## 4 Learning-Based Anomaly Detection
### Classification  
1. Standardization After labeling the normal and abnormal state, we removed the drone-label information and used a total of six variables. The range of input variable values are normalized by a standardization method similar to the pre-processing for clustering. Logistical regression algorithms can be used for binary-categorized variables such as the data labeled in this study. The two possible dependent-variable values, represented by 0 and 1,correspond to the \"normal\" and \"abnormal\" results. Binary logistical models are used to estimate the probability of a binary response based on one or more predictor (or independent) functions.
2. 1D-CNN Classifier The overall architecture of the classifier for anomaly detection is illustrated in Figure 3. The time series data of kinematic variables described in Section 2 is first standardized with the procedure described earlier in this section. The data first passes through 1D-CNN consisting of six hidden layers; at the output end of CNN is connected to dense multi-layer perceptron with sigmoid activation function. The output of this sigmoid activation function is compared with the target label value, and their cross-entropy error as explained in (5) is used to learn the overall neural network by propagating the error backwards. A stochastic gradient method with minibatch is used for learning. Table 2 represents more detailed attributes of the neural network layers, and also parameters used to learn the network. The total number of parameters in the training process is 114,198, which is 446 KB in size. The architecture laid out in Table 2 is determined by at first building a sufficiently large network and then implementing batch normalization [50] to regulate the network.
3. Mini-batch sampling in Adaptive moment estimation (Adam) optimization Most neural network algorithms work best when learning with the same (or similar) amount of data for each class because most algorithms are designed to maximize accuracy and reduce errors. However, if the number of normal and abnormal individuals is considerably different such as in defect classification or abnormal detection, binary classification in such a class-imbalanced circumstance does not produce good results [51]. To mitigate this imbalance, this work generates additional samples to achieve one-to-one ratio of normal and abnormal data when creating batches for Adam [52] optimization adopted for training of the network.  
Let denote the number of data labeled as normal (TN) and abnormal (TA) as \(m_{n}\) and \(m_{a}\), respectively. If sampling to construct a minibatch of size b in the stochastic gradient calculation is done in a uniform way, the expected ratio of the number of data of the two classes will be \(m_{a}/m_{n}\), which can be very small as an anomaly, as it is rare. Therefore, this work suggests copying the abnormal data set \(k\) times and then sample from this expanded set of data. This way the expected ratio between the two classes can be increased to \(km_{a}/m_{n}\). By appropriately choosing \(k\), the effect of imbalance can be mitigated. Numerical results in Section 5.2 demonstrate the effectiveness of this sampling scheme.  
Figure 3: Neural network-based anomaly detection structure.