常(1)与名义分布有显著的空间重叠，(2)分布在比名义测量更低的维度上，(3)具有时变分布特征。该研究将统计机器学习技术应用和扩展到异常检测环境中，包括转导、流形自适应和在线学习。这一框架使研究人员能够解决一些困难和长期存在的挑战，如漂移异常分布的最优跟踪和基于组合图的推理算法的有效放松。

Anomaly detection is essential for a broad range of security, surveillance, and monitoring problems in areas ranging from health care and environmental protection to homeland security and manufacturing. However, because of the increasing complexity of systems and data, as well as the increasing sophistication of adversaries, traditional methods of anomaly detection are no longer sufficient. These methods assume that anomalies look substantially different from normal measurements, or that their characteristics remain constant over time. In many practical applications of interest, however, anomalies are only distinguished by subtle spatio-temporal characteristics. For example, a network security event may involve a sequence of traffic patterns, each of which is innocuous in its own right, but which occupy a localized or lower-dimensional spatial domain when viewed together. Alternatively, anomalies may exhibit temporal structure caused by a slow but steady drift from normal to abnormal behavior. This project develops new theoretical and algorithmic approaches to detecting such spatio-temporal anomalies. The research will impact the monitoring of a wide range of critical infrastructures and application domains, including environmental systems, health care networks, power grids, and communication networks.The project focuses on spatio-temporal anomalies that (1) have significant spatial overlap with the nominal distribution, (2) are distributed on a manifold of lower dimension than nominal measurements, and (3) have time-varying distributional characteristics. The research applies and extends techniques from statistical machine learning, including transductive, manifold-adaptive, and online learning, to the anomaly detection setting. This framework allows the investigators to address several difficult and long-standing challenges such as optimal tracking of drifting anomaly distributions and efficient relaxations of combinatorial graph-based inference algorithms.