A Graph-based Framework for Online Time Series Anomaly Detection Using Model Ensemble

TL;DR

GDME tackles online anomaly detection for streaming time series by building a dynamic graph of detector score correlations and using community detection to form a nonredundant, diverse ensemble. The framework selects representatives per community through a weighted combination of centrality and pseudo-performance, and detects concept drift from changes in graph structure via a dual drift score $D^{(t)}$. A drift triggers major pool updates (pruning and adding models) while stable periods update only the selected representatives, enabling online adaptation with efficiency. Empirical results on seven heterogeneous datasets show up to a $24\%$ improvement in AUC over baselines, with competitive detection times, demonstrating the practicality of graph-guided online ensemble for diverse time-series patterns.

Abstract

With the increasing volume of streaming data in industrial systems, online anomaly detection has become a critical task. The diverse and rapidly evolving data patterns pose significant challenges for online anomaly detection. Many existing anomaly detection methods are designed for offline settings or have difficulty in handling heterogeneous streaming data effectively. This paper proposes GDME, an unsupervised graph-based framework for online time series anomaly detection using model ensemble. GDME maintains a dynamic model pool that is continuously updated by pruning underperforming models and introducing new ones. It utilizes a dynamic graph structure to represent relationships among models and employs community detection on the graph to select an appropriate subset for ensemble. The graph structure is also used to detect concept drift by monitoring structural changes, allowing the framework to adapt to evolving streaming data. Experiments on seven heterogeneous time series demonstrate that GDME outperforms existing online anomaly detection methods, achieving improvements of up to 24%. In addition, its ensemble strategy provides superior detection performance compared with both individual models and average ensembles, with competitive computational efficiency.

Figures (7)

• Figure 1: Illustration of the GDME Framework.
• Figure 2: Evaluating the Influence of the Concept Drift Threshold on AUC and ADT.
• Figure 3: Evaluating the Influence of the Louvain Resolution Parameter on AUC and ADT.
• Figure 4: Memory–AUC Trade-off Across Methods.
• Figure 5: Impact of $\alpha$ and $\beta$ on AUC.