Technical Report: Anomaly Detection for a Critical Industrial System using Context, Logs and Metrics

Recent advances in contextual anomaly detection attempt to combine resource metrics and event logs to un- cover unexpected system behaviors and malfunctions at run- time. These techniques are highly relevant for critical software systems, where monitoring is often mandated by international standards and guidelines. In this technical report, we analyze the effectiveness of a metrics-logs contextual anomaly detection technique in a middleware for Air Traffic Control systems. Our study addresses the challenges of applying such techniques to a new case study with a dense volume of logs, and finer monitoring sampling rate. We propose an automated abstraction approach to infer system activities from dense logs and use regression analysis to infer the anomaly detector. We observed that the detection accuracy is impacted by abrupt changes in resource metrics or when anomalies are asymptomatic in both resource metrics and event logs. Guided by our experimental results, we propose and evaluate several actionable improvements, which include a change detection algorithm and the use of time windows on contextual anomaly detection. This technical report accompanies the paper “Contextual Anomaly Detection for a Critical Industrial System based on Logs and Metrics” [1] and provides further details on the analysis method, case study and experimental results

A Risk Analysis and Data Driven Approach to Combating Sex Trafficking

Sex trafficking is a heinous criminal act that compels victims in the United States and worldwide to perform commercial sex acts through force, fraud, coercion, or age (TVPA, 2000). This dissertation takes a risk-analysis and data-driven approach to attain a better understanding of the problem, with the goal of showing that such an approach can help comprehend misallocation of resources, reform policy, reinforce social services, or support populations vulnerable to sex trafficking. Sex trafficking is a complex problem and must be studied both qualitatively and quantitatively in order to provide those in a position of influence with an improved basis for decision-making. In Chapter 2 of this dissertation, I outline the risks associated with sex trafficking and suggest that risk analysis tools can be useful for antitrafficking efforts, as they can provide context-sensitive, empirical knowledge as well as a way to communicate neutrally about a charged topic. Building on the understanding of this complex crime, in Chapter 3 I analyze online commercial sex work advertisements to draw conclusions about the COVID-19 pandemic’s impact on sex trafficking, showing a measurable impact of the pandemic-related stay-at-home orders on advertising, and likely on the vulnerability of at-risk populations to trafficking. Finally, in Chapter 4 I use data collected by myself and a collaborator on sex work advertisements as a basis to explore three quantitative methods for detecting anomalies in time-series data. Based on the results of this sex trafficking case study, I evaluate the benefits and drawbacks of each method for risk-based decision-makers and discuss how these methods can be integrated into a broader risk framework. This dissertation contributes to the field of sex trafficking research by offering improved methods for detecting anomalous behaviors in the system and advancing the application of these techniques for the risk analysis community. Although they are specifically designed for sex trafficking, analysts can apply these methods to many of the risk-related challenges of our future.PHDIndustrial & Operations EngineeringUniversity of Michigan, Horace H. Rackham School of Graduate Studieshttp://deepblue.lib.umich.edu/bitstream/2027.42/170041/1/juliaoh_1.pd