Inhalt

•  
   1 Introduction
•  
   1.1 Background
•  
   1.2 Main Contributions
•  
   1.3 Structure
•  
  2 Fundamentals
•  
   2.1 Probability Density Functions
•  
   2.2 System classes
•  
   2.2.1 Continuous-state Systems
•  
   2.2.2 Discrete Event Systems
•  
  2.3 Automata classes
•  
   2.3.1 Languages
•  
   2.3.2 Untimed Automata
•  
   2.3.3 Timed Automata
•  
   2.3.4 Hybrid Automata
•  
  2.4 Automata Inference Algorithms
•  
   2.4.1 Common Elements
•  
   2.4.2 Learning Untimed Automata
•  
   2.4.3 Learning Timed Automata
•  
   2.4.4 Algorithm Analysis Frameworks
•  
   2.5 One-class Classification
•  
   2.5.1 One-class Classification Algorithms
•  
   2.5.2 Anomaly Detection
•  
  3 Related Work
•  
   3.1 Research Area Overview
•  
  3.2 Process Mining
•  
   3.2.1 Data Format
•  
   3.2.2 Anomaly Detection
•  
   3.2.3 Models & Algorithms
•  
   3.3 Grammatical Inference
•  
   3.3.1 Data Format
•  
   3.3.2 Anomaly Detection
•  
   3.3.3 Models & Algorithms
•  
  3.4 Sequence-based Anomaly Detection
•  
   3.4.1 Data Format
•  
   3.4.2 Anomaly Detection
•  
   3.4.3 Models & Algorithms
•  
  3.5 Other Anomaly Detection Approaches
•  
   3.5.1 Vector-based Anomaly Detection
•  
   3.5.2 Anomaly Detection on Data Streams
•  
   3.5.3 ATM Fraud Detection
•  
  4 Anomaly Detection with PDTTAs
•  
   4.1 Motivation
•  
   4.2 Probabilistic Deterministic Timed Transition Automaton (PDTTA)
•  
   4.3 Learning PDTTAs
•  
   4.3.1 PDTTA Learning Algorithm ProDTTAL
•  
   4.3.2 Runtime Complexity
•  
   4.3.3 Convergence of ProDTTAL
•  
   4.3.4 Properties of Timed Automata Inference Algorithms
•  
  4.4 Anomaly Detection
•  
   4.4.1 Anomaly Detection Problem
•  
   4.4.2 Automata-based Anomaly Detection Algorithm (AmAnDA)
•  
  4.5 Anomaly Detection in a Two-/Multi-class Setting
•  
   4.5.1 Two-class Setting
•  
   4.5.2 Multi-class Setting
•  
  5 Anomaly Detection Evaluation
•  
   5.1 Performance Metrics
•  
   5.2 The Curse of One-class Evaluation
•  
   5.2.1 Anomalies in Discrete Event Systems
•  
   5.2.2 Random anomalies
•  
   5.2.3 Model-based simulated anomalies
•  
   5.2.4 Anomaly Rate
•  
   5.3 Experiment Design / Scaling of Experiments
•  
  6 Experimental Evaluation
•  
   6.1 Hyperparameter Tuning
•  
  6.2 Experiment Setup
•  
   6.2.1 SMAC Setup
•  
   6.2.2 Default Environment
•  
   6.2.3 Algorithm Improvements and Implementation Details
•  
  6.3 Preliminary Synthetic Experiments
•  
   6.3.1 PDRTA Data Generation
•  
   6.3.2 Results
•  
   6.4 Synthetic Data Evaluation
•  
   6.4.1 Direct Anomaly Insertion
•  
   6.4.2 Additional Results for the Initial PDRTA
•  
   6.4.3 PDRTA Data Generation
•  
   6.4.4 PDTTA Data Generation
•  
   6.4.5 PNTTA Data Generation
•  
  6.5 Real-world Data Evaluation
•  
   6.5.1 Preprocessing
•  
   6.5.2 Experiment Setup
•  
   6.5.3 Results
•  
  6.6 Evaluation of Algorithm Scaling
•  
   6.6.1 Scaling Approaches
•  
   6.6.2 Expectations
•  
   6.6.3 Experiment Setup
•  
   6.6.4 Runtime Results
•  
  7 Conclusion and Future Work
•  
   7.1 Conclusion
•  
   7.2 Future Work
•  
  A Experimental Evaluation
•  
   A.1 Hyperparameter Values
•  
  A.2 Evaluation of Algorithm Scaling
•  
   A.2.1 Initial Automaton
•  
   A.2.2 Memory Consumption for Different Scaling Approaches
•  
   Acronyms
•  
   Notation
•  
   Bibliography