Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

METER: A Dynamic Concept Adaptation Framework for Online Anomaly Detection

Jiaqi Zhu, Shaofeng Cai, Fang Deng, Beng Chin Ooi, Wenqiao Zhang

TL;DR

The paper addresses online anomaly detection under concept drift by introducing METER, a dynamic concept adaptation framework. It combines a Static Concept-aware Detector trained on historical central concepts with an Intelligent Evolution Controller for drift signaling and a Dynamic Shift-aware Detector powered by a hypernetwork to generate input-aware parameter shifts, complemented by an Offline Updating Strategy. Through extensive experiments on 17 real-world and 4 synthetic datasets, METER consistently outperforms incremental and ensemble baselines in AUC metrics while maintaining high efficiency and providing interpretable uncertainty via evidential deep learning. The work demonstrates practical impact for real-time, drift-aware anomaly detection in streaming systems and outlines scalable deployment with Flink integration.

Abstract

Real-time analytics and decision-making require online anomaly detection (OAD) to handle drifts in data streams efficiently and effectively. Unfortunately, existing approaches are often constrained by their limited detection capacity and slow adaptation to evolving data streams, inhibiting their efficacy and efficiency in handling concept drift, which is a major challenge in evolving data streams. In this paper, we introduce METER, a novel dynamic concept adaptation framework that introduces a new paradigm for OAD. METER addresses concept drift by first training a base detection model on historical data to capture recurring central concepts, and then learning to dynamically adapt to new concepts in data streams upon detecting concept drift. Particularly, METER employs a novel dynamic concept adaptation technique that leverages a hypernetwork to dynamically generate the parameter shift of the base detection model, providing a more effective and efficient solution than conventional retraining or fine-tuning approaches. Further, METER incorporates a lightweight drift detection controller, underpinned by evidential deep learning, to support robust and interpretable concept drift detection. We conduct an extensive experimental evaluation, and the results show that METER significantly outperforms existing OAD approaches in various application scenarios.

METER: A Dynamic Concept Adaptation Framework for Online Anomaly Detection

TL;DR

The paper addresses online anomaly detection under concept drift by introducing METER, a dynamic concept adaptation framework. It combines a Static Concept-aware Detector trained on historical central concepts with an Intelligent Evolution Controller for drift signaling and a Dynamic Shift-aware Detector powered by a hypernetwork to generate input-aware parameter shifts, complemented by an Offline Updating Strategy. Through extensive experiments on 17 real-world and 4 synthetic datasets, METER consistently outperforms incremental and ensemble baselines in AUC metrics while maintaining high efficiency and providing interpretable uncertainty via evidential deep learning. The work demonstrates practical impact for real-time, drift-aware anomaly detection in streaming systems and outlines scalable deployment with Flink integration.

Abstract

Real-time analytics and decision-making require online anomaly detection (OAD) to handle drifts in data streams efficiently and effectively. Unfortunately, existing approaches are often constrained by their limited detection capacity and slow adaptation to evolving data streams, inhibiting their efficacy and efficiency in handling concept drift, which is a major challenge in evolving data streams. In this paper, we introduce METER, a novel dynamic concept adaptation framework that introduces a new paradigm for OAD. METER addresses concept drift by first training a base detection model on historical data to capture recurring central concepts, and then learning to dynamically adapt to new concepts in data streams upon detecting concept drift. Particularly, METER employs a novel dynamic concept adaptation technique that leverages a hypernetwork to dynamically generate the parameter shift of the base detection model, providing a more effective and efficient solution than conventional retraining or fine-tuning approaches. Further, METER incorporates a lightweight drift detection controller, underpinned by evidential deep learning, to support robust and interpretable concept drift detection. We conduct an extensive experimental evaluation, and the results show that METER significantly outperforms existing OAD approaches in various application scenarios.
Paper Structure (26 sections, 14 equations, 8 figures, 10 tables, 2 algorithms)

This paper contains 26 sections, 14 equations, 8 figures, 10 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Methodology
  4. Overview
  5. Architecture
  6. Static Concept-aware Detector
  7. Intelligent Evolution Controller.
  8. Dynamic Shift-aware Detector
  9. Offline Updating Strategy
  10. Optimization
  11. Analysis and Discussion
  12. Experiments
  13. Experimental Setup
  14. Datasets and Applications
  15. Baseline Methods
  16. ...and 11 more sections

Figures (8)

  • Figure 1: (a) The illustration of the evolving data stream with concept drifts in online anomaly detection (OAD). (b) The three main types of OAD approaches. (c) The functionalities of METER supporting various applications. (d) The comparison of our METER to state-of-the-art OAD approaches on the real-world dataset INSECTS souza2020challenges, where Memstream bhatia2022memstream and ARCUS yoon2022adaptive are representative incremental and ensemble approaches: AUC: 0.816 (METER) > 0.753 (Memstream) > 0.601 (ARCUS), Inference Time: 47 s (METER) < 54 s(Memstream) < 68 s (ARCUS).
  • Figure 2: Overview of the proposed METER. (a) Static Concept-aware Detector (SCD) is first trained on historical data to model the central concepts. (b) Intelligent Evolution Controller (IEC) timely measures the concept uncertainty to determine the necessity of dynamic model evolution. (c) Dynamic Shift-aware Detector (DSD) dynamically updates SCD with the instance-aware parameter shift by considering the concept drift. (d) Offline Updating Strategy (OUS) introduces an effective framework updating strategy according to the accumulated concept uncertainty in a given sliding window.
  • Figure 3: Receiver operating characteristic curves of the top six methods on real-world datasets.
  • Figure 4: Analysis of concept drift adaptation on INSECTS dataset.
  • Figure 5: Ablation analysis. The AURROC and AUCPR performance of six METER variants on INSECTS datasets.
  • ...and 3 more figures

Theorems & Definitions (2)

  • definition 1: Online anomaly detection
  • definition 2: Concept drift