Low Latency Anomaly Detections with Imperfect Data Models

异常检测具有广泛的应用，例如关键基础设施的故障检测、网络物理系统的入侵检测以及金融服务的欺诈检测。检测延迟是指异常事件发生与检测之间的时间差，它对许多实际应用至关重要。更长的检测延迟可能导致灾难性的结果，例如桥梁倒塌或数百万人断电。通过更短的检测延迟，可以及时采取补救措施或对策，以显著减少故障、攻击、事故或灾难造成的损害。该项目将开发一种新的低延迟异常检测方法，可以最大限度地减少检测延迟，同时保持令人满意的检测精度。这与大多数当前的异常检测技术不同，当前的异常检测技术仅关注检测精度，很少或根本不关注检测延迟。所提出的低延迟异常检测方法可以应用于广泛的民用、工业、科学和军事应用，例如发电厂、通信网络、监视、结构健康监测和金融交易。拟议研究工作的成果可以显着减少对异常事件的响应时间，从而最大限度地减少网络攻击，系统故障，欺诈活动或自然灾害造成的损害和经济损失。通过该项目开发的技术可以提高物理和网络空间的安全性，并促进美国的竞争力和经济发展。本项目将利用研究工作中获得的专业知识，促进新教材和学生研究项目的开发，并从技术创新和社会影响的角度提升学生的学习体验。本项目的目标是开发不完善数据模型的低延迟异常检测方法。设计目标是在保持满意的检测精度的同时最小化检测延迟。低延迟异常检测面临的最严峻挑战之一是对检测期间使用的数据进行准确建模。由于需要以最小延迟做出决策，因此可以用于模型训练或模型选择的数据量非常有限，特别是对于由异常事件生成的数据。鉴于获得精确数据模型的难度，该项目旨在积极开发专门针对不完美数据模型的新检测方法。拟议的研究活动将从以下角度改变异常检测的研究。首先，使用检测延迟而不是检测准确度作为主要设计度量可以显著减少检测异常事件所需的时间量，同时通过附加的设计约束仍然保持令人满意的检测准确度。其次，低延迟检测算法是专门为具有不完美数据模型的系统设计的。模型的不确定性对检测延迟的基本性能限制的分析特征在于使用真实和不完美的模型之间的Kullback-Leibler分歧。分析结果用于指导参数和非参数低延迟算法的设计，为最坏情况下的延迟提供了理论保证。第三，新开发的理论和算法将应用于电机的故障检测和智能电网的入侵检测，其中设计是通过考虑这些网络物理系统的独特挑战和机遇来执行的。

Anomaly detection has a wide range of applications, such as fault detection for critical infrastructure, intrusion detection for cyber-physical systems, and fraud detection for financial services. Detection delay, which is defined as the time difference between the occurrence and detection of an anomaly event, is critical for many practical applications. A longer detection delay might lead to catastrophic results, such as the collapse of a bridge or the loss of power to millions of people. With a shorter detection delay, remedial actions or countermeasures can be carried out in a timely manner to significantly reduce the damages caused by faults, attacks, accidents, or disasters. This project will develop a new paradigm of low-latency anomaly detection methods that can minimize the detection delay while maintaining satisfactory detection accuracy. This is different from most current anomaly detection techniques, which focus solely on detection accuracy with little or no attention given to detection delays. The proposed low-latency anomaly detection methods can be applied to a wide range of civil, industrial, scientific, and military applications, such as power plants, communication networks, surveillance, structure health monitoring, and financial transactions. Outcomes of the proposed research work can significantly reduce the response time to anomaly events, thus minimizing the damages and economic losses caused by cyber-attacks, system failures, fraudulent activities, or natural disasters. Technologies developed through this project can improve the safety and security in both the physical and cyber-space, and promote the competitiveness and economic development of the United States. Expertise gained through the proposed research work will be used to facilitate the development of new course materials and student research projects, and enhance students' learning experiences from the perspectives of both technology innovations and social impacts.The goal of this project is to develop low-latency anomaly detection methods with imperfect data models. The design objective is to minimize the detection delay while maintaining satisfactory detection accuracy. One of the most formidable challenges faced by low-latency anomaly detection is the accurate modeling of the data used during detection. Since a decision needs to be made with minimum delay, there is extremely limited amount of data that can be used for model training or model selection, especially for data generated by the anomaly events. In recognition of the paramount difficulty in obtaining the precise data models, this project aims to proactively develop new detection methods tailored specifically for imperfect data models. The proposed research activities will transform the research on anomaly detection from the following perspectives. First, using detection delay instead of detection accuracy as the primary design metric can significantly reduce the amount of time required to detect an anomaly event, while still maintaining satisfactory detection accuracy through additional design constraints. Second, the low-latency detection algorithms are designed specifically for systems with imperfect data models. The fundamental performance limits imposed by model uncertainty on the detection latency are analytically characterized by using the Kullback-Leibler divergence between the true and imperfect models. The analytical results are used to guide the design of parametric and non-parametric low-latency algorithms, which can provide a theoretical guarantee on the worst case delay. Third, the newly developed theories and algorithms will be applied to the fault detection of electrical machines and the intrusion detection for smart grids, where the designs are performed by considering the unique challenges and opportunities of these cyber-physical systems.