SEARCH · Engineering Papers

Results for “anomalies”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 109 records · Page 6

All sources NASA NTRS DOE OSTI

NASA NTRS2005

Discovering System Health Anomalies Using Data Mining Techniques

We present a data mining framework for the analysis and discovery of anomalies in high-dimensional time series of sensor measurements that would be found in an Integrated System Health Monitoring system. We specifically treat the problem of discovering anomalous features in the time series that may be indicative of a system anomaly, or in the case of a manned system, an anomaly due to the human. Identification of these anomalies is crucial to building stable, reusable, and cost-efficient systems. The framework consists of an analysis platform and new algorithms that can scale to thousands of sensor streams to discovers temporal anomalies. We discuss the mathematical framework that underlies the system and also describe in detail how this framework is general enough to encompass both discrete and continuous sensor measurements. We also describe a new set of data mining algorithms based on kernel methods and hidden Markov models that allow for the rapid assimilation, analysis, and discovery of system anomalies. We then describe the performance of the system on a real-world problem in the aircraft domain where we analyze the cockpit data from aircraft as well as data from the aircraft propulsion, control, and guidance systems. These data are discrete and continuous sensor measurements and are dealt with seamlessly in order to discover anomalous flights. We conclude with recommendations that describe the tradeoffs in building an integrated scalable platform for robust anomaly detection in ISHM applications.

Sriastava, Ashok, N.↗

NASA NTRS2011

Intercomparison of Recent Anomaly Time-Series of OLR as Observed by CERES and Computed Using AIRS Products

This paper compares recent spatial and temporal anomaly time series of OLR as observed by CERES and computed based on AIRS retrieved surface and atmospheric geophysical parameters over the 7 year time period September 2002 through February 2010. This time period is marked by a substantial decrease of OLR, on the order of +/-0.1 W/sq m/yr, averaged over the globe, and very large spatial variations of changes in OLR in the tropics, with local values ranging from -2.8 W/sq m/yr to +3.1 W/sq m/yr. Global and Tropical OLR both began to decrease significantly at the onset of a strong La Ni a in mid-2007. Late 2009 is characterized by a strong El Ni o, with a corresponding change in sign of both Tropical and Global OLR anomalies. The spatial patterns of the 7 year short term changes in AIRS and CERES OLR have a spatial correlation of 0.97 and slopes of the linear least squares fits of anomaly time series averaged over different spatial regions agree on the order of +/-0.01 W/sq m/yr. This essentially perfect agreement of OLR anomaly time series derived from observations by two different instruments, determined in totally independent and different manners, implies that both sets of results must be highly stable. This agreement also validates the anomaly time series of the AIRS derived products used to compute OLR and furthermore indicates that anomaly time series of AIRS derived products can be used to explain the factors contributing to anomaly time series of OLR.

Susskind, Joel↗

NASA NTRS2011

The Relationship Between El Nino/La Nina Oscillations and Recent Anomaly Time Series of OLR Determined by CERES and AIRS

This paper compares recent spatial anomaly time series of OLR (Outgoing Longwave Radiation) and OLRCLR (Clear Sky OLR) as determined using CERES and AIRS observations over the time period September 2002 through June 2010. We find excellent agreement in OLR anomaly time series of both data sets in almost every detail, down to the 1 x 1 spatial grid point level. This extremely close agreement of OLR anomaly time series derived from observations by two different instruments implies that both sets of results must be highly stable. This agreement also validates to some extent the anomaly time series of the AIRS derived products used in the computation of the AIRS OLR product. The paper then examines anomaly time series of AIRS derived products over the extended time period September 2002 through April 2011. We show that OLR anomalies during this period are closely in phase with those of an El Nino index, and that the recent global and tropical mean decreases in OLR and OLRCLR are a result of a transition from an El Nino condition at the beginning of the data record to La Nina conditions toward the end of the data period. We show that the relationship between global mean, and especially tropical mean, OLR anomalies to the El Nino index can be explained by temporal changes of the distribution of mid-tropospheric water vapor and cloud cover in two spatial regions that are in direct response to El Nino/La Nina activity which occurs outside these spatial regions.

Susskind, Joel↗

NASA NTRS2010

Atmospheric Circulation Anomalies During Two Persistent North American Droughts: 1932-1939 and 1948-1957

We use an early twentieth century (1908-1958) atmospheric reanalysis, based on assimilation of surface and sea level pressure observations, to contrast atmospheric circulation during two periods of persistent drought in North America: 1932-1939 (the Dust Bowl) and 1948-1957. Primary forcing for both droughts is believed to come from anomalous sea surface temperatures (SSTs): a warm Atlantic and a cool eastern tropical Pacific. For boreal winter (October-March) in the 1950s, a stationary wave pattern originating from the tropical Pacific is present, with positive centers over the north Pacific and north Atlantic ocean basins and a negative center positioned over northwest North America and the tropical/subtropical Pacific. This wave train is largely absent for the 1930s drought; boreal winter height anomalies are organized much more zonally, with positive heights extending across northern North America. For boreal summer (April-September) during the 1930s, a strong upper level ridge is centered over the Great Plains; this feature is absent during the 1950s and appears to be linked to a weakening of the Great Plains low-level jet (GPLLJ). Subsidence anomalies are co-located over the centers of each drought: in the central Great Plains for the 1930s and in a band extending from the southwest to the southeastern United States for the 1950s. The location and intensity of this subsidence during the 1948-1957 drought is a typical response to a cold eastern tropical Pacific, but for 1932-1939 deviates in terms of the expected intensity, location, and spatial extent. Overall, circulation anomalies during the 1950s drought appear consistent with the expected response to the observed SST forcing. This is not the case for the 1930s, implying some other causal factor may be needed to explain the Dust Bowl drought anomalies. In addition to SST forcing, the 1930s were also characterized by massive alterations to the land surface, including regional-scale devegetation from crop failures and intensive wind erosion and dust storms. Incorporation of these land surface factors into a general circulation model greatly improves the simulation of precipitation and subsidence anomalies during this drought, relative to simulations with SST forcing alone. Even with additional forcing from the land surface, however, the model still has difficulty reproducing some of the other circulation anomalies, including weakening of the GPLLJ and strengthening of the upper level ridge during AMJJAS. This may be due to either weaknesses in the model or uncertainties in the boundary condition estimates. Still, analysis of the circulation anomalies supports the conclusion of an earlier paper (Cook et al. in Proc Natl Acad Sci 106:4997, 2009), demonstrating that land degradation factors are consistent with the anomalous nature of the Dust Bowl drought.

Cook, Benjamin↗

NASA NTRS2011

Does Terrestrial Drought Explain Global CO2 Flux Anomalies Induced by El Nino?

The El Nino Southern Oscillation is the dominant year-to-year mode of global climate variability. El Nino effects on terrestrial carbon cycling are mediated by associated climate anomalies, primarily drought, influencing fire emissions and biotic net ecosystem exchange (NEE). Here we evaluate whether El Nino produces a consistent response from the global carbon cycle. We apply a novel bottom-up approach to estimating global NEE anomalies based on FLUXNET data using land cover maps and weather reanalysis. We analyze 13 years (1997-2009) of globally gridded observational NEE anomalies derived from eddy covariance flux data, remotely-sensed fire emissions at the monthly time step, and NEE estimated from an atmospheric transport inversion. We evaluate the overall consistency of biospheric response to El Nino and, more generally, the link between global CO2 flux anomalies and El Nino-induced drought. Our findings, which are robust relative to uncertainty in both methods and time-lags in response, indicate that each event has a different spatial signature with only limited spatial coherence in Amazonia, Australia and southern Africa. For most regions, the sign of response changed across El Nino events. Biotic NEE anomalies, across 5 El Nino events, ranged from -1.34 to +0.98 Pg Cyr(exp -1, whereas fire emissions anomalies were generally smaller in magnitude (ranging from -0.49 to +0.53 Pg C yr(exp -1). Overall drought does not appear to impose consistent terrestrial CO2 flux anomalies during El Ninos, finding large variation in globally integrated responses from 11.15 to +0.49 Pg Cyr(exp -1). Despite the significant correlation between the CO2 flux and El Nino indices, we find that El Nino events have, when globally integrated, both enhanced and weakened terrestrial sink strength, with no consistent response across events

Schwalm. C. R.↗

NASA NTRS2018

Determination of Total Magnetic Anomalies and Their Vertical Gradients of Swarm-A Satellite over Central Europe and Pannonian Basin

Our paper discusses the determination of total magnetic field anomalies derived from the Swarm–A satellite data; one of two low orbiting satellites of the three Swarm formations. This procedure requires several modifications. The first step is the conversion of the measured CDF data to the ASCII format. This step is followed by the selection of the data with K(sub p) index ≤ 1(sub +). The anomalies are determined by the removal of the IGRF from the resulting satellite data. There are two Swarm–A data sets: descending (6000) orbits and ascending (5688) orbits. For our study the descending orbits were used. The next step of calculations is to determine the difference of the two-dimensional linear field fitted to the Swarm–A anomalies and the anomalies given. These anomalies are filtered by Gaussian low-pass filter. The last step of the corrections is the removal of the direct component, zero spatial frequency, from the descending anomalies. The anomalies and their vertical gradients are qualitatively interpreted over Central Europe and the Pannonian Basin.

Kis, K.↗

NASA NTRS2019

GRAIL-Identified Gravity Anomalies in Oceanus Procellarum: Insight into Subsurface Impact and Magmatic Structures on the Moon

Four, quasi-circular, positive Bouguer gravity anomalies (PBGAs) that are similar in diameter (~90-190 km) and gravitational amplitude (> 140 mGal contrast) are identified within the central Oceanus Procellarum region of the Moon. These spatially associated PBGAs are located south of Aristarchus Plateau, north of Flamsteed crater, and two are within the Marius Hills volcanic complex (north and south). Each is characterized by distinct surface geologic features suggestive of ancient impact craters and/or volcanic/plutonic activity. Here, we combine geologic analyses with forward modeling of high-resolution gravity data from the Gravity Recovery and Interior Laboratory (GRAIL) mission in order to constrain the subsurface structures that contribute to these four PBGAs. The GRAIL data presented here, at spherical harmonic degrees 6–660, permit higher resolution analyses of these anomalies than previously reported, and reveal new information about subsurface structures. Specifically, we find that the amplitudes of the four PBGAs cannot be explained solely by mare-flooded craters, as suggested in previous work; an additional density contrast is required to explain the high-amplitude of the PBGAs. For Northern Flamsteed (190 km diameter), the additional density contrast may be provided by impact-related mantle uplift. If the local crust has a density ~2800 kg/cu.m, then ~7 km of uplift is required for this anomaly, although less uplift is required if the local crust has a lower mean density of ~2500 kg/cu.m. For the Northern and Southern Marius Hills anomalies, the additional density contrast is consistent with the presence of a crustal complex of vertical dikes that occupies up to ~50% of the regionally thin crust. The structure of Southern Aristarchus Plateau (90 km diameter), an anomaly with crater-related topographic structures, remains ambiguous. Based on the relatively small size of the anomaly, we do not favor mantle uplift; however, understanding mantle response in a region of especially thin crust needs to be better resolved. It is more likely that this anomaly is due to subsurface magmatic material given the abundance of volcanic material in the surrounding region. Overall, the four PBGAs analyzed here are important in understanding the impact and volcanic/plutonic history of the Moon, specifically in a region of thin crust and elevated temperatures characteristic of the Procellarum KREEP Terrane.

Deutsch, Ariel N.↗

NASA NTRS2020

MSL Telecom Automated Anomaly Detection

The Mars Science Laboratory (MSL) Telecom Operations Team at the Jet Propulsion Laboratory (JPL) has implemented a machine learning system in order to automate the anomaly detection process as a part of daily operations. Machine learning enables reliable detection of anomalies in Telecom-related telemetry and automated reporting of Telecom subsystem status, resulting in an 90% reduction in team workload and improved anomaly detection reliability. At present, machine learning methods are used to detect: 1. Anomalous long-term trends in telemetry data 2. Anomalous time-domain evolution of telemetry values Both types of anomalies pose their own unique challenges that are addressed in different ways. In the first case, long term trending of daily minima, maximum, and mean telemetry values in temperatures, currents, voltages, and radio frequency (RF) power levels is used in addition to hard threshold safety checks to look for changes in long-term equipment health and performance. Long-term trending methods allow for ordinary seasonal variations in these quantities caused by temperature changes over the course of the Martian year while allowing operators to determine whether current performance remains in line with historical values from previous years. Changes in long-term trends can provide important insights into the health and status of the rover's on-board systems as well as valuable early warning if subtle degradation begins to take hold. But while trending of daily statistics is valuable, it does not detect anomalies in the short-term time evolution of data over the course of minutes or hours during a day, and this task is handled with short-term shape analysis. Principal components analysis (PCA) has been found to provide robust detection of short-term anomalies, and several examples of the use of PCA to detect actual anomalous events will be provided here. In using PCA, we use both the percentage of explained variance and also a log likelihood test on the PCA expansion coefficients to flag telemetry data for human review. Previous work in the field of spacecraft anomaly detection includes [1] for MSL and [2] for some other JPL missions.

Mukai, Ryan↗

NASA NTRSDate not supplied

Air Data Probe Anomalies in Flight through Measured High Ice Water Content Conditions

High concentrations of ice crystals in convective storms have caused anomalous air temperature and airspeed readings during commercial and research flight operations. These anomalies occur when ice crystals are ingested in the heated probe inlet, melt or partially melt to liquid water, and then refreeze or remain in a liquid state depending on the probe heat and cloud conditions. In pitot probes, the refreezing may cause complete blockage of the total pressure, which causes airspeed anomalies. In total air temperature probes, the melted ice water may flow near the temperature sensing element and cause the total air temperature reading to approach 0 degree Celsius. During the High Ice Water Content (HIWC) RADAR and HIWC-2022 flight campaigns and the Convective Process Experiment (CPEX-CV) flight campaign, a total of 71 anomalies were recorded on the NASA DC-8 pitot probes when subjected to specific flight and cloud conditions. Similarly, a research TAT probe mounted near the pitot probes had 19 anomalies. This paper presents analyses of the measured natural conditions that led to these TAT and pitot anomalies, identifies two types of pitot probe anomalies, applies a concentration factor to estimate local TWC conditions near the TAT and pitot probes, and identifies the static air temperature and pressure altitude where the anomalies occurred on the Part 33 Appendix D envelope.

Aircraft Icing↗

NASA NTRSDate not supplied

Air Data Probe Anomalies in Flight through Measured High Ice Water Content Conditions

Aircraft Icing↗

DOE OSTI2024

Efficient Anomaly Detection Driven By Different Machine Learning Architectures And Models

The rapid growth and ubiquitous adoption of the internet and cyber-physical systems (CPS) have fundamentally transformed modern communication, work, and human-system interactions. While networks now form the backbone of critical digital ecosystems, enabling seamless data transmission across diverse, interconnected systems, this increased connectivity also expands the attack surface, making real-time detection of network intrusions and anomalies a pressing challenge. Detecting unusual activities within network infrastructure requires advanced data traffic analysis to differentiate between legitimate and malicious interactions. Traditional approaches to network anomaly detectionâ??such as rule-based and signature-based systemsâ??often depend on predefined patterns to identify known anomalies, limiting their effectiveness against emerging, stealthy, or previously unseen threats. These conventional methods suffer from high false alarm rates and fail to adapt to the ever-evolving nature of network traffic, particularly in large-scale, decentralized environments where data volume, velocity, and variety are constantly increasing. This dissertation presents artificial intelligence (AI)-driven approaches to anomaly detection that leverage graphics processing unit (GPU)-enabled high-performance computing (HPC) platforms for processing massive network traffic data and monitoring the components of cyber-physical systems (CPS) for potentially hazardous conditions. The research advances several key contributions: (1) Designing efficient machine learning techniques for CPS condition monitoring and anomaly detection; (2) enabling federated learning (FL) frameworks that enable distributed detection while preserving data privacy and system resilience; (3) exploring graph-based methodologies combining graph neural networks (GNN) and graph machine learning (ML) approaches for the Internet of Things (IoT) and automotive network security, and (4) performing distributed edge computing optimizations that integrate FL with scalable technologies for reduced communication overhead. Through extensive experiments, these methodologies demonstrate that complex anomaly detection and condition monitoring tasks can be achieved while balancing computational efficiency and detection accuracy through fine-grained network information processing. The frameworks developed in this research establish a robust foundation for network anomaly detection, providing scalable, adaptive, and privacy-preserving solutions for safeguarding CPS and IoT networks in an increasingly interconnected digital landscape. The practical implications of these research findings are significant, as they can inform the development of next-generation network security systems and contribute to the protection of critical infrastructure against sophisticated cyber attacks.

Marfo, William↗

DOE OSTI2022

CONGO²: Scalable Online Anomaly Detection and Localization in Power Electronics Networks

Rapid and accurate detection and localization of electronic disturbances simultaneously are important for preventing its potential damages and determining potential remedies. Existing anomaly detection methods are severely limited by the low accuracy, the expensive computational cost and the need for highly trained personnel. There is an urgent need for a scalable online algorithm for in-field analysis of large-scale power electronics networks. Here in this paper, we propose a fast and accurate algorithm for anomaly detection and localization of power electronics networks: stratified colored-node graph (CONGO2). This algorithm hierarchically models the change of correlated waveforms and then correlated sensors using the colored-node graph. By aggregating the change of each sensor with its neighbors’ inputs, we can spontaneously identify and localize the anomaly that cannot be detected by data collected from a single sensor. As our proposed method only focuses on the changes within a short time frame, it is highly computational efficient and only needs small data storage. Thus, our method is ideal for online and reliable anomaly detection and localization of large-scale power electronic networks. Compared to existing anomaly detection methods, our method is entirely data-driven without training data, highly accurate and reliable for wide-spectrum anomalies detection, and more importantly, capable of both detection and localization. Thus, it is ideal for infield deployment for large-scale power electronic networks. As illustrated by a distributed energy resources (DERs) power grid with 37-node, our method can effectively detect and localize various cyber and physical attacks.

42 ENGINEERING↗

DOE OSTI2022

Capsule network-based semantic segmentation model for thermal anomaly identification on building envelopes

Thermography technology is widely used to inspect thermal anomalies in building façade systems. Computer vision-based techniques provide opportunities to autonomously detect such heat anomalies to significantly improve the efficiency of decision-making for building envelope retrofitting and maintenance. Here, in this work, we propose a novel Capsule Network-based deep learning model – CapsLab – that detects and identifies thermal anomalies by semantic segmentation. CapsLab is built based on our proposed prediction-tuning capsule (PT-Capsule) layer. Different from a traditional capsule layer, which consists of part-whole transformation and capsule-routing process, the proposed layer is composed of a prediction and tuning process, which helps decreasing the number of model parameters significantly. While the applicability of traditional Capsule Networks (CapsNets) has been limited to simpler tasks and smaller datasets due to their scalability issue, we can leverage the lightweight of the proposed PT-Capsule layer, and apply it to the semantic segmentation task. In this work, we also employ our previously presented performance metric, referred to as the Anomaly Identification Metric (AIM) (Kakillioglua et al. 2021), to evaluate the segmentation outputs. Traditional performance metrics do not accurately reflect the true performance of the segmentation models in thermal anomaly identification due to the high subjectivity in the annotation process and higher overlap ratio sensitivity of the standard metrics. AIM, on the other hand, is robust to these drawbacks. Experimental results show, both qualitatively and quantitatively, that our proposed segmentation method can effectively segment the thermal anomalies. Specifically, our model provides 9.38% and 13.53% improvements over the baseline model – DeepLabV3+ – based on traditional mIoU score and the AIM score, respectively, while requiring less model parameters and less computation at the same time. In addition, the scores that the AIM metric generates better align with the scores provided by building performance experts.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

DOE OSTI2021

The value of human data annotation for machine learning based anomaly detection in environmental systems

Anomaly detection is the process of identifying unexpected data samples in datasets. Automated anomaly detection is either performed using supervised machine learning models, which require a labelled dataset for their calibration, or unsupervised models, which do not require labels. While academic research has produced a vast array of tools and machine learning models for automated anomaly detection, the research community focused on environmental systems still lacks a comparative analysis that is simultaneously comprehensive, objective, and systematic. This knowledge gap is addressed for the first time in this study, where 15 different supervised and unsupervised anomaly detection models are evaluated on 5 different environmental datasets from engineered and natural aquatic systems. To this end, anomaly detection performance, labelling efforts, as well as the impact of model and algorithm tuning are taken into account. As a result, our analysis reveals the relative strengths and weaknesses of the different approaches in an objective manner without bias for any particular paradigm in machine learning. Most importantly, our results show that expert-based data annotation is extremely valuable for anomaly detection based on machine learning.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2025

Monte Carlo Dropout Uncertainty Quantification of Long Short-Term Memory Autoencoder Anomaly Detection in a Liquid Sodium Cold Trap

Advanced high-temperature fluid reactors, such as sodium-cooled fast reactors (SFRs) and molten salt–cooled reactors (MSCRs), require coolant purification systems to prevent fluid contamination and local freezing that can lead to plugging. Liquid sodium purification can be achieved with a cold trap, where the sodium temperature is reduced to a near-freezing point to precipitate out impurities. Automation of monitoring of the cold trap performance with machine learning algorithms can aid in early detection of incipient anomalies. An efficient approach to loss-of-coolant–type anomaly detection in a cold trap monitored with more than two dozen thermal-hydraulic sensors consists of a long short-term memory (LSTM) autoencoder. This work develops the uncertainty quantification of the LSTM autoencoder performance for cold trap anomaly detection using the Monte Carlo (MC) dropout method. The MC dropout methodology creates a distribution of sister distributions that all slightly differ from each other because of random neurons being turned off for testing. The variances of the sister network distributions are used to make an uncertainty interval. Our analysis shows that the uncertainty in the autoencoder performance is largest near the peak of the anomaly signal. Using the MC dropout method, we investigate the uncertainty in the anomaly detection with missing sensor inputs. This capability allows the reactor operator to evaluate resilience of the anomaly detection system and to make informed decisions about continuity of operation in the event of sensor failure.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2026

Platform for Automated Anomaly Detection in the Mercury Process System at the Target System in the Spallation Neutron Source

The Spallation Neutron Source (SNS) at Oak Ridge National Laboratory accelerates proton beams, which are directed toward a mercury target to generate the world’s most intense neutron beams via spallation. The target system consists of several interconnected subsystems and accounts for a major share of the facility’s overall downtime. Early detection of anomalies in the target system response can thus provide the possibility of taking corrective actions to reduce downtime. Accelerator facilities have largely focused on the beam side for data-driven fault prognostics. On the target side, SNS relies on operational shift technicians (OSTs), who respond to alarms and manually flag anomalies onto the System Tracking and Reliability (STAR) platform. This paper presents one of the first studies of using machine learning (ML) to automate anomaly detection in the target system. The study focused on the mercury process system as the first use case and employed reconstruction-based anomaly detection on minutely sampled time series signals. The pipeline was integrated into the STAR platform to autonomously rank and flag anomalies every week. The STAR platform provides a user interface for the OSTs to evaluate the flagged anomalies, thereby incorporating human feedback.

Anomaly detection↗

DOE OSTI2021

Annual Solar Irradiance Anomaly Features Over the USA During 1998-2017 Using NSRDB V3

Annual solar irradiance anomalies (or departures from the long-term mean annual value) have a direct impact on various phases of solar energy projects, from prefeasibility studies to technical deployment decisions. Anomalies can happen because of normal climate variability or exceptional weather patterns. This study investigates such anomalies for both global horizontal irradiance (GHI) and direct normal irradiance (DNI) using Version 3 of the National Solar Radiation Database (NSRDB V3) and surface irradiance measurements at eight U.S. locations. At each site, the annual anomaly is analyzed here by evaluating the irradiance deviation from the long-term average for each specific year from 1998–2017. A positive/negative anomaly indicates that the solar resource was higher/lower than the long-term average during that specific year. The results show that in most cases the anomaly is within ±5% for GHI and ±10% for DNI using either ground-based irradiance measurements or modeled data from the NSRDB.

41 EE - Solar Energy Technologies Office (EE-4S)↗

DOE OSTI2023

RX-ADS: Interpretable Anomaly Detection Using Adversarial ML for Electric Vehicle CAN Data

Recent year has brought considerable advancements in Electric Vehicles (EVs) and associated infrastructures/ communications. Intrusion Detection Systems (IDS) are widely deployed for anomaly detection in such critical infrastructures. This paper presents an Interpretable Anomaly Detection System (RX-ADS) for intrusion detection in CAN protocol communication in EVs. Contributions include: 1) window based feature extraction method; 2) deep Autoencoder based anomaly detection method; and 3) adversarial machine learning based explanation generation methodology. The presented approach was tested on two benchmark CAN datasets: OTIDS and Car Hacking. The anomaly detection performance of RX-ADS was compared against the state-of-the-art approaches on these datasets: HIDS and GIDS. The RX-ADS approach presented performance comparable to the HIDS approach (OTIDS dataset) and has outperformed HIDS and GIDS approaches (Car Hacking dataset). Further, the proposed approach was able to generate explanations for detected abnormal behaviors arising from various intrusions. Furthermore, these explanations were later validated by information used by domain experts to detect anomalies. Other advantages of RX-ADS include: 1) the method can be trained on unlabeled data; 2) explanations help experts in understanding anomalies and root course analysis, and also help with AI model debugging and diagnostics, ultimately improving user trust in AI systems.

42 ENGINEERING↗