Multivariate time series anomaly detection (MTSAD) remains challenging due to the complexity of spatiotemporal dependencies, non-stationary dynamics, and heterogeneous variable interactions. Existing methods often struggle to simultaneously model correlations within and across different time series components, limiting their ability to capture hierarchical patterns at multiple scales. To address these issues, we propose HCAAD (Hierarchical Component-Aware multivariate time series Anomaly Detection), an unsupervised framework that combines frequency-adaptive multiscale decomposition with cross-component correlation modeling. First, we use a Fast Fourier Transform (FFT)-based decomposition to split the time series into multiple components. This step isolates long-term trends, seasonal cycles, and transient fluctuations. Second, we design a dynamic correlation matrix to explicitly model intra-and inter-component dependencies. An attention mechanism further refines these correlations by adaptively integrating global spatiotemporal patterns. Experiments on six benchmark datasets show that HCAAD consistently achieves state-of-the-art performance.

In unsupervised graph anomaly detection, existing methods usually focus on detecting outliers by learning local context information of nodes, while often ignoring the importance of global context. However, global context information can provide more comprehensive relationship information between nodes in the network. By considering the structure of the entire network, detection methods are able to identify potential dependencies and interaction patterns between nodes, which is crucial for anomaly detection. Therefore, we propose an innovative graph anomaly detection framework, termed CoCo (Context Correlation Discrepancy Analysis), which detects anomalies by meticulously evaluating variances in correlations. Specifically, CoCo leverages the strengths of Transformers in sequence processing to effectively capture both global and local contextual features of nodes by aggregating neighbor features at various hops. Subsequently, a correlation analysis module is employed to maximize the correlation between local and global contexts of each normal node. Unseen anomalies are ultimately detected by measuring the discrepancy in the correlation of nodes’ contextual features. Extensive experiments conducted on six datasets with synthetic outliers and five datasets with organic outliers have demonstrated the significant effectiveness of CoCo compared to existing methods.

Electrocardiogram(ECG) signal analysis is crucial in healthcare service computing. Ensuring accurate assessment of ECG signal quality is vital to prevent wastage of transmission bandwidth and ineffective analysis caused by noise. This enables the efficient utilization of service resources. However, existing ECG signal quality assessment(SQA) methods primarily focus on single-modal learning, overlooking the interrelation of ECG in a multimodal feature space and failing to effectively exploit available information for pattern mining. In this paper, we model the SQA for ECG as an anomaly detection problem and propose a multimodal unsupervised SQA method. It jointly explores the boundaries between high-quality ECG and noise in both the time and frequency domains by introducing time-frequency pseudo anomalies. Specifically, we first simulate real ECG noise from the time-domain using a combination of a series of noises and convert it to the frequency-domain to form time-frequency pseudo-anomalies. Next, we map the time-frequency pseudo anomalies onto hyperspheres and jointly refine the hyperspheres learned only from high-quality ECG samples in both feature spaces. Finally, the noise score is defined as the distance from the joint time-frequency features to the center of the hypersphere. Multiple experiments on various real-world ECG datasets validate the superior performance of our proposed method.

Graph anomaly detection aims to identify the nodes that display significantly different behavior from the majority. However, existing methods neglect the combined interaction between the network structure and node attributes, resulting in suboptimal latent representations of nodes due to network noise. In this paper, we introduce a novel approach called adversarial regularized attributed network embedding (ARANE) for graph anomaly detection. ARANE addresses this issue by forcing normal nodes to inhabit a compact manifold in the latent space, taking into account both the network structure and node attributes.It ensures that data points from the normal class, originating from different distributions, are distributed within a single compact latent space, while excluding anomalies from this region.ARANE employs a dual-encoder architecture consisting of an attribute encoder and a structure encoder.The attribute encoder learns node attribute embeddings, while the structure encoder focuses on learning structure embeddings.To obtain high-quality node embeddings for effective anomaly detection, we apply adversarial learning to regularize the learned embeddings separately in both the structure and attribute spaces.Furthermore, we introduce a fusion module that combines the final node embeddings derived from the structure and attribute spaces.These joint embeddings serve as inputs to a dual-decoder for graph reconstruction, where the resulting reconstruction errors are utilized as anomaly scores for anomaly detection.Extensive experiments conducted on real-world attributed networks demonstrate the superior effectiveness of our proposed method compared to state-of-the-art approaches.

Capturing the complex interaction between the node attribute and the network structure is important for attributed network embedding and anomaly detection. However, there are few methods to explicitly model the correlation between these two views of the node attribute and the network structure. In this article, we propose an attributed network anomaly detection (CaCo) method based on the canonical correlation analysis, which assumes that there should be a strong correlation between the attribute and structure features of normal nodes, and a weak correlation one between those abnormal nodes, in the attributed networks. Consequently, a joint learning mechanism is designed in CaCo to explicitly measure the correlation between two views in the latent space. Specifically, the backbone of a weight-sharing graph convolutional network is employed to encode the node feature from two views of attribute and structure in the latent space, respectively. Then, a Kullback–Leibler divergence regularization is used to align the distributions of the two views. Finally, the parameters of CaCo are optimized by maximizing the correlation between attribute and structure features of normal nodes in the training phase, and anomalies can be detected by measuring the correlation between two views in the testing phase. Extensive experiments on six real-world datasets demonstrate the effectiveness of the proposed method compared to the state-of-the-art techniques.

In the context of the Internet of Everything, traditional machine learning-based intrusion detection systems (IDS) have difficulties in heterogeneous data preprocessing and fusion training, and can no longer meet the needs of heterogeneous Internet of Things (HeIoT) intrusion detection. This article proposes a deep transfer learning method based on word embedding (WE) to solve the above problems. First, a multisource data fusion method based on natural language processing is designed to maintain the consistency of the source domain and target domain tensors and complete the sample transfer. Then, use WE to map the mathematical and logical features of the physical network into feature space vectors to complete feature transfer. Finally, the heterogeneous fusion WE coefficients were imported into the deep learning model to complete the model transfer. In the simulation, the KDD CUP 99, NSL-KDD, and UNSW-NB15 datasets widely used in the IDS research field are used as the single source domain and the multisource heterogeneous fusion source domain, respectively, which verifies the effectiveness of WE combined with mainstream deep learning models in IDS. The results show that the proposed scheme can simplify the data standardization process, can better preserve data features, the WE space of heterogeneous sequences can coexist, and the convolutional neural network and bidirectional long short-term memory models perform better, the test accuracy of the single source domain and heterogeneous source domain can reach more than 98.5%, realize the integration of HeIoT network sequences, and solve the cold start problem of HeIoT IDS.

Semi-supervised learning (SSL) provides a powerful paradigm to mitigate the reliance on large labeled data by leveraging unlabeled data during model training. However, for time series data, few SSL models focus on the underlying temporal structure of time series, which results in a suboptimal representation learning quality on unlabeled time series. In this article, we propose a framework of semisupervised time series classification by investigating irregular time sampling (iTimes), which learns the underlying temporal structure of unlabeled time series in a self-supervised manner to benefit semisupervised time series classification. Specifically, we propose four different irregular time sampling functions to transform the original time series into different transformations. Then, iTimes employs a supervised module to classify labeled time series directly and employs a self-supervised module on unlabeled time series by predicting the transformation type of irregular time sampling. Finally, the underlying temporal structure pattern of unlabeled time series can be captured in the self-supervised module. The feature spaces between labeled data and unlabeled data can be aligned by jointly training the supervised and self-supervised modules which boost the ability of model learning and the representation quality. Extensive experimental results on multiple real-world datasets demonstrate the effectiveness of iTimes compared with the state-of-the-art baselines.

Networks are ubiquitous in the real world such as social networks and communication networks, and anomaly detection on networks aims at finding nodes whose structural or attributed patterns deviate significantly from the majority of reference nodes. However, most of the traditional anomaly detection methods neglect the relation structure information among data points and therefore cannot effectively generalize to the graph structure data. In this paper, we propose an end-to-end model of Deep Dual Support Vector Data description based Autoencoder (Dual-SVDAE) for anomaly detection on attributed networks, which considers both the structure and attribute for attributed networks. Specifically, Dual-SVDAE consists of a structure autoencoder and an attribute autoencoder to learn the latent representation of the node in the structure space and attribute space, respectively. Then, a dual-hypersphere learning mechanism is imposed on them to learn two hyperspheres of normal nodes from the structure and attribute perspectives, respectively. Moreover, to achieve joint learning between the structure and attribute of the network, we fuse the structure embedding and attribute embedding as the final input of the feature decoder to generate the node attribute. Finally, abnormal nodes can be detected by measuring the distance of nodes to the learned center of each hypersphere in the latent structure space and attribute space, respectively. Extensive experiments on the real-world attributed networks show that Dual-SVDAE consistently outperforms the state-of-the-arts, which demonstrates the effectiveness of the proposed method.

Link prediction aims at inferring missing links or predicting future ones based on the currently observed network. This topic is important for many applications such as social media, bioinformatics and recommendation systems. Most existing methods focus on homogeneous settings and consider only low-order pairwise relations while ignoring either the heterogeneity or high-order complex relations among different types of nodes, which tends to lead to a sub-optimal embedding result. This paper presents a method named Heterogeneous Hypergraph Variational Autoencoder (HeteHG-VAE) for link prediction in heterogeneous information networks (HINs). It first maps a conventional HIN to a heterogeneous hypergraph with a certain kind of semantics to capture both the high-order semantics and complex relations among nodes, while preserving the low-order pairwise topology information of the original HIN. Then, deep latent representations of nodes and hyperedges are learned by a Bayesian deep generative framework from the heterogeneous hypergraph in an unsupervised manner. Moreover, a hyperedge attention module is designed to learn the importance of different types of nodes in each hyperedge. The major merit of HeteHG-VAE lies in its ability of modeling multi-level relations in heterogeneous settings. Extensive experiments on real-world datasets demonstrate the effectiveness and efficiency of the proposed method.

Semi-supervised learning (SSL) has proven to be a powerful algorithm in different domains by leveraging unlabeled data to mitigate the reliance on the tremendous annotated data. However, few efforts consider the underlying temporal relation structure of unlabeled time series data in the semi-supervised learning paradigm. In this work, we propose a simple and effective method of Semi-supervised Time series classification architecture (termed as SemiTime) by gaining from the structure of unlabeled data in a self-supervised manner. Specifically, for the labeled time series, SemiTime conducts the supervised classification directly under the supervision of the annotated class label. For the unlabeled time series, the segments of past-future pair are sampled from time series, where two segments of pair from the same time series candidate are in positive temporal relation, while two segments from the different candidates are in negative temporal relation. Then, the temporal relation between those segments is predicted by SemiTime in a self-supervised manner. Finally, by jointly classifying labeled data and predicting the temporal relation of unlabeled data, the useful representation of unlabeled time series can be captured by SemiTime. Extensive experiments on multiple real-world datasets show that SemiTime consistently out-performs the state-of-the-arts, which demonstrates the effectiveness of the proposed method. Code and data are publicly available at https://haoyfan.github.io.

The artificial immune system (AIS) is one of the important branches of artificial intelligence technology, and it is widely used in many fields. The detector set is the core knowledge set, and the AIS application effects are mainly determined by the generation, evolution, and detection of the detectors. Presently, the problem space (shape-space) of AIS mainly applied real-valued representation. But the real-valued detectors have some problems that have not been solved well, such as slow convergence speed of generation, holes in the nonself region, detector overlapping redundancy, dimension curse, etc., which lead to the unsatisfactory detection effects. Moreover, artificial immune anomaly detection is a dynamic adaptive model, needs to be evolved adaptively with the detection environments. Without better adaptive modeling, these problems mentioned before will get worse. In view of this, this article proposes a multisource immune detector adaptive model in neighborhood shape-space and applies it to anomaly detection: based on random, chaotic map and DNA genetic algorithm (DNA-GA), multisource neighborhood negative selection algorithm (MSNNSA), multisource neighborhood immune detector generation algorithm (MS-NIDGA), and neighborhood immune anomaly detection algorithm (NIADA) are proposed, so that the generation and detection of immune detectors can be improved efficiently; introducing immune adaptive and feedback mechanism, multisource neighborhood immune detector adaptive model (MS-NIDAM) is built, so that the detectors can be adaptively evolved in a more targeted search domain, and keep better distribution to the nonself region in real time, so as to solve various problems existing in the real-valued shape-space under dynamic environment mentioned before and improve the overall detection performances. The experimental results show that MS-NIDAM can improve the detector generation/evolution efficiency, keep the up-to-date understanding of the changing environment, so as to obtain better overall detection performances and stability than other comparative methods.

Anomaly detection on attributed networks aims at finding nodes whose patterns deviate significantly from the majority of reference nodes, which is pervasive in many applications such as network intrusion detection and social spammer detection. However, most existing methods neglect the complex cross-modality interactions between network structure and node attribute. In this paper, we propose a deep joint representation learning framework for anomaly detection through a dual autoencoder (AnomalyDAE), which captures the complex interactions between network structure and node attribute for high-quality embeddings. Specifically, Anoma-lyDAE consists of a structure autoencoder and an attribute autoencoder to learn both node embedding and attribute embedding jointly in latent space. Moreover, attention mechanism is employed in structure encoder to learn the importance between a node and its neighbors for an effective capturing of structure pattern, which is important to anomaly detection. Besides, by taking both the node embedding and attribute embedding as inputs of attribute decoder, the cross-modality interactions between network structure and node attribute are learned during the reconstruction of node attribute. Finally, anomalies can be detected by measuring the reconstruction errors of nodes from both the structure and attribute perspectives. Extensive experiments on real-world datasets demonstrate the effectiveness of the proposed method.

With the popularisation of unmanned aerial vehicle (UAV) technology, relay communication based on multi‐UAVs has advantages and application prospects. However, determining the location of UAV relay nodes is a fundamental problem. In particular, when multiple UAVs are required, it is important to design an efficient node placement method that optimises the layout of UAV nodes to minimise the number of required UAVs and provide reliable connectivity for all ground terminals. In this study, the node placement models for multi‐UAV relay communication are constructed based on the non‐linear constraint optimisation problem for typical application scenarios, and the solving algorithm of the models is proposed based on the smallest enclosing circle and genetic algorithm. Through the new placement method, the authors can locate UAV relay nodes and optimise the network topology with the minimum number of UAVs required. Finally, the implementation process and results are validated by simulation.