Abstract Anomaly detection provides an effective decision support capability in several real-world domains. One limitation of conventional approaches is their inability to preserve knowledge as models are constantly updated with recent data, leading to catastrophic forgetting. Continual learning approaches overcome this limitation by providing strategies that provide a trade-off between model stability and plasticity. However, to deal with concept-agnostic scenarios, transitions between tasks/concepts must be detected and provided as auxiliary information to the models. While change point detection methods are a natural fit, the most effective ones for complex and evolving data rely on choosing an appropriate distance measure. However, a fundamental knowledge gap in current research stands in how distance measures for change point detection impact models’ ability to adapt and perform over time as new concepts emerge from evolving data. In this paper, we address this issue by proposing a modular approach to identify transitions in concept-agnostic scenarios and investigating how different distances in change detection affect the predictive performance of anomaly detection models in continual learning scenarios. We perform experiments with different continual learning strategies and compare them with concept-incremental scenarios across multiple real-world datasets. Our key results highlight that it is feasible to perform concept-agnostic learning with a small decline in anomaly detection performance compared to concept-incremental. Moreover, this decline can be mitigated with proper selection of the distance measure for change detection. Finally, our results reveal that even moderately accurate identification of changes can lead to competitive anomaly detection performance.

The recently proposed xLSTM is a powerful model that leverages expressive multiplicative gating and residual connections, providing the temporal capacity needed for long-horizon forecasting and representation learning. This architecture has demonstrated success in time series forecasting, lossless compression, and even large-scale language modeling tasks, where its linear memory footprint and fast inference make it a viable alternative to Transformers. Despite its growing popularity, no prior work has explored xLSTM for anomaly detection. In this work, we fill this gap by proposing xLSTMAD, the first anomaly detection method that integrates a full encoder-decoder xLSTM architecture, purpose-built for multivariate time series data. Our encoder processes input sequences to capture historical context, while the decoder is devised in two separate variants of the method. In the forecasting approach, the decoder iteratively generates forecasted future values xLSTMAD-F, while the reconstruction approach reconstructs the input time series from its encoded counterpart xLSTMAD-R. We investigate the performance of two loss functions: Mean Squared Error (MSE), and Soft Dynamic Time Warping (SoftDTW) to consider local reconstruction fidelity and global sequence alignment, respectively. We evaluate our method on the comprehensive TSB-AD-M benchmark, which spans 17 real-world datasets, using state-of-the-art challenging metrics such as VUS-PR. In our results, xLSTM showcases state-of-the-art accuracy, outperforming 23 popular anomaly detection baselines. Our paper is the first work revealing the powerful modeling capabilities of xLSTM for anomaly detection, paving the way for exciting new developments on this subject. Our code is available at: https://github.com/Nyderx/xlstmad.

Efficient flight scheduling is crucial to properly allocate airline resources, but even the best flight schedule has to face unexpected delays and disruptions. The ability to recover from such disruptions is essential for airlines to minimize the negative impact on their revenue and reputation. In this context, machine learning-based methods can be used to identify suitable recovery methods as unexpected events occur. Reinforcement learning approaches are especially promising since they extract suitable solutions much more efficiently than conventional optimization and meta-heuristics methods and provide timely rescheduling capabilities for airlines, which translates into reduced capital and reputation losses. However, current works either do not leverage deep learning or focus on simple scenarios that do not fully entail real-world complexities, resulting in limited efficiency or sub-optimal solutions. In this paper, we propose an ensemble of two deep learning approaches: Deep Double Q-Learning (DDQL) and Advantage Actor-Critic (A2C). The models aim to minimize the total delays caused by disruptions by swapping aircraft and delaying flights as recovery options. We perform experiments with a benchmark dataset and a real-world airline dataset, showing that our method is effective in providing a significant reduction of delays caused by disruptions.

Intrusion Detection System is a strategic analytical tool for the security of organizations and institutions. Among existing approaches, distributed and collaborative intrusion detection approaches are particularly effective since they combine data analysis from multiple sources to provide increased model robustness. Although many state-of-the-art approaches have the ability to adapt to evolving environments and incoming data, they are subject to catastrophic forgetting of past knowledge. At the same time, recent works in lifelong continual anomaly detection showcase the merit of simultaneous adaptation and knowledge retention. However, lifelong methods are thus far limited to the analysis of a single data source and do not provide distributed and collaborative learning capabilities. In this paper, we fill this gap by proposing a novel distributed continual learning intrusion detection framework with collaborative experience replay. The system is built from independent Detection Nodes and a Continual Learning Center. While the nodes are in charge of data selection and intrusion detection, the Continual Learning Center implements a collaborative replay strategy, performs model updates, and broadcasts the most recent model to the nodes. The separation of responsibilities allows for the decomposition of the system into task-oriented services, leading to a modular, flexible, and scalable architecture. An extensive evaluation involving popular network intrusion detection datasets shows the potential of our framework and the improvement in detection performance that can be achieved with the collaborative replay strategy.

Anomaly detection tools present the potential to enhance defense policies and protection against different types of threats, supporting public safety and national security. Lifelong anomaly detection showcases new and challenging scenarios in which models are challenged to automatically adapt to changing conditions without forgetting past knowledge. However, the presence of anomalies in incoming data may significantly impact the robustness of models in such scenarios. Although active learning strategies could be an asset to increase model longevity and robustness, they have never been explored in this context. In this paper, we propose an active lifelong anomaly detection framework for class-incremental scenarios that supports any memory-based experience replay method, any query strategy, and any anomaly detection model. While experience replay allows models to consolidate past knowledge and simultaneously adapt to new knowledge, an active learning module reduces the number of anomalies memorized in the replay buffer. We propose two strategies that automatically identify and remove additional data points that are likely to be anomalies based on the oracle’s feedback. Our experiments on popular host-based and network-based intrusion detection datasets show that our framework can improve the anomaly detection performance of models under low labeling budget constraints.

Detecting relevant changes in dynamic time series data in a timely manner is crucially important for many data analysis tasks in real-world settings. Change point detection methods have the ability to discover changes in an unsupervised fashion, which represents a desirable property in the analysis of unbounded and unlabeled data streams. However, one limitation of most of the existing approaches is represented by their limited ability to handle multivariate and high-dimensional data, which is frequently observed in modern applications such as traffic flow prediction, human activity recognition, and smart grids monitoring. In this paper, we attempt to fill this gap by proposing WATCH, a novel Wasserstein distance-based change point detection approach that models an initial distribution and monitors its behavior while processing new data points, providing accurate and robust detection of change points in dynamic high-dimensional data. An extensive experimental evaluation involving a large number of benchmark datasets shows that WATCH is capable of accurately identifying change points and outperforming state-of-the-art methods.