Interpretable malware detection is crucial for understanding harmful behaviors and building trust in automated security systems. Traditional explainable methods for Graph Neural Networks (GNNs) often highlight important regions within a graph but fail to associate them with known benign or malicious behavioral patterns. This limitation reduces their utility in security contexts, where alignment with verified prototypes is essential. In this work, we introduce a novel dual prototype-driven explainable framework that interprets GNN-based malware detection decisions. This dual explainable framework integrates a base explainer (a state-of-the-art explainer) with a novel second-level explainer which is designed by subgraph matching technique, called SubMatch explainer. The proposed explainer assigns interpretable scores to nodes based on their association with matched subgraphs, offering a fine-grained distinction between benign and malicious regions. This prototype-guided scoring mechanism enables more interpretable, behavior-aligned explanations. Experimental results demonstrate that our method preserves high detection performance while significantly improving interpretability in malware analysis. • Dual prototype-driven framework for explainable GNN-based malware detection. • SubMatch explainer uses subgraph matching for structure-aware node interpretation. • Behavior-aligned explanations via verified malicious and benign subgraph prototypes. • Fine-grained localization of malicious and benign regions within a CFG.

Current continual learning techniques are challenged by the harsh learning conditions that are frequently imposed by real-world environments, such as distributional shifts, feature evolution, label scarcity, imbalance, noise, and novel or recurring classes. Current research typically tackles these problems separately, which restricts its relevance to dynamic and uncertain situations. This survey offers a thorough analysis of continual learning in such challenging circumstances and presents self-adaptive learning as a broad conceptual framework to bring these initiatives together. Instead of suggesting a particular algorithm, we present self-adaptive learning as an approach where a learning system recognizes environmental or data deficiencies on its own and modifies its learning behavior accordingly. We identify commonalities, classify methodological developments, and delineate unresolved issues in the development of resilient, self-regulating continual learners for practical applications by arranging previous research around this adaptive perspective.

Machine learning is a powerful tool enabling full automation of a huge number of tasks without explicit programming. Despite recent progress of machine learning in different domains, these models have shown vulnerabilities when they are exposed to adversarial threats. Adversarial threats aim to hinder the machine learning models from satisfying their objectives. They can create adversarial perturbations, which are imperceptible to humans’ eyes but have the ability to cause misclassification during inference. In this paper, we propose a defense system, which devises an adversarial training module within mixture-of-experts architecture to enhance its robustness against white-box evasion attacks. In our proposed defense system, we use nine pre-trained classifiers (experts) with ResNet-18 as their backbone. During end-to-end training, the parameters of all experts and the gating mechanism are jointly updated allowing further optimization of the experts. Our proposed defense system outperforms prior MoE-based defenses under strong white-box FGSM and PGD evaluation on CIFAR-10 and SVHN. The use of multiple experts increases training time and compute relative to single-network baselines; however, inference scales approximately linearly with the number of experts and is substantially cheaper than training.

The serverless nature of Decentralized Federated Learning (DFL) requires allocating the aggregation role to specific participants in each federated round. Current DFL architectures ensure the trustworthiness of the aggregator node upon selection. However, most of these studies overlook the possibility that the aggregating node may turn rogue and act maliciously after being nominated. To address this problem, this paper proposes a DFL structure, calledTrustChain, that scores the aggregators before selection based on their past behavior and additionally audits them after the aggregation. To do this, the statistical independence between the client updates and the aggregated model is continuously monitored using the Hilbert-Schmidt Independence Criterion (HSIC). The proposed method relies on several principles, including blockchain, anomaly detection, and concept drift analysis. The designed structure is evaluated on several federated datasets and attack scenarios with different numbers of Byzantine nodes.

This paper introduces SBAN (Source code, Binary, Assembly, and Natural Language Description), a large-scale, multi-dimensional dataset designed to advance the pre-training and evaluation of large language models (LLMs) for software code analysis. SBAN comprises more than 3 million samples, including 2.9 million benign and 672,000 malware respectively, each represented across four complementary layers: binary code, assembly instructions, natural language descriptions, and source code. This unique multimodal structure enables research on cross-representation learning, semantic understanding of software, and automated malware detection. Beyond security applications, SBAN supports broader tasks such as code translation, code explanation, and other software mining tasks involving heterogeneous data. It is particularly suited for scalable training of deep models, including transformers and other LLM architectures. By bridging low-level machine representations and high-level human semantics, SBAN provides a robust foundation for building intelligent systems that reason about code. We believe that this dataset opens new opportunities for mining software behavior, improving security analytics, and enhancing LLM capabilities in pre-training and fine-tuning tasks for software code mining.

Natural Language Description (NLD) is a Natural Language Processing (NLP) task that requires models to generate structured and meaningful outputs from natural language inputs. In this work, we propose NLD-LLM, a systematic NLP framework to evaluate the performance of language models to generate accurate and concise source code descriptions. This framework incorporates a diverse set of transformer models, including Qwen, DeepSeek, Phi, LLaMA, and Mistral, spanning various sizes, architectures, and training approaches. Central to NLD-LLM is a comprehensive prompt design strategy that includes standardized formatting, clear task guidance, and NLD prompting, ensuring fair and consistent evaluation. Additionally, we apply an iterative refinement process to improve output’s quality and assess the model’s adaptability. Using semantic and structural metrics, our analysis demonstrates that prompt engineering significantly impacts the effectiveness of the model such that smaller models often performing competitively when supported by well-crafted prompts.

The growing sophistication and scale of malicious software demand detection methods capable of capturing both the behavioral complexity and structural relationships in program execution. Graph Neural Networks (GNNs) have shown strong potential for malware detection by leveraging graph-structured representations such as Control Flow Graphs (CFGs), which preserve execution semantics and interdependencies between program components. When extracted dynamically, CFGs reflect actual runtime behavior, offering richer and more reliable information than static analysis alone. At the same time, GNN performance is sensitive to hyperparameter configurations, where suboptimal settings can lead to over-smoothing, reduced accuracy, or excessive computational cost. This paper presents a systematic study that combines the development of a GNN-based malware detection framework using dynamically extracted CFGs with a detailed analysis of hyperparameter sensitivity. We investigate the influence of model depth, hidden dimensions, learning rate, weight decay, and training epochs using two representative architectures, Graph Convolutional Networks (GCN) and GraphSAGE. The findings provide empirical insights and practical guidelines for building powerful, efficient, and well-tuned GNN-based malware detection systems, with applicability to other graph classification domains.

Federated Continual Learning (FCL) has emerged as a robust solution for collaborative model training in dynamic environments, where data samples are continuously generated and distributed across multiple devices. This survey provides a comprehensive review of FCL, focusing on key challenges such as heterogeneity, model stability, communication overhead, and privacy preservation. We explore various forms of heterogeneity and their impact on model performance. Solutions to non-IID data, resource-constrained platforms, and personalized learning are reviewed in an effort to show the complexities of handling heterogeneous data distributions. Next, we review techniques for ensuring model stability and avoiding catastrophic forgetting, which are critical in non-stationary environments. Privacy-preserving techniques are another aspect of FCL that have been reviewed in this work. This survey has integrated insights from federated learning and continual learning to present strategies for improving the efficacy and scalability of FCL systems, making it applicable to a wide range of real-world scenarios.

Control Flow Graphs (CFGs) are critical for analyzing program execution and characterizing malware behavior. With the growing adoption of Graph Neural Networks (GNNs), CFG-based representations have proven highly effective for malware detection. This study proposes a novel framework that dynamically constructs CFGs and embeds node features using a hybrid approach combining rule-based encoding and autoencoder-based embedding. A GNN-based classifier is then constructed to detect malicious behavior from the resulting graph representations. To improve model interpretability, we apply state-of-the-art explainability techniques, including GNNExplainer, PGExplainer, and CaptumExplainer, the latter is utilized three attribution methods: Integrated Gradients, Guided Backpropagation, and Saliency. In addition, we introduce a novel aggregation method, called RankFusion, that integrates the outputs of the top-performing explainers to enhance the explanation quality. We also evaluate explanations using two subgraph extraction strategies, including the proposed Greedy Edge-wise Composition (GEC) method for improved structural coherence. A comprehensive evaluation using accuracy, fidelity, and consistency metrics demonstrates the effectiveness of the proposed framework in terms of accurate identification of malware samples and generating reliable and interpretable explanations.

In this paper, we study the performance of few-shot learning, specifically meta learning empowered few-shot relation networks, over supervised deep learning and conventional machine learning approaches in the problem of Sound Source Distance Estimation (SSDE). In previous research on deep supervised SSDE, low accuracies have often resulted from the mismatch between the training data (from known environments) and the test data (from unknown environments). By performing comparative experiments on a sufficient amount of data, we show that the few-shot relation network outperforms other competitors including eXtreme Gradient Boosting (XGBoost), Support Vector Machine (SVM), Convolutional Neural Network (CNN), and MultiLayer Perceptron (MLP). Hence it is possible to calibrate a microphone-equipped system, with a few labeled samples of audio recorded in a particular unknown environment to adjust and generalize our classifier to the possible input data and gain higher accuracies.

Intrusion detection systems are primarily designed to flag security breaches upon their occurrence. These systems operate under the assumption of single-label data, where each instance is assigned to a single category. However, when dealing with complex data, such as malware triage, the information provided by the IDS is limited. Consequently, additional analysis becomes necessary, leading to delays and incurring additional computational costs. Existing solutions to this problem typically merge these steps by considering a unified, but large, label set encompassing both intrusion and analytical labels, which adversely affects efficiency and performance. To address these challenges, this paper presents a novel framework for multi-label classification by employing an ensemble of sequential models that preserve the original label sets during training. Each model focuses on learning the distribution specifically related to its assigned set of labels, independent of the other label sets. To capture the relationship between different sets of labels, the parameters of each trained model initialize the subsequent model, ensuring that information from unrelated label sets does not interfere with the learning objective. Consequently, the proposed method enhances prediction performance without increasing computational complexity. To evaluate the effectiveness of our approach, we conduct experiments on a real-world dataset related to intrusion detection. The results clearly demonstrate the effectiveness of our proposed method in handling multi-label classification tasks.

Federated learning has been rapidly evolving and gaining popularity in recent years due to its privacy-preserving features, among other advantages. Nevertheless, the exchange of model updates and gradients in this architecture provides new attack surfaces for malicious users of the network which may jeopardize the model performance and user and data privacy. For this reason, one of the main motivations for decentralized federated learning is to eliminate server-related threats by removing the server from the network and compensating for it through technologies such as blockchain. However, this advantage comes at the cost of challenging the system with new privacy threats. Thus, performing a thorough security analysis in this new paradigm is necessary. This survey studies possible variations of threats and adversaries in decentralized federated learning and overviews the potential defense mechanisms. Trustability and verifiability of decentralized federated learning are also considered in this study.

This article studies the resilient finite-time consensus tracking problem for high-order nonholonomic chained-form systems against denial-of-service (DoS) attacks. The first step is to develop a novel secure distributed observer for each follower in which the tangent hyperbolic function is used to accelerate the convergence speed of the observer by inducing a high-gain effect. The paralyzed-connectivity graphs resulting from DoS attacks are repaired to the initially connected graphs by integrating both acknowledgment-based attack detection techniques and the communication recovery process. In addition, it is demonstrated that the duration of DoS attacks directly affects the convergence time of the proposed scheme. Then, a fast finite-time backstepping control (FFTBC) algorithm is established for each follower to track the estimated leader's information, ensuring fast convergence performance regardless of whether the follower states are near or far from the equilibrium point. An approximation-based approach is also presented for reducing the conservatism of the upper estimate of the settling time. An evaluation of the proposed control algorithm under DoS attacks is conducted using a group of wheeled mobile robots.

Trust-building is of paramount importance for managing and improving consensus in group decision-making (GDM). This mechanism usually involves a trust propagation process for estimating the level of trust among decision-makers (DMs). However, this process is computationally expensive and hinders the speed of consensus reaching. To address this issue, this work proposes a novel trust-building mechanism that does not rely on the trust propagation process to quantify DMs' level of trust. Instead, it makes use of Blockchain technology to facilitate communication between the moderator and the group of DMs. This novel trust-building mechanism does not rely on trust propagation, which makes it computationally efficient for building trust among DMs while also providing a secure and efficient communication protocol to accelerate the consensus-reaching process. The proposed GDM model is illustrated through an example, and the sensitivity of the model to various assumptions is analyzed, demonstrating the practical applicability of this approach.

To manage consensus in opinion dynamics models (ODMs), removing bias from agents' interactions and considering their willingness are critical. It can be accomplished by providing a secure mechanism that does not disclose agents' identities and opinions in their interactions, eliminating the impact of opinion similarity on trust building. To build trust and consensus opinion, we propose a linguistic ODM based on the Blockchain technology. This model allows agents' opinions to be expressed usingZ-numbers, as opposed to regular ODMs with numerical opinions. Agents are encouraged to modify their initial opinions in response to a minimum cost consensus model. Willingness of agents to accept or refuse the suggested modifications is realized through a Blockchain regime to avoid bias. The regime, however, must be supported by a trust-building mechanism to persuade agents to alter their opinions. To this end, we propose a Blockchain-enabled trust-building mechanism to improve agents' trust and guide them toward a consensus opinion. Following a sensitivity analysis of the underlying assumptions in the developed model, the proposed ODM is tested for its efficiency and validity.

Emerging data-driven technologies and big data analytics generate and deal with high-dimensional data. Transformation of such data into a low-dimensional feature space brings about numerous benefits, such as a more discriminant feature space, performance enhancement, less computational burden, and facilitating data visualization. This paper proposes a novel dimensionality reduction algorithm based on generative adversarial networks to tackle the issues related to high-dimensional data and common challenges in dimensionality reduction. To this aim, two constraints are defined to preserve the characteristics of the original data while rectifying the data distribution upon transformation. Formulating the transformation as sequential projections, the proposed Constrained Adversarial Dimensionality Reduction (CADR) method finds a set of sequential projection vectors that lead to a feature space in which between-class separability and within-class integrity are satisfied. This is while the transformed data perfectly comply with the pairwise affinity correlation in the original feature space. To evaluate the proposed method, nine advanced dimensionality reduction techniques are employed to enable a comparative study. The experiments are performed on several real-world benchmark datasets in terms of classification accuracy, F-measure, and G-mean. The obtained results show that the CADR could yield classification performance at a satisfactory level and outperforms the other competitors.

The number of discussion rounds and harmony degree of decision makers are two crucial efficiency measures to be considered in the design of the consensus-reaching process for the group decision-making problems. Adjusting the feedback parameter and importance weights of the decision makers in the recommendation mechanism has a great impact on these efficiency measures. This work aims to propose novel and efficient reinforcement learning-based adjustment mechanisms to address the tradeoff between the aforementioned measures. To employ these adjustment mechanisms, we propose to extract the dynamics of state transition from consensus models based on the distributed trust functions and$Z$-Numbers in order to convert the decision environment into a Markov decision process. Two independent reinforcement learning agents are then trained via a deep deterministic policy gradient algorithm to adjust the feedback parameter and importance weights of decision makers. The first agent is trained toward reducing the number of discussion rounds while ensuring the highest possible level of harmony degree among the decision makers. The second agent merely speeds up the consensus reaching process by adjusting the importance weights of the decision makers. Various experiments are designed to verify the applicability and scalability of the proposed feedback and weight-adjustment mechanisms in different decision environments.

Deep brain stimulation (DBS) is an effective and promising therapy to control Parkinson’s tremor movement in patients with advanced Parkinson’s disease (PD). This paper proposes a new alternative medication that has several advantages, including compatibility with individual needs and low side effects. There has been a rapid improvement in the literature on the development of the dynamic computational model of neuroscience, alongside the development of DBS. A combination of DBS and model-based control strategies opens up a new vision for Parkinson’s disease treatment. Despite the numerous studies on basal ganglia (BG) modeling, researchers are required to employ adaptive and robust strategies to eliminate Parkinson’s patients’ tremors. This paper proposes a new adaptive optimal fast terminal sliding mode control (AOFTSMC) method to mitigate tremors by tuning GABA thorough DBS. This approach represents finite-time convergence law, a new method to stimulate the inner nuclei of BG in a robust and optimum manner that leads to removing tremors of PD fluctuation signal in the presence of uncertainties. Finally, simulation results of the basal ganglia model under the addressed approach are adopted to demonstrate the effectiveness of the proposed method.

Misbehavior detection is a critical task in vehicularad hocnetworks (VANETs). However, state-of-the-art data-driven techniques for misbehavior detection are usually conducted through complete V2X communications data collected from simulated experiments. This article evaluates main strategies for the treatment of missing values to find out the best match for misbehavior detection with incomplete V2X communications data. This article proposes two novel methods for imputing and tolerating missing data. The former is a novel imputation method that is based on the collaborative clustering and the latter is a missing-tolerant method that is an ensemble learning based on the random subspace selection and Dempster–Shafer fusion. The effectiveness of the proposed techniques is evaluated by the ground-truth vehicular reference misbehavior (VeReMi) data. Moreover, a multifactor amputation framework has been developed to induce missingness over V2X communications data with different missing ratios, mechanisms, and distributions. This provides a comprehensive benchmark resembling missingness over V2X communications data. The proposed methods are compared with five missing-tolerant and nine imputation methods. The attained results over the benchmark data indicate that the proposed missing-tolerant method is significantly better than other treatment methods in terms of accuracy and F-measure.

Many efforts have been dedicated to addressing data loss in various domains. While task-specific solutions may eliminate the respective issue in certain applications, finding a generic method for missing data estimation is rather complex. In this regard, this article proposes a novel missing data imputation algorithm, which has supreme generalization ability for a vast variety of applications. Making use of both complete and incomplete parts of data, the proposed algorithm reduces the effect of missing ratio, which makes it suitable for situations with very high missing ratios. In addition, this feature enables model construction on incomplete training sets, which is rarely addressed in the literature. Moreover, the nonparametric nature of this new algorithm brings about supreme flexibility against all variations of missing values and data distribution. We incorporate the advantages of denoising autoencoders and ladder architecture into a novel formulation based on deep neural networks. To evaluate the proposed algorithm, a comparative study is performed using a number of reputable imputation techniques. In this process, real-world benchmark datasets from different domains are selected. On top of that, a real cyber-physical system is also evaluated to study the generalization ability of the proposed algorithm for distinct applications. To do so, we conduct studies based on three missing data mechanisms, namely: 1) missing completely at random; 2) missing at random; and 3) missing not at random. The attained results indicate the superiority of the proposed method in these experiments.

This article introduces an uncertainty-aware cloud-fog-based framework for power management of smart grids using a multiagent-based system. The power management is a social welfare optimization problem. A multiagent-based algorithm is suggested to solve this problem, in which agents are defined as volunteering consumers and dispatchable generators. In the proposed method, every consumer can voluntarily put a price on its power demand at each interval of operation to benefit from the equal opportunity of contributing to the power management process provided for all generation and consumption units. In addition, the uncertainty analysis using a deep learning method is also applied in a distributive way with the local calculation of prediction intervals for sources with stochastic nature in the system, such as loads, small wind turbines (WTs), and rooftop photovoltaics (PVs). Using the predicted ranges of load demand and stochastic generation outputs, a range for power consumption/generation is also provided for each agent called "preparation range" to demonstrate the predicted boundary, where the accepted power consumption/generation of an agent might occur, considering the uncertain sources. Besides, fog computing is deployed as a critical infrastructure for fast calculation and providing local storage for reasonable pricing. Cloud services are also proposed for virtual applications as efficient databases and computation units. The performance of the proposed framework is examined on two smart grid test systems and compared with other well-known methods. The results prove the capability of the proposed method to obtain the optimal outcomes in a short time for any scale of grid.

There has been an increasing interest in the use of data-driven techniques for classifying cyber-attacks and physical faults in cyber-physical systems. In real-world applications, the number of cyber-attack and faulty samples is usually far less than normal samples. This causes the skewed class distribution in data collected from cyber-physical systems. Training an accurate predictive model under skewed class conditions is not an easy task. In this work, we introduce a new generative adversarial framework for learning from skewed class distributions. This novel Adversarial Class-Imbalance Learning (ACIL) scheme has a novel loss function that is used during the adversarial training session. ACIL tries to iteratively adjust weights of an auxiliary multilayer perceptron to learn the minority class (i.e., cyber-attacks and physical faults) distributions along with the majority class (i.e., normal) distribution. Moreover, we devise an inclusive data-driven scheme for classifying cyber-attacks and faults, which includes four experiments of a baseline, nine state-of-the-art class-imbalance learning methods, two different generative-adversarial network-based approaches, and ACIL. These techniques are verified and compared through several experimental cyber-physical power scenarios. The obtained results show the effectiveness of ACIL for classifying samples of cyber-attacks and faults with skewed class distributions.

This paper presents a novel data-driven framework to aid in system state estimation when the power system is under unobservable false data injection attacks. The proposed framework dynamically detects and classifies false data injection attacks. Then, it retrieves the control signal using the acquired information. This process is accomplished in three main modules, with novel designs, for detection, classification, and control signal retrieval. The detection module monitors historical changes of phasor measurements and captures any deviation pattern caused by an attack on a complex plane. This approach can help to reveal characteristics of the attacks including the direction, magnitude, and ratio of the injected false data. Using this information, the signal retrieval module can easily recover the original control signal and remove the injected false data. Further information regarding the attack type can be obtained through the classifier module. The proposed ensemble learner is compatible with harsh learning conditions including the lack of labeled data, concept drift, concept evolution, recurring classes, and independence to external updates. The proposed novel classifier can dynamically learn from data and classify attacks under all these harsh learning conditions. The introduced framework is evaluated w.r.t. real-world data captured from the Central New York Power System. The obtained results indicate the efficacy and stability of the proposed framework.

In this article, a new approach is proposed for stability analysis and controller design of nonlinear discrete-time positive systems by means of the Takagi–Sugeno fuzzy model. The closed-loop stability and the positivity constraint are guaranteed by synthesizing a linear co-positive Lyapunov function and by applying the parallel distributed compensation controller. In contrast to the state-of-the-art approaches for ensuring the$\ell _{1}$-stability of the positive system which are based on bilinear matrix inequalities, the proposed optimal robust control design under$\ell _{1}$-induced performance is derived based on linear programming framework. It has been shown that the computational complexity of the proposed optimization problem can be effectively reduced. Finally, a numerical example and the Leslie population model are adopted to show the capabilities of the proposed method.

In this study, first, a comprehensive model is introduced to model actuator faults, and then a novel fault-tolerant control (FTC) strategy is proposed to compensate the loss of actuator’s effectiveness in networked control systems (NCSs). A Markov chain is exploited to represent networked-induced random delays, and data packet dropouts as well as disorders to address the stochastic characteristic of the network issues. Accordingly, the resulting closed-loop system lies in the framework of Markovian jump systems (MJSs). Moreover, partly unknown transition probabilities are considered in the current study since the identification of the exact value of transition probabilities of the Markov chain is difficult or even impractical due to the complex structure of the network. Sufficient conditions for the stochastic stability are derived by means of the solutions of a finite set of linear matrix inequalities (LMIs) to design a novel robust FTC through the output feedback technique, which requires only the outputs. A numerical example and an engineering benchmark system are presented to verify the capability of the proposed method in practical applications.

In this study, a constrained nonlinear model predictive control (NMPC) is presented for the purpose of voltage and current stabilization of a DC microgrid that supplies constant power loads. The proposed technique can handle all constraints of the stand-alone DC microgrid in different configurations. Furthermore, in order to reduce the complexity of the NMPC, a novel approach, which is called fast NMPC is proposed, and it is shown that it has superior performance than NMPC.

The performance of intrusion classification systems is often hampered by the presence of missing values in data collected from cyber-physical systems. Therefore, it is of paramount importance to robustly handle such missing scores, which in turn enhances the efficiency of intrusion classification task, and, consequently, the cybersecurity of cyber-physical systems. To this aim, this paper studies the efficacy of missing data imputation techniques for safeguarding intrusion classification systems against missing scores. To do this, a hybrid intrusion classification system is designed that comprises several advanced imputation techniques. To evaluate this intrusion classification framework, various incomplete scenarios have been simulated from data collected from a cyber-physical water system. In total, forty-four incomplete scenarios are considered throughout the experiments. The evaluation is conducted based on the classification accuracy and F-measure, as well as the root mean square error of the imputed data. The experimental results indicate the efficiency of the proposed intrusion classification system and find the best match missing data imputation technique for the sake of intrusion classification.

This paper deals with the problem of robust H∞fault-tolerant controller design for fuzzy networked control systems using static state feedback. The stability of networked control systems is affected by delay, sensor failure and data drift. Therefore, a Lyapunov–Krasovskii functional are exploited to establish asymptotic stability conditions for the underlying system considering these imperfections. It is assumed that sensor failure and data drift, which occur during data transmission over the network, are modeled by a stochastic variable with Bernoulli distribution. The design conditions are presented in terms of linear matrix inequalities, and the efficiency of the proposed approach is shown through a numerical example.

Correct classification of rare samples is a vital data mining task and of paramount importance in many research domains. This article mainly focuses on the development of the novel class-imbalance learning techniques, which make use of oversampling methods integrated with bagging and boosting ensembles. Two novel oversampling strategies based on the single and the multiple imputation methods are proposed. The proposed techniques aim to create useful synthetic minority class samples, similar to the original minority class samples, by estimation of missing values that are already induced in the minority class samples. The re-balanced datasets are then used to train base-learners of the ensemble algorithms. In addition, the proposed techniques are compared with the commonly used class imbalance learning methods in terms of three performance metrics including AUC, F-measure, and G-mean over several synthetic binary class datasets. The empirical results show that the proposed multiple imputation-based oversampling combined with bagging significantly outperforms other competitors.

Fault diagnosis and prognosis are some of the most crucial functionalities in complex and safety-critical engineering systems, and particularly fault diagnosis, has been a subject of intensive research in the past four decades. Such capabilities allow for detection and isolation of early developing faults as well as prediction of fault propagation, which can allow for preventive maintenance, or even serve as a countermeasure to the possibility of catastrophic incidence as a result of a failure. Following a short preliminary overview and definitions, this article provides a survey of recent research on fault prognosis. Additionally, we report on some of the significant application domains where prognosis techniques are employed. Finally, some potential directions for future research are outlined.

Security maintenance of Supervisory Control and Data Acquisition (SCADA) systems has been a point of interest during recent years. Numerous research works have been dedicated to the design of intrusion detection systems for securing SCADA communications. Nevertheless, these data-driven techniques are usually dependant on the quality of the monitored data. In this work, we propose a novel feature selection approach, called MSFS, to tackle undesirable quality of data caused by feature redundancy. In contrast to most feature selection techniques, the proposed method models each class in a different subspace, where it is optimally discriminated. This has been accomplished by resorting to ensemble learning, which enables the usage of multiple feature sets in the same feature space. The proposed method is then utilized to perform intrusion detection in smaller subspaces, which brings about efficiency and accuracy. Moreover, a comparative study is performed on a number of advanced feature selection algorithms. Furthermore, a dataset obtained from the SCADA system of a gas pipeline is employed to enable a realistic simulation. The results indicate the proposed approach extensively improves the detection performance in terms of classification accuracy and standard deviation.

Data-driven diagnostic frameworks for large-scale power grid networks usually deal with a large number of features collected by means of sparse measuring devices. As a pre-processing task, dimensionality reduction methods can improve the efficiency of data-driven diagnostic methods by extracting sets of informative and relevant features from the raw data through appropriate transformations. This work is devoted to studying the applicability of various well-known dimensionality reduction techniques in combination with four classification models in diagnosing open circuit faults in smart grids. By providing a comparative study, this work aims at finding the best combination of dimensionality reduction techniques and classification models for diagnosing faults under normal, high signal-to-noise-ratio, low sampling rate, and high fault-resistance conditions. Various fault scenarios have been simulated on the IEEE 39-bus system and a rigorous analysis of the attained results is fulfilled so as to determine the best combinations under different conditions.

This paper is devoted to studying the effect of false data injection attacks on the state estimation of discrete linear time-invariant systems in the presence of unknown disturbance. The proposed scheme firstly decouples the disturbance signal from the estimation error by exploiting the concepts of unknown input observers. Then, the observer gain has been designed based on the Kalman filter algorithm while a saturation term has been assigned to the output error in the update rule of the estimated states. Thanks to the saturation-limit dynamics introduced into the error dynamics of the Kalman filter-based estimation, the proposed method is applicable for the real-time applications. The effectiveness of the proposed scheme has been validated through a numerical example by taking two different scenarios into considerations. First, the comparative results show the superiority of the proposed scheme in state estimation under the presence of high-frequency measurement noise. Next, further to the high-frequency measurement noise, it is assumed that the sensed measurements are also manipulated by an adversary, leading to outliers in the measurements. As for this scenario, the attained results show how successfully the proposed scheme can mitigate the effect of the outliers in the presence of unknown disturbances.

Missing data imputation is a critical part of data cleaning tasks and vital for learning from incomplete data. This paper proposes a novel cooperative clustering imputation (CCI) method to estimate missing values. The proposed method aims to find a better clustering model and donor for imputation, comparing with individual clustering algorithms. It makes use of agreements among different clustering algorithms to generate a set of sub-clusters, and, then, merges these sub-clusters based on the matrix of the performance measures of sub-clusters. The proposed method is evaluated using ten public datasets from UCI data repository and V2X communication data with induced missing samples, and compared with three standard clustering based imputation methods, k-means imputation, fuzzy c-means imputation, and partition around medoids imputation. Missing values are induced through each dataset by different missing mechanisms, missing rates, and missing distribution, and, thus, various incomplete datasets are generated. The performance of these methods are checked using normalized root mean square error (NRMSE). The attained experimental results indicate the effectiveness of the proposed missing values imputation method.

This article proposes a clustering-based hierarchical framework that includes a consensus decision support system for locating faults in smart grids. Frequency measurements are initially collected by distributed frequency disturbance recorders, and then, decomposed in the time-frequency domain. Extracted time-frequency variational modes are further analyzed through statistical analysis. The resulted features are then used by the affinity propagation (AP) clustering technique to partition the power grid. The faulty partition is determined by evaluating a heuristic index, and, is then fed to a zNumber-based multicriteria group decision support system to decide on the fault location. The effect of various preferences on AP clustering has been handled by resorting to an aggregation scheme, which considers multiple criteria into account. The feasibility and effectiveness of the proposed framework have been validated through a comprehensive study on the IEEE 39-bus system.

There has been a growing interest in using smart grids due to their capability in delivering automated and distributed energy level to the consumption units. However, in order to guarantee the safe and reliable delivery of the high-quality power from the generation units to the consumers, smart grids need to be equipped with diagnostic systems. This paper presents an efficient data-driven scheme for diagnosing faults in smart grids. In order to reduce the computational burden and monitor the state of the system with a lower number of smart meters, a method based on the affinity propagation clustering algorithm is suggested for the placement of meters, that makes use of the graph-based representation of the system. The collected voltage data measurements from the installed meters are then decomposed by matching pursuit decomposition in order to generate informative features. Extracted features are then used to train a convolutional neural network, and the constructed deep learning model is then tested using unseen samples of normal and faulty conditions. Simulation results based on the IEEE 39-Bus System demonstrate the effectiveness of the proposed data-driven fault diagnostic system.

Smart grids aim to move the energy industry into a new era of availability, quality, reliability, and efficiency of power at generation, transmission and distribution levels. Transmission lines, like the arteries of smart grids, play an important role in delivering high-quality power from the generation units to the consumers. However, because of their vast geographical spread, they are always exposed to different threats. This paper proposes a computational intelligence method for increasing the protection of the transmission lines in smart grids. Three-phase current measurements of only one side of the faulty transmission line have been collected and passed through a signal processing module to extract novel informative features from the transient current signals generated due to the fault occurrence. Obtained features are then fed to the fault location algorithms to construct predictive models including adaptive neuro-fuzzy inference systems (ANFIS), support vector regression (SVR), and artificial neural networks (ANN) to estimate the exact location of the fault. Multiple scenarios have been simulated on the IEEE 14-bus system, and the attained results validate the superiority of the ANFIS over the other methods.

Design of the data-driven diagnostic systems usually requires to have labeled data during the training session. This paper aims to design a hybrid data-driven framework for diagnosing faults, where the data labels are not available to a large extent. This hybrid framework has five steps for transforming raw vibration signals to informative sets of samples for decision making. It uses several state-of-the-art approaches for feature extraction and semi-supervised feature reduction. The decision-making step uses a number of state-of-the-art semi-supervised learners. This step also comprises a novel surface estimation approach that is developed for SSL. The proposed hybrid framework is applied for diagnosing bearing defects in induction motors and validated based on four scenarios, each of which is experimented with different amounts of labeled samples. The attained diagnostic accuracies show the efficiency of the proposed hybrid framework, including the novel semi-supervised learner in classifying bearing defects, regardless of the number of labeled samples.

Machine learning techniques are widely used for diagnosing faults to guarantee the safe and reliable operation of the systems. Among various techniques, semi-supervised learning can help in diagnosing faulty states and decision making in partially labeled data, where only a few number of labeled observations along with a large number of unlabeled observations are collected from the process. Thus, it is crucial to conduct a critical study on the use of semi-supervised techniques for both dimensionality reduction and fault classification. In this work, three state-of-the- art semi-supervised dimensionality reduction techniques are used to produce informative features for semi-supervised fault classifiers. This study aims to achieve the best pair of the semisupervised dimensionality reduction and classification techniques that can be integrated into the diagnostic scheme for decision making under partially labeled sets of observations.

This paper presents a new approach for broken rotor bars detection in induction motors. When broken rotor bar occurs, the rotor resistance will increase. Furthermore, thermal effects of rotor resistance are considered to address practical aspects. Therefore, a suitable method to detect broken rotor bar is rotor resistance estimation. An applicable method in state estimation is Cubature Kalman Filter (CKF). To display the advantages of the CKF, simulation results are compared with Unscented Kalman Filter (UKF). In addition to not needing setting parameters, this filter is more accurate in rotor resistance estimation compared to the UKF.

This work deals with the problem of filter design for disturbance decoupling in discrete-time linear fractional order systems (FOS) under noisy environments. To this end, Fractional Unknown Input Filter (FUIF) is developed based on Fractional Kalman Filter (FKF) framework. Accordingly, the proposed structure can result in robustness against unknown inputs (UIs) in noisy environments. This algorithm can be used for robust fault detection since the disturbance is decoupled from state estimation error. The designed filter is applied to a fractional order (FO) model of an ultra-capacitor (UC), under noisy condition, for the state estimation and fault detection purposes. Simulation results illustrate the benefits of the proposed approach.

This paper proposes an adaptive incremental ensemble of extreme learning machines for fault diagnosis. The diagnostic system contains a data processing unit which aims to progressively generate discriminant features from the vibration signals for decision making. The decision making unit receives a few sets of labeled discriminant features in a chunk by chunk manner, incrementally learns the features-faults relations, dynamically diagnoses multiple bearing defects, and adaptively adjusts itself to learn new concept classes. This adaptive ensemble system is based on incremental learning of multiple extreme learning machines that are able to consult together and adjust themselves based on their confidence in the decision making. Extreme learning machines are used to construct the hybrid ensemble due to their good controllability and fast learning rate. Experimental results show the efficiency of the hybrid diagnostic system. The proposed diagnostic system is applied to diagnosing bearing defects in an induction motor.

This paper investigates the problem of network-based fault-tolerant controller design for networked control systems (NCSs) in the presence of random delays and data packet dropouts. A novel actuator fault model which is more general and practical than the conventional actuator fault models is developed. Considering this new fault model, the NCSs are firstly modeled as a Markovian jump system (MJS) with partly unknown transition probabilities (TPs), upon which sufficient conditions based on linear matrix inequalities (LMIs) are then developed to design the output feedback fault-tolerant controller to ensure the stochastic stability of the NCS. Finally, simulation results are provided to illustrate the effectiveness and superiority of the proposed method compared to the existing approaches in the literatures.

Efficient diagnosis of bearing defects in induction motors usually requires extracting informative features from the vibration signal and efficiently reducing the dimensionality of the features. In this paper, the vibration signal is primarily analyzed by the empirical mode decomposition technique to extract informative intrinsic mode functions as a set of features. The dimensionality of the extracted feature set is reduced by means of maximally collapsing metric learning (MCML) to create an informative set of small-sized features for fault classification. MCML is an efficient supervised dimensionality reduction technique which aims to collapse patterns of the similar class to a point in the feature space while separates patterns of other classes to the maximum extent possible. To compare the performance of MCML, other state-of-the-art unsupervised and supervised techniques are used for the dimension reduction of the features. The fault diagnosis unit includes various classifiers which aim to diagnose multiple bearing defects that are ball, inner race and outer race defects of different diameters.

This paper focuses on the development of an integrated scheme for diagnosing bearing defects in induction motors, under the class-imbalanced condition. This scheme comprises of four main modules: segmentation, feature extraction, feature reduction, and fault classification. Various state-of-the-art techniques have been devised in the feature extraction and reduction modules to extract informative sets of features from a raw vibration signal, filter redundant features, and produce the most distinct features for the following module. The fault classification module adapts various state-of-the-art class-imbalanced learning techniques for diagnosing bearing defects. This module contains a novel imputation-based oversampling technique for class-imbalanced learning. This integrated diagnostic scheme is evaluated on three experimental scenarios with different imbalance ratios. The reasonable diagnostic performances confirm the ability of the proposed novel class-imbalanced learning technique in diagnosing bearing defects, independently from the imbalance ratios.

This paper presents a novel supervised clustering technique including different clustering algorithms which cooperate together to span the decision space in a supervised manner. It uses a variety of clustering methods for an efficient partitioning. An evolutionary algorithm is used to tune the key parameters of the cooperative scheme which minimizes an error-based objective function on the training dataset. The proposed supervised scheme is developed for diagnosing faults in the Tennessee Eastman process, which is a standard benchmark for fault detection and diagnosis. Experimental results show that the proposed technique can efficiently diagnose the process faults.

Imputation of missing data is of paramount importance in machine learning and data mining tasks with incomplete data. In this paper, a fuzzy-neighborhood density-based clustering technique is developed for imputation of missing data. The proposed technique makes use of the density measure, in order to group the similar patterns and find the best donors for each incomplete target pattern to impute its missing values. The fuzzy neighborhood membership degrees are adjusted using an invasive weed optimization algorithm. The performance of the proposed imputation technique is evaluated using eight synthetic publicly available datasets with induced missing values and compared with the performance of other existing competitors, k-means imputation, fuzzy c-means imputation and fuzzy c-means with genetic algorithm imputation. Various types of missingness have been induced to each dataset. The attained results show the effectiveness of the proposed missing data imputation technique.

This paper presents a model to extract and select a proper set of features for diagnosing bearing defects in induction motors. An efficient pre-processing of the vibration signals is of paramount importance to provide informative features for the fault classification module. The vibration signals are firstly analyzed by the wavelet packet transform to extract informative frequency domain features. The dimension of the set of extracted features is reduced by resorting to linear discriminant analysis to provide a small-size set of informative features for decision making. The fault classification module contains different classifiers that can learn the features-faults relations and classify multiple bearing defects including ball, inner race and outer race defects of different diameters. Experimental results verify the effectiveness of the proposed technique for diagnosing multiple bearing defects in induction motors.

This paper focuses on the use of different multi-step prediction techniques for long-term prognosis of the Lithium-ion batteries condition. Various inductive algorithms including adaptive neuro-fuzzy inference systems, random forests, and group method of data handling are used along with three strategies for multi-step prediction and prognosis. These prediction strategies including iterative, direct, and DirRec schemes make use of the historical and current data in different manners to forecast the future values of the capacity over a long horizon for estimation of the remaining useful life (RUL) of the Li-ion batteries. These multi-step predictors are trained by means of constant current Li-ion battery datasets. The attained results present the effectiveness of these techniques for the long-term prognosis of the RUL of the batteries. Besides, a statistical analysis of the attained results indicates that the RF predictor outperforms other techniques.

In this paper, a supervised fuzzy-neighborhood density-based clustering approach is proposed for the fault diagnosis of induction motors' bearings. The proposed approach makes use of the labeled data regarding the actual classes of faulty and fault-free cases, in order to train the fuzzy-neighborhood density-based clustering algorithm in a supervised manner, by resorting to an invasive weed optimization algorithm that aims to minimize an error-based objective function. The proposed classifier can properly classify multi-class data with complex and variously shaped decision boundaries among the different classes of faults and the fault-free state, and is robust against noise. This is due mainly to the fact that the classifier is constructed using the fuzzy-neighborhood density based clustering method, which is not sensitive to the geometrical shape of clusters in the feature space.

Handling the missing data is considered as a crucial requirement for the performance of diagnostic systems. In the proposed diagnostic system, the preprocessing module receives sets of residuals generated by a combined set of observers, and feeds the proceeded residuals to a fault classification module. It is necessary for the fault classification module to receive complete feature sets. Multiple missing data imputation techniques have been devised in the preprocessing module to guarantee feeding complete sets of features to the fault classification module. The proposed diagnostic scheme is validated using incomplete batch of residuals for sensor fault diagnosis in a doubly fed induction generator (DFIG) of a wind turbine.

One of the crucial requirements for the practical implementation of empirical diagnostic systems is the capability of handling missing data. This is done by resorting to missing data imputation techniques in a pre-processing module. The pre-processing module is a part of a previously developed diagnostic system which receives batches of residuals generated by a combined set of observers and progressively feeds the processed residuals to a fault classification module that incrementally learns the residuals-faults relations and dynamically classifies the faults including multiple new classes. The proposed method is tested with respect to sensor fault diagnosis of the incomplete scenarios in a doubly fed induction generator (DFIG) of a wind turbine.

Proper detection of unknown patterns plays an important role in diagnosing new classes of faults. This can be done by incremental learning of novel information and updating the diagnostic system by appending newly trained fault classifiers in an ensemble design. We consider a new-class fault detector previously developed by the authors and based on thresholding the normalized weighted average of the outputs (NWAO) of the base classifiers in a multi-classifier diagnostic system. A proper tuning of the thresholds in the NWAO detector is necessary to achieve a satisfactory performance. This is done in this paper by specifically introducing a performance function and optimizing it within the necessary trade-off between new class false alarm and new class missed alarm rates, by means of an Invasive Weed Optimization (IWO) algorithm. The optimal NWAO detector is tested with respect to a set of simulated sensor faults in the doubly-fed induction generator (DFIG) of a wind turbine.