Abstract Anomaly detection provides an effective decision support capability in several real-world domains. One limitation of conventional approaches is their inability to preserve knowledge as models are constantly updated with recent data, leading to catastrophic forgetting. Continual learning approaches overcome this limitation by providing strategies that provide a trade-off between model stability and plasticity. However, to deal with concept-agnostic scenarios, transitions between tasks/concepts must be detected and provided as auxiliary information to the models. While change point detection methods are a natural fit, the most effective ones for complex and evolving data rely on choosing an appropriate distance measure. However, a fundamental knowledge gap in current research stands in how distance measures for change point detection impact models’ ability to adapt and perform over time as new concepts emerge from evolving data. In this paper, we address this issue by proposing a modular approach to identify transitions in concept-agnostic scenarios and investigating how different distances in change detection affect the predictive performance of anomaly detection models in continual learning scenarios. We perform experiments with different continual learning strategies and compare them with concept-incremental scenarios across multiple real-world datasets. Our key results highlight that it is feasible to perform concept-agnostic learning with a small decline in anomaly detection performance compared to concept-incremental. Moreover, this decline can be mitigated with proper selection of the distance measure for change detection. Finally, our results reveal that even moderately accurate identification of changes can lead to competitive anomaly detection performance.

Intrusion Detection System is a strategic analytical tool for the security of organizations and institutions. Among existing approaches, distributed and collaborative intrusion detection approaches are particularly effective since they combine data analysis from multiple sources to provide increased model robustness. Although many state-of-the-art approaches have the ability to adapt to evolving environments and incoming data, they are subject to catastrophic forgetting of past knowledge. At the same time, recent works in lifelong continual anomaly detection showcase the merit of simultaneous adaptation and knowledge retention. However, lifelong methods are thus far limited to the analysis of a single data source and do not provide distributed and collaborative learning capabilities. In this paper, we fill this gap by proposing a novel distributed continual learning intrusion detection framework with collaborative experience replay. The system is built from independent Detection Nodes and a Continual Learning Center. While the nodes are in charge of data selection and intrusion detection, the Continual Learning Center implements a collaborative replay strategy, performs model updates, and broadcasts the most recent model to the nodes. The separation of responsibilities allows for the decomposition of the system into task-oriented services, leading to a modular, flexible, and scalable architecture. An extensive evaluation involving popular network intrusion detection datasets shows the potential of our framework and the improvement in detection performance that can be achieved with the collaborative replay strategy.

Anomaly detection tools present the potential to enhance defense policies and protection against different types of threats, supporting public safety and national security. Lifelong anomaly detection showcases new and challenging scenarios in which models are challenged to automatically adapt to changing conditions without forgetting past knowledge. However, the presence of anomalies in incoming data may significantly impact the robustness of models in such scenarios. Although active learning strategies could be an asset to increase model longevity and robustness, they have never been explored in this context. In this paper, we propose an active lifelong anomaly detection framework for class-incremental scenarios that supports any memory-based experience replay method, any query strategy, and any anomaly detection model. While experience replay allows models to consolidate past knowledge and simultaneously adapt to new knowledge, an active learning module reduces the number of anomalies memorized in the replay buffer. We propose two strategies that automatically identify and remove additional data points that are likely to be anomalies based on the oracle’s feedback. Our experiments on popular host-based and network-based intrusion detection datasets show that our framework can improve the anomaly detection performance of models under low labeling budget constraints.

Change point detection methods offer a crucial ca-pability in modern data analysis tasks characterized by evolving time series data in the form of data streams. Recent interest in lifelong learning showed the importance of acquiring knowledge and identifying new occurring tasks in a continually evolving environment. Although this setting could benefit from a timely identification of changes, existing change point detection methods are unable to recognize recurring tasks, which is a necessary condition in lifelong learning. In this paper, we attempt to fill this gap by proposing LIFEWATCH, a novel Wasserstein-based change point detection approach with memory capable of modeling multiple data distributions in a fully unsupervised manner. Our method does not only detect changes, but discriminates between changes characterized by the appearance of a new task and changes that rather describe a recurring or previously seen task. An extensive experimental evaluation involving a large number of benchmark datasets shows that LIFEWATCH outperforms state-of-the-art methods for change detection while exploiting the characterization of detected changes to correctly identify tasks occurring in complex scenarios characterized by recurrence in lifelong consolidation settings.

Detecting relevant changes in dynamic time series data in a timely manner is crucially important for many data analysis tasks in real-world settings. Change point detection methods have the ability to discover changes in an unsupervised fashion, which represents a desirable property in the analysis of unbounded and unlabeled data streams. However, one limitation of most of the existing approaches is represented by their limited ability to handle multivariate and high-dimensional data, which is frequently observed in modern applications such as traffic flow prediction, human activity recognition, and smart grids monitoring. In this paper, we attempt to fill this gap by proposing WATCH, a novel Wasserstein distance-based change point detection approach that models an initial distribution and monitors its behavior while processing new data points, providing accurate and robust detection of change points in dynamic high-dimensional data. An extensive experimental evaluation involving a large number of benchmark datasets shows that WATCH is capable of accurately identifying change points and outperforming state-of-the-art methods.

Along with the popularization of cloud computing and the increase in responsibilities of mobile devices, there is a need for intrusion detection systems available for working in these two new areas. At the same time, the increase in computational power of mobile devices gives us the possibility to use them to do a part of data preprocessing. Similarly, more complex operations can be executed in the cloud - this concept is known as mobile cloud computing. In this paper, we propose an autoencoder-based intrusion detection system applicable to cloud and mobile environments. The system provides multiple data gathering points, allowing to monitor either fully controlled networks, like virtual networks in the cloud, or mobile devices scattered in different networks. The monitoring process uses both mobile devices and cloud computational power. Gathered network traffic records are sent to a proper intrusion detection node, which executes the detection process. In case of suspicious behavior, an alert of a possible intrusion can be sent to the device owner. The detection process is based on an autoencoder neural network, which brings significant advantages: an anomaly-based approach, training only on benign samples, and a good performance. To improve detection results, we created time-window-based features, and there is also a possibility to share computed statistics between intrusion detection nodes. In the experiments, we construct three models using pure network flows data and time-window-based features. The results show that the autoencoder-based approach can detect with a high performance attacks not known during the training process. We also prove that created derived features have a significant impact on detection results.

The ultimate goal of Mobile Cloud Computing is to allow users of mobile devices to execute their applications and complex numerical tasks on a broad range of cloud services and resources. One of the most challenging problems in the flow of mobile tasks related to remote cloud services is the security of all aspects of communication, service security and the reliability of cloud resources. In this paper, we developed a new security-aware job flow model for mobile computational clouds. In our model, we defined dedicated algorithm models such as the Filtration Algorithm and Prediction Module to generate an optimal secure system architecture for task and data processing and to ensure optimal cloud resource and service utilization. The robust performance of our model has been demonstrated by experimental analysis. Results of the experiments performed show that our flow model significantly enhances the security level of computations compared to a configuration in which computation time is the major criterion for job processing optimization.

Summary In this article, we present an original agent‐based adaptive task scheduling system which optimizes the performance of services in the mobile cloud computing environment using machine learning mechanisms and context information. The system learns how to allocate resources appropriately: how to schedule services/tasks optimally between the mobile device and the cloud. Decisions are made taking into account the context (e.g., network connection type, location, security level). In this study, a supervised learning agent architecture and service selection algorithm are proposed to solve this problem. Adaptation is performed online on a mobile device. To verify the solution proposed, appropriate software has been developed and a series of experiments has been conducted. Results demonstrate that owing to the experience gathered and the learning process performed, the decision module becomes more efficient in assigning the task to either the mobile device or cloud resources. In the face of presented improvements, the security issues inherent in the context of mobile services/applications and cloud computing are further discussed. As threats associated with mobile data offloading are a serious concern, often ruling out the utilization of cloud services, we propose a more security focused approach for our solution, preferably without hindering performance.

In this paper we present an original adaptive task scheduling system, which optimizes the energy consumption of mobile devices using machine learning mechanisms and context information. The system learns how to allocate resources appropriately: how to schedule services/tasks optimally between the device and the cloud, which is especially important in mobile systems. Decisions are made taking the context into account (e.g. network connection type, location, potential time and cost of executing the application or service). In this study, a supervised learning agent architecture and service selection algorithm are proposed to solve this problem. Adaptation is performed online, on a mobile device. Information about the context, task description, the decision made and its results such as power consumption are stored and constitute training data for a supervised learning algorithm, which updates the knowledge used to determine the optimal location for the execution of a given type of task. To verify the solution proposed, appropriate software has been developed and a series of experiments have been conducted. Results show that due to the experience gathered and the learning process performed, the decision module has consequently become more efficient in assigning the task to either the mobile device or cloud resources. In face of presented improvements, the security issues inherent within the context of mobile application and cloud computing are further discussed. As threats associated with mobile data offloading are a serious concern, often preventing the utilization of cloud services, we propose a more security focused approach for our solution, preferably without hindering the performance.

We address the problem of executing tool-using manipulation skills in scenarios where the objects to be used may vary. We assume that point clouds of the tool and target object can be obtained, but no interpretation or further knowledge about these objects is provided. The system must interpret the point clouds and decide how to use the tool to complete a manipulation task with a target object; this means it must adjust motion trajectories appropriately to complete the task. We tackle three everyday manipulations: scraping material from a tool into a container, cutting, and scooping from a container. Our solution encodes these manipulation skills in a generic way, with parameters that can be filled in at run-time via queries to a robot perception module; the perception module abstracts the functional parts of the tool and extracts key parameters that are needed for the task. The approach is evaluated in simulation and with selected examples on a PR2 robot.

In child-robot interaction, the element of trust towards the robot is critical. This is particularly important the first time the child meets the robot, as the trust gained during this interaction can play a decisive role in future interactions. We present an in-the-wild study where Polish kindergartners interacted with a Pepper robot. The videos of this study were analyzed for the issues of trust, anthropomorphization, and reaction to malfunction, with the assumption that the last two factors influence the children's trust towards Pepper. Our results reveal children's interest in the robot performing tasks specific for humans, highlight the importance of the conversation scenario and the need for an extended library of answers provided by the robot about its abilities or origin and show how children tend to provoke the robot.

In this paper we propose a novel reservation plan adaptation system based on machine learning. In the context of cloud auto-scaling, an important issue is the ability to define and use a resource reservation plan, which enables efficient resource scheduling. If necessary, the plan may allocate new resources upon reservation where a sufficient amount of resources is available. Our solution allows the updating of a reservation plan initially prepared by an administrator. It makes it possible to adapt reservation plans one or more weeks ahead. Hence, it allows time for the administrator to analyze the plan and discover potential problems with resource under-provisioning or over-provisioning, which may prevent server overload in the former case and unnecessary expenses in the latter. It also makes it possible to extract and analyze the knowledge learned, which may provide useful information about resource usage characteristics. The proposed solution is tested on OpenStack using real Wikipedia server traffic data. Experimental results demonstrate that machine learning enables an improvement in resource usage.

As the concept of merging the capabilities of mobile devices and cloud computing is becoming increasingly popular, an important question arises: how to optimally schedule services/tasks between the device and the cloud. The main objective of this paper is to investigate the possibilities for using a decision module on mobile devices in order to autonomously optimize the execution of services within the framework of Mobile Cloud Computing while taking context into account. A novel model of the decision module with learning capabilities, service-oriented architecture, and service selection optimization algorithm are proposed to solve this problem. To achieve autonomous, online learning on mobile devices, we apply supervised learning. Information about the context, task description, the decision made and its results such as calculation time or power consumption are stored and form training data for a supervised learning algorithm, which updates the knowledge used by the decision module to determine the optimal place for the execution of a given type of task. To verify the solution proposed, service-oriented mobile processing systems for multimedia file conversion have been developed and series of experiments have been executed. Results show that the decision module has become more efficient in assigning the task to either the mobile device or cloud resources.

In this paper we propose a method of training example generation from agent's experience, which is suitable for sequential sce- narios. The experience consists of the agent's observations and its action records. Examples generated are used by the agent to learn a classifier, which is used to make decisions about its strategy in the following problem instances. The method is tested in a Sovereign environment, which is an economics simulation created to test agent-based learning. Experimental results show that an agent using the proposed methods is able to learn and achieves better results than random and heuristic agents.

Reinforcement learning suffers from inefficiency when the number of potential solutions to be searched is large. This paper describes a method of improving reinforcement learning by applying rule induction in multi-agent systems. Knowledge captured by learned rules is used to reduce search space in reinforcement learning, allowing it to shorten learning time. The method is particularly suitable for agents operating in dynamically changing environments, in which fast response to changes is required. The method has been tested in transportation logistics domain in which agents represent vehicles being routed in a simple road network. Experimental results indicate that in this domain the method performs better than traditional Q-learning, as indicated by statistical comparison.