Drift-Aware Variational Autoencoder-based Anomaly Detection with Two-level Ensembling
Jin Li, Kleanthis Malialis, Christos G. Panayiotou, Marios M. Polycarpou
TL;DR
The paper tackles online anomaly detection in unlabeled, nonstationary data streams by introducing VAE++ESDD, a drift-aware framework that combines two-level ensembling: multiple VAEs for anomaly scoring and an ensemble of drift detectors to identify concept drift. The method uses incremental learning with diverse training windows and an adaptive reconstruction-loss threshold, plus a dual drift-detection mechanism based on Mann–Whitney tests and warning/alarm signals to trigger model resets and retraining. Extensive ablations and comparisons against state-of-the-art baselines demonstrate that VAE++ESDD achieves high G-mean and PAUC across synthetic and real-world drift scenarios, maintaining robustness under severe class imbalance. The approach advances practical unsupervised online anomaly detection by jointly addressing drift, data imbalance, and unlabeled data, with near real-time operation and scalable computation.
Abstract
In today's digital world, the generation of vast amounts of streaming data in various domains has become ubiquitous. However, many of these data are unlabeled, making it challenging to identify events, particularly anomalies. This task becomes even more formidable in nonstationary environments where model performance can deteriorate over time due to concept drift. To address these challenges, this paper presents a novel method, VAE++ESDD, which employs incremental learning and two-level ensembling: an ensemble of Variational AutoEncoder(VAEs) for anomaly prediction, along with an ensemble of concept drift detectors. Each drift detector utilizes a statistical-based concept drift mechanism. To evaluate the effectiveness of VAE++ESDD, we conduct a comprehensive experimental study using real-world and synthetic datasets characterized by severely or extremely low anomalous rates and various drift characteristics. Our study reveals that the proposed method significantly outperforms both strong baselines and state-of-the-art methods.
