Library · Machine learning & AI

What Anomaly Detection got wrong, from 56 theses

Summary written by a model from the records below: The records document numerous failure points across anomaly detection pipelines, ranging from reconstruction models overfitting nominal data to statistical residual detectors failing against stealthy manipulation. Practitioners repeatedly encountered high false alarm rates under noisy baseline conditions, degradation caused by training contamination or feature compression, and poor generalization across unseen operational environments. These records come from graduate theses, 2021 to 2026, each labeled with its degree where the repository states it, and each links to its thesis. They were extracted by language models reading the full text, so treat each as a lead to read, not a verdict.

56
theses
20
institutions
67
failure records
7
failure modes

Plus 9 problems the authors left open, listed at the end.

Failure modes, by theses reporting them

Select a mode to jump to its records.

Generative and reconstruction models fail to separate anomalies from normal patterns
17
17 theses · 9 institutions · 19 records
Benign environmental noise and nominal fluctuations trigger excessive false alarms
11
11 theses · 9 institutions · 11 records
Contaminated baselines, label scarcity, and synthetic training impair model supervision
11
11 theses · 9 institutions · 12 records
Stealthy attacks and historical replays bypass residual thresholds
7
7 theses · 5 institutions · 8 records
Models fail to generalize across unseen anomaly types and operational shifts
6
6 theses · 4 institutions · 6 records
Rigid heuristics and simplistic decision rules degrade anomaly discrimination
6
6 theses · 4 institutions · 6 records
Dimensionality reduction and feature compression discard critical anomaly signatures
5
5 theses · 5 institutions · 5 records

Generative and reconstruction models fail to separate anomalies from normal patterns

17 theses · 9 institutions

Deep autoencoders and generative architectures frequently over-smooth outlier values, overfit nominal training data, or learn to reconstruct anomalies when anomalous samples concentrate near the nominal distribution mean. Consequently, these complex neural architectures often underperform simpler baselines such as Isolation Forests and Random Forests while suffering from training instability or artifact generation.

Tried and failed

reconstruction and one-class anomaly detection methods applied to time-series sensor anomaly detection. Outcome: no signal. Reason: anomalies overlapped with nominal distribution support or concentrated near the nominal mean

A Deep Learning Approach to State Estimation and Bad Data Detection · Cornell · PhD

Tried and failed

imposing latent space regularisation constraints applied to out-of-distribution detection via reconstruction error. Outcome: worse than baseline. Reason: latent constraints degrade reconstruction fidelity compared to unconstrained autoencoders, reducing anomaly detection discriminability

Learning Representations Toward the Understanding of Out-of-Distribution for Neural Networks · Georgia Tech · PhD

Tried and failed

non-linear autoencoders for dimensionality reduction applied to unsupervised anomaly detection. Outcome: worse than baseline. Reason: non-regularized non-linear dimensionality reduction degraded performance compared to linear methods like PCA

On the Effectiveness of Dimensionality Reduction for Unsupervised Structural Health Monitoring Anomaly Detection · Virginia Tech · Master's

Tried and failed

analytic KL-divergence instead of latent adversarial training applied to unsupervised visual anomaly detection. Outcome: worse than baseline. Reason: analytic KL approximation degraded representation quality compared to adversarial latent matching for anomaly scoring

Exploring variability in medical imaging · Imperial · PhD

Tried and failed

L2 regularization on autoencoder dimensionality reduction applied to unsupervised anomaly detection. Reason: higher regularization penalties caused underfitting and unpredictable performance degradation

On the Effectiveness of Dimensionality Reduction for Unsupervised Structural Health Monitoring Anomaly Detection · Virginia Tech · Master's

Tried and failed

deep out-of-distribution detection models applied to tabular anomaly detection. Outcome: worse than baseline. Reason: deep VAE and density-based models underperformed simple Isolation Forest on engineered tabular features

Optimising data collection strategies in cyber security to address bias · Imperial · PhD

Tried and failed

deep autoencoding Gaussian mixture model applied to time series anomaly detection. Outcome: worse than baseline. Reason: achieved poor F1 scores on standard benchmarks using high anomaly score thresholds

Wavelet probabilistic neural networks for temporal data analysis · Imperial · PhD

Tried and failed

mimicry attacks via benign pattern insertion applied to autoencoder anomaly detection evasion. Outcome: worse than baseline. Reason: inserting benign operations increased reconstruction error, making anomalous samples stand out more rather than hiding them

Improving the Understanding of Malware using Machine Learning · Georgia Tech · PhD

Tried and failed

reconstruction-based neural autoencoders applied to time series anomaly detection. Outcome: did not generalise. Reason: models over-smoothed extreme values or erroneously fit out-of-range outlier points

Machine Learning Systems for Unsupervised Time Series Anomaly Detection · MIT · PhD

Tried and failed

variational auto-encoders for counterfactual generation applied to anomaly repair and explanation. Outcome: worse than baseline. Reason: struggled to generate high-quality repairs compared to diffusion models

Reliable Anomaly Detection with Explanation and Feedback · Penn · PhD

Tried and failed

variational autoencoder anomaly detection applied to semiconductor fabrication process monitoring. Outcome: overfit. Reason: overfitting on nominal training data caused high reconstruction error on unseen nominal runs, degrading classification

Applications of Probabilistic Machine Learning Models to Semiconductor Fabrication · MIT · PhD

Tried and failed

batch normalization applied to autoencoder anomaly detection. Reason: did not improve anomaly detection performance during model development

Developing AI Systems for Monitoring Heterogeneous Mental Health Disorders · Cornell · PhD

Lost to a baseline

Random Forest beat Autoencoders on pointwise anomaly detection accuracy (RF: 0.963 vs AE: 0.937) and F1-score (RF: 0.967 vs AE: 0.953)

An AI and data-driven approach to unwanted network traffic inspection · Politecnico di Torino · PhD

Lost to a baseline

VAE + DoSE (AUROC 0.698) and One-Class SVM (AUROC 0.605) lost to baseline Isolation Forest (AUROC 0.850) on anomaly detection.

Optimising data collection strategies in cyber security to address bias · Imperial · PhD

Lost to a baseline

On MVTec AD anomaly detection, standard DeepSVDD achieved 72.2% AUC and DROCC achieved 74.5% AUC, beating the generative baseline AnoGAN (50.3% AUC).

Few Shot Anomaly Detection and Segmentation in Medical Imaging · University College Dublin · PhD

Considered and rejected

Considered and rejected: Rejected relying solely on reconstruction error for point anomaly detection, requiring variational auto-encoders with regularized latent spaces instead.

Topics of deep learning in security and compression · Boston University · PhD

Tried and failed

generative image-to-image translation for anomaly detection applied to medical imaging lesion detection. Reason: over-correction at normal anatomical boundaries and vessels generated false-positive artifact hotspots in anomaly maps

HYBRID INTELLIGENCE FRAMEWORK FOR PATHOLOGICAL LIVER SEGMENTATION AND LESION DETECTION IN DIAGNOSTIC CT IMAGING · Penn · PhD

Tried and failed

MLP-based variational autoencoder applied to cross-dataset structural anomaly detection. Outcome: did not generalise. Reason: model overfitted to source structure distributions and failed on unseen structural data

Machine learning tools for identifying structural artifacts in data · Imperial · Master's

Tried and failed

fast anomaly GAN for anomaly detection applied to network intrusion detection. Outcome: unstable. Reason: large instability between benign and anomaly detection F1 scores across datasets

Detecting Irregular Network Activity with Adversarial Learning and Expert Feedback · Virginia Tech · Master's

Benign environmental noise and nominal fluctuations trigger excessive false alarms

11 theses · 9 institutions

Detectors applied to operational technology and physical measurements often produce high rates of false positives because nominal variations and background noise mimic attack signatures. Strict fixed thresholds and standard normality assumptions fail in operational environments, forcing practitioners to reject complex models in favor of methods that avoid alarming on nominal states.

Tried and failed

missing signal anomaly detection applied to industrial control system anomaly detection. Reason: monitoring missing signals alone caused high false positives without adjusting detection thresholds

Detection and Forensic Analysis of Modern ICS Attacks Via Correlating Scada Host Operations with Physical Behavior · Georgia Tech · PhD

Tried and failed

performance counter machine learning anomaly detection applied to microarchitectural attack detection. Outcome: did not generalise. Reason: high false positive rates on benign workloads structurally mimicking attack patterns

Towards microarchitectural side-channel security for modern applications—a case for many-domain processors · UT Austin · PhD

Tried and failed

hidden Markov model for anomaly detection applied to combustion instability detection. Outcome: did not generalise. Reason: excessive false positive rate classifying normal conditions as anomalies

Trustworthy deep learning for cyber-physical systems · Iowa State · PhD

Tried and failed

support vector machine for anomaly detection applied to multivariate time series fault diagnosis. Reason: produced false positives under nominal operating conditions, incorrectly triggering mitigation procedures

A Methodology for the Selection and Integration of Self-Healing Architectures in Human Habitation Design · Georgia Tech · PhD

Tried and failed

low statistical threshold anomaly detection applied to sediment core grain size anomalies. Outcome: no signal. Reason: background signal noise caused false positive anomaly detections at lower standard deviation thresholds

Environmental Drivers of Coastal Evolution · MIT · PhD

Considered and rejected

Considered and rejected: Rejected machine learning / anomaly-based IDS due to high false-positive rates in operational technology environments.

Design, implementation, and field-testing of distributed intrusion detection system for smart grid SCADA network · Iowa State · Master's

Considered and rejected

Considered and rejected: Rejected standalone ESN and deep neural architectures due to lack of interpretability, inability to enforce hard logical constraints, and high false positive rates in anomaly detection.

Enhancing Logical Reasoning and Temporal Dynamics in Complex Systems through Hybrid Logical Neural and Echo State Networks · University of Nevada, Reno · Doctorate

Considered and rejected

Considered and rejected: Rejected k-means clustering for constellation anomaly detection because it forces fixed k clusters, leading to false positives when no anomaly exists.

Design of a Co-Orbital Threat Identification System · Virginia Tech · Master's

Considered and rejected

Considered and rejected: Rejected standard Gaussian prediction intervals for time series anomaly scoring because network connection data regularly violates normality assumptions, yielding overly wide and uninformative intervals.

Temporally adaptive monitoring procedures with applications in enterprise cyber-security · Imperial · PhD

Considered and rejected

Considered and rejected: Rejected manual thresholding of roll rate (omega_x) crossings for anomaly side classification due to susceptibility to sensor noise and overfitting to specific anomaly shapes.

Autonomous Ground Vehicle Guidance and Mapping in Challenging Terrains by using On-Board Vibration Measurements · Queen's University · Master's

Tried and failed

isolation forest on noisy time series features applied to physiological anomaly detection. Outcome: did not generalise. Reason: unacceptable false alarm rates when applied to noisier real-world dataset

Self-Aware Machine Learning for Chronic Pathology Monitoring on Wearable Devices · EPFL · PhD

Contaminated baselines, label scarcity, and synthetic training impair model supervision

11 theses · 9 institutions

Supervised and semi-supervised anomaly detectors struggle when ground-truth labels are scarce, highly imbalanced, or corrupted by pre-existing anomalous observations. Models trained on synthetic anomalies or unregularized batches overfit the reference distribution and fail to establish reliable decision boundaries for real-world anomalies.

Tried and failed

supervised classification on compromised account labels applied to authentication log anomaly detection. Reason: classifiers yielded poor precision due to noisy or imperfect ground-truth attack labels

Characterizing and Detecting Password Guessing Attacks · Cornell · PhD

Tried and failed

augmenting training set sampling dynamically applied to multivariate statistical process control anomaly detection. Outcome: worse than baseline. Reason: training set corruption by undetected false-negative observations

Automated monitoring of test-taking behavior in online assessments · UT Austin · PhD

Tried and failed

autoregressive anomaly detection with contaminated training data applied to hydraulic sewer surcharge detection. Outcome: did not generalise. Reason: fitting the model on baseline data containing pre-existing anomalies causes high false positive rates

Sensor-driven flood risk monitoring in levee-protected floodplains and urban storm sewer networks · Cornell · PhD

Considered and rejected

Considered and rejected: Rejected supervised anomaly detection methods (logistic regression, kNN, SVM) due to inability to generalize to unseen anomaly types and lack of labeled data

Toward an Automated Real-Time Anomaly Detection Engine in Microservice Architectures · Carleton University · Master's

Considered and rejected

Considered and rejected: Rejected fully supervised anomaly detection for cross-domain and medical imaging tasks due to extreme class imbalance and lack of exhaustive anomaly labels.

Robust and Cross-Domain Anomaly Detection and Mitigation · University of Nevada, Reno · Doctorate

Considered and rejected

Considered and rejected: Rejected machine learning (ML) / deep learning approaches for in-situ anomaly detection due to lack of explainability, need for massive human-tagged training sets, and certification standard barriers (Fixed Process Control).

Multi-Scale Materials Characterization and Analysis of In-Situ Process Monitoring Data towards enabling Multivariate Statistical Process Control in Laser Powder Bed Fusion Metal Additive Manufacturing · Georgia Tech · PhD

Tried and failed

deep overparameterized classification on synthetic anomalies applied to unsupervised anomaly detection. Outcome: did not generalise. Reason: achieved zero training loss while overfitting to the synthetic reference distribution rather than learning true density boundaries

Statistical Learning Theory of Deep Neural Networks: A Generalization Viewpoint · Georgia Tech · PhD

Tried and failed

training density estimators without instance noise regularization applied to tabular categorical anomaly detection. Outcome: overfit. Reason: omitting instance noise achieved lower training loss but degraded test generalization

A Framework for Automated Discovery and Analysis of Suspicious Trade Records · Virginia Tech · Doctorate

Tried and failed

training temporary autoencoders on small shifted batches applied to continual anomaly detection under distribution shift. Outcome: overfit. Reason: training standalone models solely on small drifted batches led to severe overfitting and poor generalization

Mitigating distribution shift and label noise in deep neural network based network intrusion detection systems · Imperial · PhD

Considered and rejected

Considered and rejected: Avoided training custom segmentation networks for industrial anomaly detection because anomalies are unlabelled and not predefined.

Neuro-Symbolic Integration in Artificial Intelligence and its Applications · Politecnico di Torino · PhD

Considered and rejected

Considered and rejected: Rejected data augmentation for industrial anomaly detection due to risks of overfitting and need for complex augmentation strategies.

Neuro-Symbolic Integration in Artificial Intelligence and its Applications · Politecnico di Torino · PhD

Tried and failed

supervised data-driven predictive maintenance applied to basic single-asset anomaly detection. Outcome: data insufficient. Reason: insufficient historical labelled failure data for training supervised models

Investigation on Predictive Maintenance Implementation Cost-Efficiency · Cranfield · PhD

Stealthy attacks and historical replays bypass residual thresholds

7 theses · 5 institutions

Intelligently designed cyber-physical attacks modulate input magnitudes to keep state residuals within nominal accumulation and chi-squared thresholds. As a result, residual monitoring fails to detect stealthy false-data injections and time-delay replay attacks before physical impacts occur.

Tried and failed

CUSUM stateful residual anomaly detection applied to stealthy false data injection attacks. Reason: Simulation-backed stealthy injection attacks bypassed residual accumulation thresholds, yielding extremely high false negative rates.

Achieving Security and Reliability of Industrial Control Systems Using Data-Driven Models Informed by Physical Domain Knowledge · Georgia Tech · PhD

Tried and failed

residual-based statistical anomaly detection for ramp attacks applied to cyber-attack detection in physical systems. Reason: increasing attack magnitude made anomalies trivially detectable over time compared to subtle bias attacks

Cyber Security of Grid-Scale Battery Energy Storage Systems using Battery Modeling and Statistical Methods · Texas Tech · PhD

Considered and rejected

Considered and rejected: Rejected 3-sigma threshold rule commonly used in time-series anomaly detection because non-IID data heterogeneity makes reconstruction errors wider, allowing malicious updates to slip through.

Anomaly Detection and Attack Mitigation in Federated Learning · York University · Master's

Tried and failed

static threshold-based anomaly detection applied to detecting intermittent Byzantine adversaries in networks. Outcome: did not generalise. Reason: Adversaries dynamically modulate attack rates to remain undetected below fixed detection thresholds.

Trust-Based Algorithms for Resilient Multi-Agent Systems · Harvard · PhD

Tried and failed

autoregressive recurrent neural network anomaly detection applied to cyber-physical sensor measurements. Outcome: did not generalise. Reason: Failed to detect attacks before physical impact and was bypassed by valid replayed historical measurements

AI-based Detection Against Cyberattacks in Cyber-Physical Distribution Systems · Virginia Tech · Doctorate

Tried and failed

chi-squared anomaly detection on innovation signals applied to cyber-physical input injection detection. Outcome: no signal. Reason: Intelligently designed malicious inputs bypassed innovation-based chi-squared thresholding without triggering detection.

Architectures for Hardening Security in Intelligent Cyber-physical Systems · Georgia Tech · PhD

Tried and failed

residual-based chi-squared anomaly detection applied to cyber-physical state estimation under false-data injection. Reason: model-informed stealthy false-data injection attacks construct perturbations that lie within expected residual thresholds

Cyber Security of Grid-Scale Battery Energy Storage Systems using Battery Modeling and Statistical Methods · Texas Tech · PhD

Tried and failed

parametric hypothesis tests on cross-sensor residual statistics applied to time-delay replay anomaly detection. Outcome: no signal. Reason: residual variance remained within nominal thresholds despite significant time delay between paired signals

Accelerometer Aided GNSS Spoofing Detection Using Wavelet Based Time-Frequency Analysis · Virginia Tech · Master's

Models fail to generalize across unseen anomaly types and operational shifts

6 theses · 4 institutions

Classifiers and unsupervised detectors experience performance collapse when encountering unseen attack types, varied operational modes, or dynamic adversaries. Shifting operational distributions, short interaction traces, and collusion degrade detector discrimination down to random chance levels.

Tried and failed

shallow unsupervised anomaly detection algorithms applied to subtle network traffic anomaly detection. Outcome: no signal. Reason: algorithms fail to capture subtle anomaly signatures in complex high-dimensional traffic patterns

Detecting Irregular Network Activity with Adversarial Learning and Expert Feedback · Virginia Tech · Master's

Tried and failed

One-Class SVM and feedforward autoencoders applied to sequential anomaly detection in logs. Outcome: did not generalise. Reason: Unable to reliably detect anomalies without supervised attack knowledge for tuning hyperparameters

Data-driven Algorithms for Critical Detection Problems: From Healthcare to Cybersecurity Defenses · Virginia Tech · Doctorate

Tried and failed

empirical risk minimization with halfspace neural networks applied to anomaly and intrusion detection. Outcome: did not generalise. Reason: failed to generalize to unseen attack types, performing near random

Characterizing anomalies for reliable machine learning · Georgia Tech · PhD

Tried and failed

heuristic anomaly detection on interaction logs applied to identifying reinforcement learning cyberattackers. Outcome: no signal. Reason: noisy and short interaction traces prevented reliable discrimination between attackers and benign users

Communication and generalization in multi-agent learning · UT Austin · PhD

Tried and failed

deep neural networks for time-series anomaly detection applied to network traffic anomaly detection. Outcome: did not generalise. Reason: severe overfitting caused performance collapse across operational modes, locations, and time periods

Anomaly detection for IoT environments · Imperial · PhD

Tried and failed

individual acoustic emission statistical feature thresholding applied to mechanical wear anomaly detection. Outcome: no signal. Reason: features showed inconsistent and non-monotonic trends across damage progression states

Practical and generally applicable condition based maintenance (CBM) system for mud pump · UT Austin · PhD

Rigid heuristics and simplistic decision rules degrade anomaly discrimination

6 theses · 4 institutions

Unsupervised ranking rules that enforce fixed contamination rates prioritize high-variance measurement artifacts over rare phenomena of operational interest. In addition, basic Boolean combination rules degrade performance because OR logic inflates false alarms while AND logic causes high missed detections.

Tried and failed

density and isolation-based anomaly detection applied to oil production time series anomaly detection. Reason: algorithms rigidly flagged arbitrary fixed contamination percentages, generating high false positive rates

Enhanced Oil Field Data-Wrangling using Machine Learning · Texas Tech · PhD

Tried and failed

Boolean logic ensemble combination of anomaly detectors applied to multi-model anomaly detection fusion. Outcome: worse than baseline. Reason: OR logic inflated false positive rates while AND logic caused unacceptable missed detections

Tenko++: Next-Gen Lightweight Intrusion Detection with Context-Aware Anomaly Scoring · Virginia Tech · Master's

Tried and failed

missing data imputation indicator feature engineering applied to time series anomaly detection. Outcome: no signal. Reason: imputed missing data features failed to discriminate anomaly states from normal baseline days

Developing AI Systems for Monitoring Heterogeneous Mental Health Disorders · Cornell · PhD

Tried and failed

random sampling of reference comparison sets applied to pairwise anomaly detection in authentication logs. Outcome: worse than baseline. Reason: yielded low F1 scores (38% to 43%) on test sets

Characterizing and Detecting Password Guessing Attacks · Cornell · PhD

Tried and failed

logistic loss in classification-based level set estimation applied to unsupervised anomaly detection. Outcome: worse than baseline. Reason: non-zero asymptotic loss degraded performance compared to hinge loss

Statistical Learning Theory of Deep Neural Networks: A Generalization Viewpoint · Georgia Tech · PhD

Tried and failed

Single decision tree classification applied to anomaly detection in time-series measurements. Outcome: worse than baseline. Reason: Lacked ensemble averaging, resulting in lower detection accuracy across all tree depths compared to random forest

Protection and Cybersecurity of Inverter-Based Resources · Virginia Tech · Master's

Dimensionality reduction and feature compression discard critical anomaly signatures

5 theses · 5 institutions

Preprocessing high-dimensional inputs with lossy compression such as PCA or coarse state quantization eliminates variance directions essential for distinguishing faulty conditions. Consequently, anomaly detectors trained on raw features consistently outperform compressed representations where subtle novelty signals have been stripped away.

Tried and failed

coarse discretization of continuous physical states applied to cyber-physical system anomaly detection. Outcome: worse than baseline. Reason: coarse quantization degraded state representation fidelity, reducing true positive detection rates compared to continuous precision

Detection and Forensic Analysis of Modern ICS Attacks Via Correlating Scada Host Operations with Physical Behavior · Georgia Tech · PhD

Considered and rejected

Considered and rejected: Frequency-domain feature extraction for ICS anomaly detection, rejected due to inability to detect short-duration anomalies requiring long time windows

Robust Anomaly Detection in Critical Infrastructure · University of Trento · PhD

Tried and failed

dimensionality reduction feature preprocessing applied to unsupervised anomaly detection on spectral features. Outcome: worse than baseline. Reason: compression discards subtle anomaly-discriminating spectral signatures needed for novelty detection

On the Effectiveness of Dimensionality Reduction for Unsupervised Structural Health Monitoring Anomaly Detection · Virginia Tech · Master's

Tried and failed

training anomaly detection on unselected high-dimensional features applied to structural damage severity estimation. Outcome: no signal. Reason: irrelevant features and environmental noise masked the monotonic degradation signal in the anomaly metric

Data-Driven Structural Health Monitoring of Wind Turbine Blades under Operational and Environmental Variability · University College Dublin · PhD

Tried and failed

PCA dimensionality reduction before one-class SVM applied to anomaly detection from sensor data. Outcome: worse than baseline. Reason: Nominal-only PCA bases discarded variance directions critical for distinguishing faulty signals

Applications of Probabilistic Machine Learning Models to Semiconductor Fabrication · MIT · PhD

Left open by the authors

Problems the authors named and did not get to.

Left open

Implement machine learning anomaly detection to detect and flag suspicious trade entities and transactions. Blocker: No specific anomaly detection algorithms, evaluation metrics, or trade transaction datasets are specified.

Can an LLM find its way around a Spreadsheet? · Virginia Tech · Master's

Left open

Extend the deep learning framework to anomaly-based detection for identifying novel cyber-physical attacks and system faults. Blocker: None

Online Detection Against Cyberattacks In Cyber-Physical Systems · Georgia Tech · PhD

Left open

Investigate why pre-trained classification network latent representations fail to transfer effectively to one-class anomaly detection. Blocker: None

Semi-Supervised Anomaly Detection Using One-Class RBF Networks · University College Dublin · PhD

Left open

Extend the black-box mimicker distillation technique to anomaly detection methods lacking a high-level variable basis, such as variational autoencoders. Blocker: Lacks specific formulation or target datasets for defining feature selection without an established high-level basis.

Seek and Ye Shall Find: Machine Learning and Searches for New Physics · University of Oregon · PhD

Left open

Extend flight software intrusion detection and ML-based anomaly detection with adaptive autonomous mitigation mechanisms. Blocker: The unfinished work lacks specific target metrics, algorithms, and design details beyond a broad concept

Engineering Cyber Resilience in Spacecraft Flight Software: A Threat-Informed Architecture and Evaluation · Johns Hopkins · Doctorate

Left open

Evaluate anomaly detection sensitivity to stealthy, benign-resembling network attacks using richer network data representations. Blocker: Lacks specific data representations, attack scenarios, or performance targets

Diagnosis and Mitigation of Evolving Threats for Sustainable Security · University College Dublin · PhD

Left open

Evaluate the CAAD model against a broader variety of sophisticated network anomaly types. Blocker: No specific anomaly types, benchmark datasets, or performance criteria are defined

Detecting Irregular Network Activity with Adversarial Learning and Expert Feedback · Virginia Tech · Master's

Left open

Develop and evaluate methods for controlling false positive rates in dynamic graph anomaly detection beyond the Benjamini-Hochberg procedure. Blocker: None

Statistical Inference on Time Series of Graphs · Johns Hopkins · PhD

Left open

Develop and test risk management and anomaly detection techniques for safeguarding against fraudulent or erroneous trades in algorithmic trading. Blocker: None

Knowledge Graphs, Automatic Feature Engineering and Machine Learning in Algorithmic Trading for Financial Markets · University of Camerino · PhD

Who has worked on this

Authors of the public theses cited on this page, most-cited first.

Checking a claim in this area?

We can run the same search on any method or claim. If nothing turns up, we will say so, and that proves nothing on its own.