Temporal Logics for Learning and Detection of Anomalous Behavior

Abstract

Abstract-The increased complexity of modern systems necessitates automated anomaly detection methods to detect possible anomalous behavior determined by malfunctions or external attacks. We present formal methods for inferring (via supervised learning) and detecting (via unsupervised learning) anomalous behavior. Our procedures use data to construct a signal temporal logic (STL) formula that describes normal system behavior. This logic can be used to formulate properties such as "If the train brakes within 500 m of the platform at a speed of 50 km/hr, then it will stop in at least 30 s and at most 50 s." Our procedure infers not only the physical parameters involved in the formula (e.g., 500 m in the example above) but also its logical structure. STL gives a more human-readable representation of behavior than classifiers represented as surfaces in high-dimensional feature spaces. The learned formula enables us to perform early detection by using monitoring techniques and anomaly mitigation by using formal synthesis techniques. We demonstrate the power of our methods with examples of naval surveillance and a train braking system.

A Logic-Based Learning Approach to Explore Diabetes Patient Behaviors

“…In terms of STL Learning, a variety of papers have developed new methodologies to learn STL formula structures and their parameters for anomaly detection and behavior identification in applications such as naval surveillance and medical contexts. Kong et al [17] developed an offline supervised learning approach that uses machine learning to detect anomalous and normal behaviors. Formula structures and parameters are synthesized using a gradient descent optimization guided by robustness and hinge loss functions in their machine learning algorithm.…”

Efficient Parametric Identification for STL

“…In other contexts, such as those of [13] and [11,30], the traces can be classified as normal or abnormal and the problem becomes that of learning from both positive and negative examples, a case of supervised learning.…”

“…Signal temporal logic (STL) [33,35] is an extension of temporal logic designed to handle real-valued dense-time signals which gained a lot of popularity in recent years as a rigorous and expressive formalism to describe behaviors of continuous and hybrid systems in various domains such as analog circuits [28], systems and synthetic biology [8,17,40], biomedical systems [13,14] and cyber-physical control systems [15,19,30,36,37]. The reader is referred to [9] for an introduction and a survey of applications.…”

Graph Temporal Logic Inference for Classification and Identification

“…Our approach of inferring GTL formulas from data is closely related to inferring temporal logic formulas from data. The work in [2,5,8] focus on inferring temporal logic formulas for classifying two sets of trajectories, while the work in [3,6,9,15] focus on identifying temporal logic formulas from system trajectories.…”