Graph-level anomaly detection (GLAD), which identifies rare or atypical graphs within a graph set, is crucial for applications such as image analysis, industrial defect inspection and fraud detection. However, existing GLAD approaches typically rely on the in-distribution hypothesis while lacking generalization capability for out-of-distribution (OOD) scenarios (e.g., different graph sizes), which largely limits the application in the real world. For the first time, we formulate the OOD generalization problem for GLAD, where testing graph data exhibit significant distributional shifts from training data. To tackle two common types of distributional shifts, domain generalization and subpopulation shift, we propose the Fine-Grained Subpopulation Graph-Level Anomaly Detection (FGS-GLAD). First, we propose a Graph Information Bottleneck-based Anomaly Detection Module (GIB4AD) that implements graph reverse distillation and graph information bottleneck on the graph to enhance task-relevant feature extraction for domain generalization. Second, We propose a Fine-Grained Subpoulation Inference Module (FGSI) to predict fine-grained subpopulations and focus on critical inter-subpopulation features through a supervised contrastive mechanism. Experiments on seven benchmark datasets and ten baselines demonstrate our model's superiority in handling domain generalization and subpopulation shift.

Existing graph fraud detection (GFD) methods have made remarkable progress with well-labeled training samples. However, in real applications, adequate training data may be unavailable due to the high cost of manual annotation and the scarcity of fraud samples. Therefore, we explore the one-class graph fraud detection task for the first time, which trains the model only on normal data and can detect fraud samples during inference. This task faces two main challenges: heterogeneity discrepancy in different relationships and diverse distribution of the normal data. To address the above challenges, we propose a novel one-class GFD method named OC-GFD. We design a hierarchical message propagation mechanism that learns both global features and local features under different relationships to accurately extract node representations from the GNN model. Subsequently, we integrate our model with an adaptive Gaussian mixture module to capture the diverse distribution of normal samples, enhancing the characterization of subtle differences in normal behavior and improving fraud detection accuracy. Experimental results show that OC-GFD outperforms state-of-the-art graph fraud detection and one-class classification approaches on Yelp and Amazon datasets in the one-class scenario. Code is available at https://github.com/THSS-GAD/OC-GFD.

The Intrusion Detection System (IDS) is an essential component of cybersecurity for Advanced Persistent Threat (APT) defense. A successful APT attack is a series of tactics aimed at achieving specific goals. Due to the versatility of these tactics, IDS must respond to numerous novel and previously unobserved attacks. However, traditional IDS systems are ineffective in defending against unknown attacks, as they assume that training and real data belong to the same distribution. To tackle this problem, we introduce OpenSentinel, which leverages a deep open set recognition method to effectively detect unknown attacks and pinpoint them to specific APT stages. With a specially designed log modeling approach and a neural network model, OpenSentinel generates human-readable reports to characterize attacks and facilitate further analysis for security experts. We validate the detection performance of OpenSentinel in two experimental environments with over 100 scenarios. Qualitative and quantitative results demonstrate that our method achieves an accuracy of over 90% and remains robust when facing real-world attacks. Meanwhile, we developed a benchmark APT attack dataset with well-defined stages named BeATT&CKed, which can be used for future research.

System intrusions, particularly Advanced Persistent Threats (APTs), pose significant threats to enterprises and organizations. Provenance graph-based attack detection and investigation methods are crucial for defending against these intrusions. To detect various attacks, security systems collect comprehensive operating system event data, resulting in massive provenance graphs that increase storage costs and complicate analysis and querying. Efficiently optimizing these provenance graphs has thus become a core issue. However, existing data reduction methods often mistakenly delete critical security information, significantly impacting attack detection and investigation. This paper introduces TeRed, a novel method for reducing provenance graphs based on normal behavior patterns. Our approach employs unit tests to learn the system’s normal behavior patterns, which are then used to streamline the provenance graph. Experiments on five datasets show that our method reduces the provenance graph while preserving all attack-related information. Importantly, it does not compromise attack detection and investigation, showcasing significant advantages over other data reduction techniques.

Reliable and accurate localization awareness is of great importance for the distributed multi-agent system (DMAS). Instead of global information, measurements only between neighbors pose locatability and accuracy challenges for distributed systems, which leads to the development and application of relative localization. In this paper, we put forward a backbone-listener localization scheme for the D-MAS. Agents switch backbone-listener modes through a node selection strategy. Position and orientation angle of agents are jointly estimated by range and angle information fusion. A distributed multidimensional scaling method is proposed for backbone agents to maintain the topology estimation. And listener agents ensure the localization capacity through a least square range and angle fusion algorithm. Extensive simulation and real-world experiments validate that our method achieves decimeter-level accuracy relative localization.

Multi-agent formation as well as obstacle avoid-ance is one of the most actively studied topics in the field of multi-agent systems. Although some classic controllers like model predictive control (MPC) and fuzzy control achieve a certain measure of success, most of them require precise global information which is not accessible in harsh environments. On the other hand, some reinforcement learning (RL) based approaches adopt the leader-follower structure to organize different agents' behaviors, which sacrifices the collaboration between agents thus suffering from bottlenecks in maneuver-ability and robustness. In this paper, we propose a distributed formation and obstacle avoidance method based on multi-agent reinforcement learning (MARL). Agents in our system only utilize local and relative information to make decisions and control themselves distributively, and will reorganize themselves into a new topology quickly in case that any of them is dis-connected. Our method achieves better performance regarding formation error, formation convergence rate and on-par success rate of obstacle avoidance compared with baselines (both classic control methods and another RL-based method). The feasibility of our method is verified by both simulation and hardware implementation with Ackermann-steering vehicles.

This article introduces LinkStream, a liquidity modeling system based on multiple video streams designed and implemented for oilfield. LinkStream combines a variety of technologies to solve several problems in computing power and network latency. First, the system adopts an edge-central architecture and tailoring based on spatio-temporal correlation, which greatly reduces computing power requirements and network costs, and enables real-time analysis of large-scale video stream on limited edge devices. Second, it designed a set of liquidity models to describe the liquidity status in the oilfield. Finally, it uses object tracking technology to design a counting algorithm for the unique tubing object in the oilfield. We have deployed LinkStream in an oilfield in Iraq. LinkStream can perform real-time inference on over 200 video streams with acceptable resource overhead.

We demonstrate a diagnostics platform which integrates an ISFET array and a temperature control loop for isothermal DNA detection. The controller maintains a temperature of 63°C to perform nucleic acid amplification which is detected by the on-chip sensors. The 32×32 ISFET array is first calibrated to cancel trapped charge and then measures the change in the pH of the reaction. The sensor data is sent to a microcontroller and the reaction is monitored in real-time using a MATLAB interface. Experiments confirm a change of 0.9 pH when tested for the presence of RNA associated with the Zika virus.