Intelligent Systems with Applications最新文献_第4页

Alert correlation for intelligent threat detection and response 警报关联智能威胁检测和响应

IF 4.3

Intelligent Systems with Applications

Pub Date : 2025-12-01 Epub Date: 2025-11-07 DOI: 10.1016/j.iswa.2025.200606

Bronagh Lanigan , Zeinab Rezaeifar , Federico Cruciani , Michael Milliken , Jordan Vincent , Samuel Moore , Muhammad Aaqib , Alan Mills , Pushpinder K. Chouhan , Alfie Beard , Chris D. Nugent , Luke Chen , Alex Healing

With the increasing diversity of IoT devices, keeping IT systems secure is becoming increasingly difficult. Attackers exploit vulnerabilities within the system in order to access sensitive information, typically reaching their objective through several steps. Current Intrusion Detection Systems (IDSs) focus on low-level alerts, and tend to produce a high rate of false positives. This type of information alone is insufficient for the detection of sophisticated attack scenarios such Advanced Persistent Threats (APTs). Consequently, correlation techniques have recently been introduced to correlate alerts and reconstruct attack scenarios, however, various attack scenarios exist, with diverse characteristics. Also, different steps of the APTs scenarios may have their own characteristics. Therefore, finding a proper method that covers all cases remains a challenge. Moreover, after detecting APTs, how the system should respond to these attacks to avoid sabotage to the system remains a challenge. Thus, in this paper, first for detection of the attacks, we classify different cases, and then, a method based on different characteristics of attack patterns is proposed to detect APT scenarios. The proposed method consists of two main phases: APT detection and the intelligent hybrid response framework. In APT detection phase, similar alerts are aggregated and attack graphs are generated based on a similarity matrix. These graphs, combined with third party API data enable alert correlation and APT scenario detection. Entity graphs are then created to visualise host behaviour, and alert graphs are analysed to detect APT scenarios. In the response phase, attack graphs produced from the correlation inform the hybrid response framework, integrating knowledge and data-driven components that facilitate automated or recommended mitigation. The approach was evaluated on the ZeekData24 dataset. Obtained precision and recall on the malicious traffic was observed to be 96.65% and 87.04% respectively. The results show that our approach can effectively filter false positive alerts with a reduction of the data going from 10,063 alerts daily to 586 meta-alerts, pruned to 48 attack graphs and finally reduced to 20 suspicious attack graphs.

随着物联网设备的日益多样化，保持IT系统的安全变得越来越困难。攻击者利用系统中的漏洞来访问敏感信息，通常通过几个步骤来达到他们的目标。当前的入侵检测系统（ids）侧重于低级警报，容易产生高误报率。这种类型的信息本身不足以检测复杂的攻击场景，例如高级持续威胁（apt）。因此，最近引入了相关技术来关联警报和重建攻击场景，然而，存在各种攻击场景，具有不同的特征。此外，apt场景的不同步骤可能有自己的特点。因此，找到一种适用于所有情况的合适方法仍然是一项挑战。此外，在检测到apt之后，系统应该如何响应这些攻击以避免对系统的破坏仍然是一个挑战。因此，本文首先对攻击进行检测，对不同的案例进行分类，然后提出一种基于攻击模式不同特征的APT场景检测方法。该方法包括两个主要阶段：APT检测和智能混合响应框架。在APT检测阶段，基于相似矩阵聚合相似警报并生成攻击图。这些图表与第三方API数据相结合，可以实现警报关联和APT场景检测。然后创建实体图来可视化主机行为，并分析警报图以检测APT场景。在响应阶段，根据相关性生成的攻击图为混合响应框架提供信息，整合知识和数据驱动组件，促进自动化或推荐的缓解措施。该方法在ZeekData24数据集上进行了评估。对恶意流量的检测准确率和召回率分别为96.65%和87.04%。结果表明，我们的方法可以有效地过滤假阳性警报，将数据从每天10,063个警报减少到586个元警报，修剪到48个攻击图，最终减少到20个可疑攻击图。

{"title":"Alert correlation for intelligent threat detection and response","authors":"Bronagh Lanigan , Zeinab Rezaeifar , Federico Cruciani , Michael Milliken , Jordan Vincent , Samuel Moore , Muhammad Aaqib , Alan Mills , Pushpinder K. Chouhan , Alfie Beard , Chris D. Nugent , Luke Chen , Alex Healing","doi":"10.1016/j.iswa.2025.200606","DOIUrl":"10.1016/j.iswa.2025.200606","url":null,"abstract":"<div><div>With the increasing diversity of IoT devices, keeping IT systems secure is becoming increasingly difficult. Attackers exploit vulnerabilities within the system in order to access sensitive information, typically reaching their objective through several steps. Current Intrusion Detection Systems (IDSs) focus on low-level alerts, and tend to produce a high rate of false positives. This type of information alone is insufficient for the detection of sophisticated attack scenarios such Advanced Persistent Threats (APTs). Consequently, correlation techniques have recently been introduced to correlate alerts and reconstruct attack scenarios, however, various attack scenarios exist, with diverse characteristics. Also, different steps of the APTs scenarios may have their own characteristics. Therefore, finding a proper method that covers all cases remains a challenge. Moreover, after detecting APTs, how the system should respond to these attacks to avoid sabotage to the system remains a challenge. Thus, in this paper, first for detection of the attacks, we classify different cases, and then, a method based on different characteristics of attack patterns is proposed to detect APT scenarios. The proposed method consists of two main phases: APT detection and the intelligent hybrid response framework. In APT detection phase, similar alerts are aggregated and attack graphs are generated based on a similarity matrix. These graphs, combined with third party API data enable alert correlation and APT scenario detection. Entity graphs are then created to visualise host behaviour, and alert graphs are analysed to detect APT scenarios. In the response phase, attack graphs produced from the correlation inform the hybrid response framework, integrating knowledge and data-driven components that facilitate automated or recommended mitigation. The approach was evaluated on the ZeekData24 dataset. Obtained precision and recall on the malicious traffic was observed to be 96.65% and 87.04% respectively. The results show that our approach can effectively filter false positive alerts with a reduction of the data going from 10,063 alerts daily to 586 meta-alerts, pruned to 48 attack graphs and finally reduced to 20 suspicious attack graphs.</div></div>","PeriodicalId":100684,"journal":{"name":"Intelligent Systems with Applications","volume":"28 ","pages":"Article 200606"},"PeriodicalIF":4.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145520065","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

CTR-Net: Scalable safe reinforcement learning via neural approximations of control theoretic regulators 基于神经逼近控制理论调节器的可扩展安全强化学习

IF 4.3

Intelligent Systems with Applications

Pub Date : 2025-12-01 Epub Date: 2025-10-31 DOI: 10.1016/j.iswa.2025.200597

Ramen Ghosh

Ensuring hard constraint satisfaction during both training and deployment is central to safety-critical reinforcement learning (RL). Control-theoretic regularization (CTR) enforces safety by filtering actions through viability- or barrier-certified safe sets, but evaluating the state-dependent regulator

R (x)

online is often prohibitive in high dimensions. We propose a scalable CTR framework based on neural regulator approximators

{\hat{R}}_{θ} (x)

—differentiable surrogates of

R (x)

that enable fast projection or rejection-sampling filters within standard RL loops. We formalize a learning-theoretic analysis for approximate safety filtering and prove probably approximately correct (PAC)-style guarantees: if the set approximation error is bounded by

ɛ

with confidence

1 - δ

, then the probability of constraint violation along a length–

T

rollout is bounded by a term that scales linearly in

T

and

ɛ

(plus

δ

). We further show that the performance suboptimality of the filtered policy is controlled analytically by the same approximation envelope, yielding an explicit, provably quantified safety-versus-optimality tradeoff (PAC bounds linear in

T

and the envelope), complemented by empirical ablations; see also the calculus-of-variations view of constrained tradeoffs (Younis, 2023). The resulting method, CTR-Net, is architecture-agnostic and supports real-time execution via fast, differentiable safety layers. Empirical evaluations on high-dimensional continuous-control benchmarks — including safe locomotion and constrained multi-joint manipulation — demonstrate reliable constraint satisfaction during learning and deployment, robustness under modeling uncertainty and substantial computational gains relative to exact viability/barrier baselines. By coupling operator-free neural safety sets with CTR guarantees, CTR-Net bridges theoretical safety certificates and scalable implementation, advancing practical, real-time safe RL for complex intelligent systems.

在训练和部署期间确保硬约束的满足是安全关键型强化学习（RL）的核心。控制理论正则化（CTR）通过生存能力或障碍认证的安全集过滤动作来加强安全性，但是在线评估状态相关的调节器R(x)在高维中通常是令人望而却步的。我们提出了一个可扩展的CTR框架，该框架基于神经调节器近似器R θ(x) - R(x)的可微替代品，可以在标准RL环路内实现快速投影或拒绝采样滤波器。我们形式化了近似安全过滤的学习理论分析，并证明了可能近似正确（PAC）风格的保证：如果集合近似误差以置信度为1−δ的π为界，那么沿长度- T rollout的约束违反概率由一个在T和π (+ δ)中线性缩放的项为界。我们进一步表明，过滤策略的性能次优性由相同的近似包络分析控制，产生明确的，可证明的量化安全与最优性权衡（PAC界在T和包络中是线性的），辅以经验消融；另见约束权衡的变分演算观点（Younis, 2023）。由此产生的方法cnet与体系结构无关，并通过快速、可区分的安全层支持实时执行。对高维连续控制基准（包括安全运动和约束多关节操作）的经验评估表明，在学习和部署过程中，约束满足是可靠的，建模不确定性下的鲁棒性和相对于确切的可行性/障碍基线的大量计算收益。通过将无操作人员的神经安全集与CTR保证相结合，CTR- net将理论安全证书与可扩展的实施相结合，为复杂的智能系统推进实用、实时的安全RL。

{"title":"CTR-Net: Scalable safe reinforcement learning via neural approximations of control theoretic regulators","authors":"Ramen Ghosh","doi":"10.1016/j.iswa.2025.200597","DOIUrl":"10.1016/j.iswa.2025.200597","url":null,"abstract":"<div><div>Ensuring hard constraint satisfaction during both training and deployment is central to safety-critical reinforcement learning (RL). Control-theoretic regularization (CTR) enforces safety by filtering actions through viability- or barrier-certified safe sets, but evaluating the state-dependent regulator <span><math><mrow><mi>R</mi><mrow><mo>(</mo><mi>x</mi><mo>)</mo></mrow></mrow></math></span> online is often prohibitive in high dimensions. We propose a scalable CTR framework based on <em>neural regulator approximators</em> <span><math><mrow><msub><mrow><mover><mrow><mi>R</mi></mrow><mrow><mo>ˆ</mo></mrow></mover></mrow><mrow><mi>θ</mi></mrow></msub><mrow><mo>(</mo><mi>x</mi><mo>)</mo></mrow></mrow></math></span>—differentiable surrogates of <span><math><mrow><mi>R</mi><mrow><mo>(</mo><mi>x</mi><mo>)</mo></mrow></mrow></math></span> that enable fast projection or rejection-sampling filters within standard RL loops. We formalize a learning-theoretic analysis for approximate safety filtering and prove probably approximately correct (PAC)-style guarantees: if the set approximation error is bounded by <span><math><mi>ɛ</mi></math></span> with confidence <span><math><mrow><mn>1</mn><mo>−</mo><mi>δ</mi></mrow></math></span>, then the probability of constraint violation along a length–<span><math><mi>T</mi></math></span> rollout is bounded by a term that scales linearly in <span><math><mi>T</mi></math></span> and <span><math><mi>ɛ</mi></math></span> (plus <span><math><mi>δ</mi></math></span>). We further show that the performance suboptimality of the filtered policy is controlled analytically by the same approximation envelope, yielding an explicit, provably quantified safety-versus-optimality tradeoff (PAC bounds linear in <span><math><mi>T</mi></math></span> and the envelope), complemented by empirical ablations; see also the calculus-of-variations view of constrained tradeoffs (Younis, 2023). The resulting method, <strong>CTR-Net</strong>, is architecture-agnostic and supports real-time execution via fast, differentiable safety layers. Empirical evaluations on high-dimensional continuous-control benchmarks — including safe locomotion and constrained multi-joint manipulation — demonstrate reliable constraint satisfaction during learning and deployment, robustness under modeling uncertainty and substantial computational gains relative to exact viability/barrier baselines. By coupling operator-free neural safety sets with CTR guarantees, CTR-Net bridges theoretical safety certificates and scalable implementation, advancing practical, real-time safe RL for complex intelligent systems.</div></div>","PeriodicalId":100684,"journal":{"name":"Intelligent Systems with Applications","volume":"28 ","pages":"Article 200597"},"PeriodicalIF":4.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145416658","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

AI-predictive vaccine stability: a systems biology framework to modernize regulatory testing and cold chain equity 人工智能预测疫苗稳定性：实现监管测试和冷链公平现代化的系统生物学框架

IF 4.3

Intelligent Systems with Applications

Pub Date : 2025-12-01 Epub Date: 2025-09-15 DOI: 10.1016/j.iswa.2025.200584

Sinethemba H. Yakobi, Uchechukwu U. Nwodo

Vaccine instability contributes to the loss of up to 25 % of doses globally, a challenge intensified by the complexity of next-generation platforms such as mRNA–lipid nanoparticles (mRNA–LNPs), viral vectors, and protein subunits. Current regulatory frameworks (ICH Q5C, WHO TRS 1010) rely on static protocols that overlook platform-specific degradation mechanisms and real-world cold-chain variability. We introduce the Systems Biology–guided AI (SBg-AI) framework, a predictive stability platform integrating omics-derived biomarkers, real-time telemetry, and explainable machine learning. Leveraging recurrent and graph neural networks with Bayesian inference, SBg-AI forecasts degradation events with 89 % accuracy—validated in African and Southeast Asian supply chains. Federated learning ensures multi-manufacturer collaboration while preserving data privacy. In field trials, dynamic expiry predictions reduced mRNA vaccine wastage by 22 %. A phased regulatory roadmap supports transition from hybrid AI-empirical models (2024) to full AI-based stability determinations by 2030. By integrating mechanistic degradation science with real-time telemetry and regulatory-compliant AI, the SBg-AI framework transforms vaccine stability from retrospective batch testing to proactive, precision-guided assurance.

疫苗的不稳定性导致全球高达25%的剂量损失，下一代平台（如mrna -脂质纳米颗粒（mRNA-LNPs））、病毒载体和蛋白质亚基)的复杂性加剧了这一挑战。目前的监管框架（ICH Q5C, WHO TRS 1010）依赖于静态协议，忽略了平台特定的降解机制和现实世界的冷链可变性。我们介绍了系统生物学引导的人工智能（SBg-AI）框架，这是一个集成了组学衍生生物标志物、实时遥测和可解释机器学习的预测稳定性平台。利用贝叶斯推理的循环神经网络和图神经网络，SBg-AI预测退化事件的准确率为89%，在非洲和东南亚的供应链中得到了验证。联邦学习确保多制造商协作，同时保护数据隐私。在田间试验中，动态过期预测使mRNA疫苗的浪费减少了22%。分阶段的监管路线图支持从混合人工智能经验模型（2024年）过渡到2030年完全基于人工智能的稳定性确定。通过将机械降解科学与实时遥测和符合法规的人工智能相结合，SBg-AI框架将疫苗稳定性从回顾性批量检测转变为主动、精确指导的保证。

{"title":"AI-predictive vaccine stability: a systems biology framework to modernize regulatory testing and cold chain equity","authors":"Sinethemba H. Yakobi, Uchechukwu U. Nwodo","doi":"10.1016/j.iswa.2025.200584","DOIUrl":"10.1016/j.iswa.2025.200584","url":null,"abstract":"<div><div>Vaccine instability contributes to the loss of up to 25 % of doses globally, a challenge intensified by the complexity of next-generation platforms such as mRNA–lipid nanoparticles (mRNA–LNPs), viral vectors, and protein subunits. Current regulatory frameworks (ICH Q5C, WHO TRS 1010) rely on static protocols that overlook platform-specific degradation mechanisms and real-world cold-chain variability. We introduce the Systems Biology–guided AI (SBg-AI) framework, a predictive stability platform integrating omics-derived biomarkers, real-time telemetry, and explainable machine learning. Leveraging recurrent and graph neural networks with Bayesian inference, SBg-AI forecasts degradation events with 89 % accuracy—validated in African and Southeast Asian supply chains. Federated learning ensures multi-manufacturer collaboration while preserving data privacy. In field trials, dynamic expiry predictions reduced mRNA vaccine wastage by 22 %. A phased regulatory roadmap supports transition from hybrid AI-empirical models (2024) to full AI-based stability determinations by 2030. By integrating mechanistic degradation science with real-time telemetry and regulatory-compliant AI, the SBg-AI framework transforms vaccine stability from retrospective batch testing to proactive, precision-guided assurance.</div></div>","PeriodicalId":100684,"journal":{"name":"Intelligent Systems with Applications","volume":"28 ","pages":"Article 200584"},"PeriodicalIF":4.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145097475","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

End-to-end semantically aware tactile generation 端到端语义感知触觉生成

IF 4.3

Intelligent Systems with Applications

Pub Date : 2025-12-01 Epub Date: 2025-10-28 DOI: 10.1016/j.iswa.2025.200594

Mohammad Mahdi Heydari Dastjerdi, Abbas Akkasi, Hilaire Djani, Aatreyi Pranavbhai Mehta, Majid Komeili

Tactile graphics are an essential tool for conveying visual information to visually impaired individuals. However, translating 2D plots, such as B’ezier curves, polygons, and bar charts, into an effective tactile format remains a challenge. This paper presents a novel, two-stage deep learning pipeline for automating this conversion process. Our method leverages a Pix2Pix architecture, employing a U-Net++ generator network for robust image generation. To improve the perceptual quality of the tactile representations, we incorporate an adversarial perceptual loss function alongside a gradient penalty. The pipeline operates in a sequential manner: firstly, converting the source plot into a grayscale tactile representation, followed by a transformation into a channel-wise equivalent. We evaluate the performance of our model on a comprehensive synthetic dataset consisting of 20,000 source-target pairs encompassing various 2D plot types. To quantify performance, we utilize fuzzy versions of established metrics like pixel accuracy, Dice coefficient, and Jaccard index. Additionally, a human study is conducted to assess the visual quality of the generated tactile graphics. The proposed approach demonstrates promising results, significantly streamlining the conversion of 2D plots into tactile graphics. This paves the way for the development of fully automated systems, enhancing accessibility of visual information for visually impaired individuals.

触觉图形是向视障人士传达视觉信息的重要工具。然而，将二维图形（如B’ezier曲线、多边形和条形图）转换成有效的触觉格式仍然是一个挑战。本文提出了一种新颖的两阶段深度学习管道，用于自动化此转换过程。我们的方法利用Pix2Pix架构，采用U-Net++生成器网络进行鲁棒图像生成。为了提高触觉表征的感知质量，我们结合了一个对抗感知损失函数和一个梯度惩罚。管道以顺序的方式运行：首先，将源图转换为灰度触觉表示，然后转换为通道等效。我们在包含各种2D图类型的20,000对源-目标对的综合合成数据集上评估了我们的模型的性能。为了量化性能，我们使用模糊版本的既定指标，如像素精度，骰子系数和Jaccard指数。此外，还进行了人体研究，以评估生成的触觉图形的视觉质量。所提出的方法显示了有希望的结果，显着简化了二维图形到触觉图形的转换。这为开发全自动系统铺平了道路，增强了视障人士获取视觉信息的能力。

{"title":"End-to-end semantically aware tactile generation","authors":"Mohammad Mahdi Heydari Dastjerdi, Abbas Akkasi, Hilaire Djani, Aatreyi Pranavbhai Mehta, Majid Komeili","doi":"10.1016/j.iswa.2025.200594","DOIUrl":"10.1016/j.iswa.2025.200594","url":null,"abstract":"<div><div>Tactile graphics are an essential tool for conveying visual information to visually impaired individuals. However, translating 2D plots, such as B’ezier curves, polygons, and bar charts, into an effective tactile format remains a challenge. This paper presents a novel, two-stage deep learning pipeline for automating this conversion process. Our method leverages a Pix2Pix architecture, employing a U-Net++ generator network for robust image generation. To improve the perceptual quality of the tactile representations, we incorporate an adversarial perceptual loss function alongside a gradient penalty. The pipeline operates in a sequential manner: firstly, converting the source plot into a grayscale tactile representation, followed by a transformation into a channel-wise equivalent. We evaluate the performance of our model on a comprehensive synthetic dataset consisting of 20,000 source-target pairs encompassing various 2D plot types. To quantify performance, we utilize fuzzy versions of established metrics like pixel accuracy, Dice coefficient, and Jaccard index. Additionally, a human study is conducted to assess the visual quality of the generated tactile graphics. The proposed approach demonstrates promising results, significantly streamlining the conversion of 2D plots into tactile graphics. This paves the way for the development of fully automated systems, enhancing accessibility of visual information for visually impaired individuals.</div></div>","PeriodicalId":100684,"journal":{"name":"Intelligent Systems with Applications","volume":"28 ","pages":"Article 200594"},"PeriodicalIF":4.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145416791","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Mimicking human attention in driving scenarios for enhanced Visual Question Answering: Insights from eye-tracking and the human attention filter 在驾驶场景中模拟人类注意力以增强视觉问答：来自眼动追踪和人类注意力过滤器的见解

IF 4.3

Intelligent Systems with Applications

Pub Date : 2025-12-01 Epub Date: 2025-09-11 DOI: 10.1016/j.iswa.2025.200578

Kaavya Rekanar , Martin J. Hayes , Ciarán Eising

Visual Question Answering (VQA) models serve a critical role in interpreting visual data and responding to textual queries, particularly within the domain of autonomous driving. These models enhance situational awareness and enable naturalistic interaction between passengers and vehicle systems. However, existing VQA architectures often underperform in driving contexts due to their generic design and lack of alignment with domain-specific perceptual cues. This study introduces a targeted enhancement strategy based on the integration of human visual attention patterns into VQA systems. The proposed approach investigates visual subjectivity by analysing human responses and gaze behaviours captured through an eye-tracking experiment conducted in a realistic driving scenario. This method enables the direct observation of authentic attention patterns and mitigates the limitations introduced by subjective self-reporting. From these findings, a Human Attention Filter (HAF) is constructed to selectively preserve task-relevant features while suppressing visually distracting but semantically irrelevant content. Three VQA models – LXMERT, ViLBERT, and ViLT – are evaluated to demonstrate the adaptability and impact of HAF across different visual representation strategies, including region-based and patch-based architectures. Case studies involving LXMERT and ViLBERT are conducted to assess the integration of the HAF within region-based multimodal pipelines, showing measurable improvements in performance and alignment with human-like attention. Quantitative analysis reveals statistically significant performance trends correlated with driving experience, highlighting cognitive variability among human participants and informing model interpretability. In addition, failure cases are examined to identify potential limitations introduced by attention filtering, offering critical insight into the boundaries of gaze-guided model alignment.The findings validate the effectiveness of human-informed filtering for improving both accuracy and transparency in autonomous VQA systems, and present HAF as a sustainable, cognitively aligned strategy for advancing trustworthy AI in real-world environments.

视觉问答（VQA）模型在解释视觉数据和响应文本查询方面发挥着至关重要的作用，特别是在自动驾驶领域。这些模型增强了态势感知能力，并使乘客和车辆系统之间的自然互动成为可能。然而，现有的VQA架构由于其通用设计和缺乏与特定领域感知线索的一致性，在驱动环境中往往表现不佳。本研究介绍了一种基于将人类视觉注意模式整合到VQA系统中的目标增强策略。该方法通过分析在现实驾驶场景中进行的眼动追踪实验中捕获的人类反应和凝视行为来研究视觉主观性。这种方法可以直接观察真实的注意力模式，减轻主观自我报告带来的限制。基于这些发现，我们构建了一个人类注意过滤器（HAF）来选择性地保留任务相关的特征，同时抑制视觉上分散注意力但语义上不相关的内容。对三个VQA模型——LXMERT、ViLBERT和ViLT进行了评估，以展示HAF在不同视觉表示策略（包括基于区域和基于补丁的架构）中的适应性和影响。包括LXMERT和ViLBERT在内的案例研究进行了评估，以评估HAF在基于区域的多模态管道中的整合，显示出性能的可衡量改进，并与人类的注意力保持一致。定量分析揭示了与驾驶经验相关的统计显著性能趋势，突出了人类参与者之间的认知可变性，并为模型的可解释性提供了信息。此外，还研究了失败案例，以确定注意力过滤引入的潜在限制，为视线引导模型对齐的边界提供了关键的见解。研究结果验证了人类知情过滤在提高自主VQA系统的准确性和透明度方面的有效性，并将HAF作为一种可持续的、认知一致的策略，用于在现实环境中推进值得信赖的人工智能。

{"title":"Mimicking human attention in driving scenarios for enhanced Visual Question Answering: Insights from eye-tracking and the human attention filter","authors":"Kaavya Rekanar , Martin J. Hayes , Ciarán Eising","doi":"10.1016/j.iswa.2025.200578","DOIUrl":"10.1016/j.iswa.2025.200578","url":null,"abstract":"<div><div>Visual Question Answering (VQA) models serve a critical role in interpreting visual data and responding to textual queries, particularly within the domain of autonomous driving. These models enhance situational awareness and enable naturalistic interaction between passengers and vehicle systems. However, existing VQA architectures often underperform in driving contexts due to their generic design and lack of alignment with domain-specific perceptual cues. This study introduces a targeted enhancement strategy based on the integration of human visual attention patterns into VQA systems. The proposed approach investigates visual subjectivity by analysing human responses and gaze behaviours captured through an eye-tracking experiment conducted in a realistic driving scenario. This method enables the direct observation of authentic attention patterns and mitigates the limitations introduced by subjective self-reporting. From these findings, a Human Attention Filter (HAF) is constructed to selectively preserve task-relevant features while suppressing visually distracting but semantically irrelevant content. Three VQA models – LXMERT, ViLBERT, and ViLT – are evaluated to demonstrate the adaptability and impact of HAF across different visual representation strategies, including region-based and patch-based architectures. Case studies involving LXMERT and ViLBERT are conducted to assess the integration of the HAF within region-based multimodal pipelines, showing measurable improvements in performance and alignment with human-like attention. Quantitative analysis reveals statistically significant performance trends correlated with driving experience, highlighting cognitive variability among human participants and informing model interpretability. In addition, failure cases are examined to identify potential limitations introduced by attention filtering, offering critical insight into the boundaries of gaze-guided model alignment.The findings validate the effectiveness of human-informed filtering for improving both accuracy and transparency in autonomous VQA systems, and present HAF as a sustainable, cognitively aligned strategy for advancing trustworthy AI in real-world environments.</div></div>","PeriodicalId":100684,"journal":{"name":"Intelligent Systems with Applications","volume":"28 ","pages":"Article 200578"},"PeriodicalIF":4.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145061040","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Comprehensive analysis on laser spots adversarial attacks using genetic algorithm 基于遗传算法的激光光点对抗性攻击综合分析

IF 4.3

Intelligent Systems with Applications

Pub Date : 2025-12-01 Epub Date: 2025-11-01 DOI: 10.1016/j.iswa.2025.200598

Youssef Mansour , Ayad Turky , Ibrahim Abaker Hashem , Imad Afyouni , Ali Bou Nassif , Ismail Shahin , Ashraf Elnagar

Deep Neural Networks (DNNs) are highly vulnerable to disruptions caused by minimal noise, yet research on physical attacks leveraging light-based methods remains scarce. Light-based physical attacks are exceptionally stealthy, posing substantial security threats to vision-dependent applications such as autonomous driving. This paper enhances a state-of-the-art light-based physical attack that employs a genetic algorithm to optimize laser spot placement for maximum effectiveness. We expand the algorithm by introducing additional hyperparameters and systematically optimizing them to establish the most efficient workflow for this problem. To our knowledge, this is the first light-based attack capable of reliably performing physical attacks during daylight conditions, making it the most effective and robust approach of its kind. Extensive experiments conducted in a digital environment demonstrate the superiority of the genetic algorithm over random-location methods. By identifying optimal hyperparameter values, we achieve significant improvements in both performance and efficiency. Specifically, we managed to achieve an Attack Success Rate (ASR) of 89.7%, with an Average Query (AQ) of only 109.4, demonstrating a highly efficient and effective approach. The results reveal that laser spots can severely interfere with advanced DNNs, highlighting the critical security risks associated with this technique.

深度神经网络（dnn）极易受到微小噪声造成的干扰，但利用基于光的方法进行物理攻击的研究仍然很少。基于光的物理攻击非常隐蔽，对自动驾驶等依赖视觉的应用构成了巨大的安全威胁。本文改进了一种最先进的基于光的物理攻击，该攻击采用遗传算法来优化激光光斑的放置，以获得最大的效果。我们通过引入额外的超参数来扩展算法，并对它们进行系统优化，以建立最有效的工作流程。据我们所知，这是第一次基于光的攻击，能够在白天条件下可靠地执行物理攻击，使其成为同类中最有效和最强大的方法。在数字环境中进行的大量实验证明了遗传算法比随机定位方法的优越性。通过识别最优的超参数值，我们在性能和效率方面都取得了显著的改进。具体来说，我们设法实现了89.7%的攻击成功率（ASR），平均查询（AQ）仅为109.4，证明了一种高效有效的方法。结果表明，激光光斑可以严重干扰高级dnn，突出了与该技术相关的关键安全风险。

{"title":"Comprehensive analysis on laser spots adversarial attacks using genetic algorithm","authors":"Youssef Mansour , Ayad Turky , Ibrahim Abaker Hashem , Imad Afyouni , Ali Bou Nassif , Ismail Shahin , Ashraf Elnagar","doi":"10.1016/j.iswa.2025.200598","DOIUrl":"10.1016/j.iswa.2025.200598","url":null,"abstract":"<div><div>Deep Neural Networks (DNNs) are highly vulnerable to disruptions caused by minimal noise, yet research on physical attacks leveraging light-based methods remains scarce. Light-based physical attacks are exceptionally stealthy, posing substantial security threats to vision-dependent applications such as autonomous driving. This paper enhances a state-of-the-art light-based physical attack that employs a genetic algorithm to optimize laser spot placement for maximum effectiveness. We expand the algorithm by introducing additional hyperparameters and systematically optimizing them to establish the most efficient workflow for this problem. To our knowledge, this is the first light-based attack capable of reliably performing physical attacks during daylight conditions, making it the most effective and robust approach of its kind. Extensive experiments conducted in a digital environment demonstrate the superiority of the genetic algorithm over random-location methods. By identifying optimal hyperparameter values, we achieve significant improvements in both performance and efficiency. Specifically, we managed to achieve an Attack Success Rate (ASR) of 89.7%, with an Average Query (AQ) of only 109.4, demonstrating a highly efficient and effective approach. The results reveal that laser spots can severely interfere with advanced DNNs, highlighting the critical security risks associated with this technique.</div></div>","PeriodicalId":100684,"journal":{"name":"Intelligent Systems with Applications","volume":"28 ","pages":"Article 200598"},"PeriodicalIF":4.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145465829","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Optimizing printing processes with MCTS 使用MCTS优化打印过程

IF 4.3

Intelligent Systems with Applications

Pub Date : 2025-12-01 Epub Date: 2025-11-10 DOI: 10.1016/j.iswa.2025.200602

Kadri Kukk , Ants Torim , Erki Eessaar , Tarmo Kadak

The printing industry benefits from digitalizing workflows such as customer quoting. Intelligent printing process planning is essential to determine the near-optimal price for automated quoting. This paper addresses the automation of sheet imposition, a critical and computationally intensive step in optimizing the printing process that belongs to the general class of cutting and packing problems. We propose a simple recursive sheet imposition representation as the basis for our algorithms. The Brute Force algorithm for optimizing sheet imposition guarantees the cheapest solution but is computationally infeasible for complex tasks. As alternatives, we investigate heuristic algorithms, specifically Monte Carlo Tree Search (MCTS) and Simulated Annealing (SA). Our findings show that while Brute Force is prohibitively slow, MCTS strikes a robust balance between computational performance and solution quality, consistently finding solutions within a 5% margin of optimal price. Although SA can occasionally find superior solutions, MCTS provides a more reliable and efficient approach by consistently delivering results close to the optimal price.

印刷行业受益于数字化工作流程，如客户报价。智能印刷工艺规划对于确定近乎最优的自动报价价格至关重要。本文讨论了纸张拼版的自动化，这是优化印刷过程的一个关键和计算密集的步骤，属于一般的切割和包装问题。我们提出了一个简单的递归拼版表示作为我们算法的基础。蛮力算法用于优化板材拼装保证了最便宜的解决方案，但计算上不可行的复杂任务。作为替代方案，我们研究了启发式算法，特别是蒙特卡罗树搜索（MCTS）和模拟退火（SA）。我们的研究结果表明，虽然蛮力算法速度非常慢，但MCTS在计算性能和解决方案质量之间取得了良好的平衡，始终在最优价格的5%范围内找到解决方案。虽然SA偶尔可以找到更好的解决方案，但MCTS提供了一种更可靠、更有效的方法，它始终如一地提供接近最优价格的结果。

{"title":"Optimizing printing processes with MCTS","authors":"Kadri Kukk , Ants Torim , Erki Eessaar , Tarmo Kadak","doi":"10.1016/j.iswa.2025.200602","DOIUrl":"10.1016/j.iswa.2025.200602","url":null,"abstract":"<div><div>The printing industry benefits from digitalizing workflows such as customer quoting. Intelligent printing process planning is essential to determine the near-optimal price for automated quoting. This paper addresses the automation of sheet imposition, a critical and computationally intensive step in optimizing the printing process that belongs to the general class of cutting and packing problems. We propose a simple recursive sheet imposition representation as the basis for our algorithms. The Brute Force algorithm for optimizing sheet imposition guarantees the cheapest solution but is computationally infeasible for complex tasks. As alternatives, we investigate heuristic algorithms, specifically Monte Carlo Tree Search (MCTS) and Simulated Annealing (SA). Our findings show that while Brute Force is prohibitively slow, MCTS strikes a robust balance between computational performance and solution quality, consistently finding solutions within a 5% margin of optimal price. Although SA can occasionally find superior solutions, MCTS provides a more reliable and efficient approach by consistently delivering results close to the optimal price.</div></div>","PeriodicalId":100684,"journal":{"name":"Intelligent Systems with Applications","volume":"28 ","pages":"Article 200602"},"PeriodicalIF":4.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145520071","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Towards efficient wafer visual inspection: Exploring novel lightweight approaches for anomaly detection and defect segmentation 迈向高效晶圆视觉检测：探索新的轻量级异常检测和缺陷分割方法

IF 4.3

Intelligent Systems with Applications

Pub Date : 2025-12-01 Epub Date: 2025-09-07 DOI: 10.1016/j.iswa.2025.200576

Ivo Façoco, Rafaela Carvalho, Luís Rosado

The rapid advancement of both wafer manufacturing and AI technologies is reshaping the semiconductor industry. As chip features become smaller and more intricate, the variety and complexity of defects continue to grow, making defect detection increasingly challenging. Meanwhile, AI has made significant strides in unsupervised anomaly detection and supervised defect segmentation, yet its application to wafer inspection remains underexplored. This work bridges these fields by investigating cutting-edge lightweight AI techniques for automated inspection of current generation of silicon wafers. Our study leverages a newly curated dataset comprising 1,055 images of 300 mm wafers, annotated with 6,861 defect labels across seven distinct types, along with PASS/FAIL decisions. From a data-centric perspective, we introduce a novel unsupervised dataset-splitting approach to ensure balanced representation of defect classes and image features. Using the DINO-ViT-S/8 model for feature extraction, our method achieves 96% coverage while maintaining the target 20% test ratio for both individual defects and PASS/FAIL classification. From a model-centric perspective, we benchmark several recent methods for unsupervised anomaly detection and supervised defect segmentation. For unsupervised anomaly detection, EfficientAD obtains the best performance for both pixel-level and image-wise metrics, with F1-scores of 75.14% and 82.35%, respectively. For supervised defect segmentation, UPerNet-Swin achieves the highest performance, with a pixel-level mDice of 47.90 and a mask-level F1-score of 57.45. To facilitate deployment in high-throughput conditions, we conduct a comparative analysis of computational efficiency. Finally, we explore a dual-stage output fusion approach that integrates the best-performing unsupervised anomaly detection and supervised segmentation models to refine PASS/FAIL decisions by incorporating defect severity.

晶圆制造和人工智能技术的快速发展正在重塑半导体产业。随着芯片特征越来越小、越来越复杂，缺陷的种类和复杂性也在不断增加，使得缺陷检测越来越具有挑战性。与此同时，人工智能在无监督异常检测和监督缺陷分割方面取得了重大进展，但其在晶圆检测中的应用仍未得到充分探索。这项工作通过研究用于当前一代硅片自动检测的尖端轻量级人工智能技术，将这些领域联系起来。我们的研究利用了一个新整理的数据集，其中包括1055张300毫米晶圆的图像，标注了7种不同类型的6861个缺陷标签，以及通过/不通过的决定。从以数据为中心的角度来看，我们引入了一种新的无监督数据集分割方法，以确保缺陷类和图像特征的平衡表示。使用dino - viti - s /8模型进行特征提取，我们的方法实现了96%的覆盖率，同时对单个缺陷和PASS/FAIL分类保持20%的目标测试比率。从以模型为中心的角度来看，我们对几种最新的无监督异常检测和监督缺陷分割方法进行了基准测试。对于无监督异常检测，EfficientAD在像素级和图像级指标上都获得了最佳性能，f1得分分别为75.14%和82.35%。对于监督缺陷分割，supernet - swin达到了最高的性能，像素级的mdevice为47.90，掩码级的F1-score为57.45。为了便于在高吞吐量条件下部署，我们对计算效率进行了比较分析。最后，我们探索了一种双阶段输出融合方法，该方法集成了性能最好的无监督异常检测和监督分割模型，通过结合缺陷严重程度来改进PASS/FAIL决策。

{"title":"Towards efficient wafer visual inspection: Exploring novel lightweight approaches for anomaly detection and defect segmentation","authors":"Ivo Façoco, Rafaela Carvalho, Luís Rosado","doi":"10.1016/j.iswa.2025.200576","DOIUrl":"10.1016/j.iswa.2025.200576","url":null,"abstract":"<div><div>The rapid advancement of both wafer manufacturing and AI technologies is reshaping the semiconductor industry. As chip features become smaller and more intricate, the variety and complexity of defects continue to grow, making defect detection increasingly challenging. Meanwhile, AI has made significant strides in unsupervised anomaly detection and supervised defect segmentation, yet its application to wafer inspection remains underexplored. This work bridges these fields by investigating cutting-edge lightweight AI techniques for automated inspection of current generation of silicon wafers. Our study leverages a newly curated dataset comprising 1,055 images of 300 mm wafers, annotated with 6,861 defect labels across seven distinct types, along with PASS/FAIL decisions. From a data-centric perspective, we introduce a novel unsupervised dataset-splitting approach to ensure balanced representation of defect classes and image features. Using the DINO-ViT-S/8 model for feature extraction, our method achieves 96% coverage while maintaining the target 20% test ratio for both individual defects and PASS/FAIL classification. From a model-centric perspective, we benchmark several recent methods for unsupervised anomaly detection and supervised defect segmentation. For unsupervised anomaly detection, EfficientAD obtains the best performance for both pixel-level and image-wise metrics, with F1-scores of 75.14% and 82.35%, respectively. For supervised defect segmentation, UPerNet-Swin achieves the highest performance, with a pixel-level mDice of 47.90 and a mask-level F1-score of 57.45. To facilitate deployment in high-throughput conditions, we conduct a comparative analysis of computational efficiency. Finally, we explore a dual-stage output fusion approach that integrates the best-performing unsupervised anomaly detection and supervised segmentation models to refine PASS/FAIL decisions by incorporating defect severity.</div></div>","PeriodicalId":100684,"journal":{"name":"Intelligent Systems with Applications","volume":"28 ","pages":"Article 200576"},"PeriodicalIF":4.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145021018","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Enhanced radiology report: Leveraging image enhancement and multi-label transfer learning with attention-based text generation 增强放射学报告：利用图像增强和多标签迁移学习与基于注意力的文本生成

IF 4.3

Intelligent Systems with Applications

Pub Date : 2025-12-01 Epub Date: 2025-11-08 DOI: 10.1016/j.iswa.2025.200605

Hilya Tsaniya , Chastine Fatichah , Nanik Suciati , Takashi Obi , Joong-sun Lee

Current research in radiology report generation tend to overlook the utilization of abnormalities depicted in medical images. This study introduces a novel radiology report generator that integrates a multi-label learning approach for predicting abnormality tags and employs transformer models for generating reports. Additionally, the research explores contrast-based image enhancement to mitigate noise in medical images, evaluating its impact on model performance. The multi-label learning is trained on a dataset with 180 abnormality labels and the features used as initial weights for MIMICCXR, as a visual feature extractor.Imbalance handling and ensemble methods are employed to optimize multi-label model performance for abnormality tag prediction. Multi-head attention, in conjunction with GPT-2, facilitates context building for medical report generation, utilizing BERT embeddings for text feature extraction. Evaluation metrics demonstrate that the proposed model achieves superior performance in both multi-label prediction accuracy 77 % and text generation, showing an increase in similarity 28 % in average compared to the baseline model. These findings suggest that leveraging transfer learning with an ensemble classifier, combined with a transformer for context building and decoding, effectively utilizes visual and text features. Furthermore, the incorporation of image enhancement techniques significantly impacts model performance.

目前在放射学报告生成方面的研究往往忽视了对医学图像中所描述的异常的利用。本研究介绍了一种新的放射学报告生成器，它集成了多标签学习方法来预测异常标签，并使用变压器模型来生成报告。此外，研究探讨了基于对比度的图像增强来减轻医学图像中的噪声，评估其对模型性能的影响。多标签学习在具有180个异常标签的数据集上进行训练，这些特征用作MIMICCXR的初始权重，作为视觉特征提取器。采用不平衡处理和集成方法优化多标签模型的性能，用于异常标签预测。多头注意力与GPT-2结合，促进了医学报告生成的上下文构建，利用BERT嵌入进行文本特征提取。评估指标表明，所提出的模型在多标签预测准确率77%和文本生成方面都取得了优异的性能，与基线模型相比，相似度平均提高了28%。这些发现表明，利用集成分类器的迁移学习，结合上下文构建和解码的转换器，可以有效地利用视觉和文本特征。此外，图像增强技术的结合显著影响了模型的性能。

{"title":"Enhanced radiology report: Leveraging image enhancement and multi-label transfer learning with attention-based text generation","authors":"Hilya Tsaniya , Chastine Fatichah , Nanik Suciati , Takashi Obi , Joong-sun Lee","doi":"10.1016/j.iswa.2025.200605","DOIUrl":"10.1016/j.iswa.2025.200605","url":null,"abstract":"<div><div>Current research in radiology report generation tend to overlook the utilization of abnormalities depicted in medical images. This study introduces a novel radiology report generator that integrates a multi-label learning approach for predicting abnormality tags and employs transformer models for generating reports. Additionally, the research explores contrast-based image enhancement to mitigate noise in medical images, evaluating its impact on model performance. The multi-label learning is trained on a dataset with 180 abnormality labels and the features used as initial weights for MIMIC<img>CXR, as a visual feature extractor.Imbalance handling and ensemble methods are employed to optimize multi-label model performance for abnormality tag prediction. Multi-head attention, in conjunction with GPT-2, facilitates context building for medical report generation, utilizing BERT embeddings for text feature extraction. Evaluation metrics demonstrate that the proposed model achieves superior performance in both multi-label prediction accuracy 77 % and text generation, showing an increase in similarity 28 % in average compared to the baseline model. These findings suggest that leveraging transfer learning with an ensemble classifier, combined with a transformer for context building and decoding, effectively utilizes visual and text features. Furthermore, the incorporation of image enhancement techniques significantly impacts model performance.</div></div>","PeriodicalId":100684,"journal":{"name":"Intelligent Systems with Applications","volume":"28 ","pages":"Article 200605"},"PeriodicalIF":4.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145520078","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

AIOps for log anomaly detection in the era of LLMs: A systematic literature review llm时代日志异常检测的AIOps：系统的文献综述

IF 4.3

Intelligent Systems with Applications

Pub Date : 2025-12-01 Epub Date: 2025-11-19 DOI: 10.1016/j.iswa.2025.200608

Miguel De la Cruz Cabello , Tiago Prince Sales , Marcos R. Machado

Modern IT systems generate large volumes of log data that challenge timely and effective anomaly detection. Traditional methods often require intensive feature engineering and struggle to adapt to dynamic operational environments. This Systematic Literature Review (SLR) analyzes how Artificial Intelligence for IT Operations (AIOps) benefits from advanced language models, emphasizing Large Language Models (LLMs) for more effective log anomaly detection. By comparing state-of-art frameworks with LLM-driven methods, this study reveals that prompt engineering – the practice of designing and refining inputs to AI models to produce accurate and useful outputs – and Retrieval Augmented Generation (RAG) boost accuracy and interpretability without extensive fine-tuning. Experimental findings demonstrate that LLM-based approaches significantly outperform traditional methods across evaluation metrics that include F1-score, precision, and recall. Furthermore, the integration of LLMs with RAG techniques has shown a strong adaptability to changing environments. The applicability of these methods also extends to the military industry. Consequently, the development of specialized LLM systems with RAG tailored for the military industry represents a promising research direction to improve operational effectiveness and responsiveness of defense systems.

现代IT系统产生大量的日志数据，这对及时有效的异常检测提出了挑战。传统的方法通常需要密集的特征工程，并且难以适应动态的操作环境。这篇系统性文献综述（SLR）分析了IT运营人工智能（AIOps）如何从高级语言模型中受益，强调了大型语言模型（llm）可以更有效地检测日志异常。通过比较最先进的框架与法学硕士驱动的方法，本研究表明，快速工程（设计和改进人工智能模型输入的实践，以产生准确和有用的输出）和检索增强生成（RAG）提高了准确性和可解释性，而无需进行大量微调。实验结果表明，基于法学硕士的方法在评估指标（包括f1分数、精度和召回率）上明显优于传统方法。此外，法学硕士与RAG技术的集成显示出对不断变化的环境的强大适应性。这些方法的适用性也延伸到军事工业。因此，为军事工业量身定制具有RAG的专用LLM系统的开发代表了一个有前途的研究方向，可以提高国防系统的作战效率和响应能力。

{"title":"AIOps for log anomaly detection in the era of LLMs: A systematic literature review","authors":"Miguel De la Cruz Cabello , Tiago Prince Sales , Marcos R. Machado","doi":"10.1016/j.iswa.2025.200608","DOIUrl":"10.1016/j.iswa.2025.200608","url":null,"abstract":"<div><div>Modern IT systems generate large volumes of log data that challenge timely and effective anomaly detection. Traditional methods often require intensive feature engineering and struggle to adapt to dynamic operational environments. This Systematic Literature Review (SLR) analyzes how Artificial Intelligence for IT Operations (AIOps) benefits from advanced language models, emphasizing Large Language Models (LLMs) for more effective log anomaly detection. By comparing state-of-art frameworks with LLM-driven methods, this study reveals that prompt engineering – the practice of designing and refining inputs to AI models to produce accurate and useful outputs – and Retrieval Augmented Generation (RAG) boost accuracy and interpretability without extensive fine-tuning. Experimental findings demonstrate that LLM-based approaches significantly outperform traditional methods across evaluation metrics that include F1-score, precision, and recall. Furthermore, the integration of LLMs with RAG techniques has shown a strong adaptability to changing environments. The applicability of these methods also extends to the military industry. Consequently, the development of specialized LLM systems with RAG tailored for the military industry represents a promising research direction to improve operational effectiveness and responsiveness of defense systems.</div></div>","PeriodicalId":100684,"journal":{"name":"Intelligent Systems with Applications","volume":"28 ","pages":"Article 200608"},"PeriodicalIF":4.3,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145571740","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0