Catching Every Ripple: Enhanced Anomaly Awareness via Dynamic Concept Adaptation

TL;DR

DyMETER is a novel online anomaly detection framework that dynamically adapts to concept drift using a hypernetwork and adaptive thresholding, eliminating the need for retraining.

Contribution

It introduces a unified online paradigm combining on-the-fly parameter shifting and dynamic thresholding with a hypernetwork-based adaptation mechanism.

Findings

DyMETER outperforms existing methods across various scenarios.

It effectively adapts to concept drift without retraining or fine-tuning.

The framework maintains high detection accuracy in dynamic environments.

Abstract

Online anomaly detection (OAD) plays a pivotal role in real-time analytics and decision-making for evolving data streams. However, existing methods often rely on costly retraining and rigid decision boundaries, limiting their ability to adapt both effectively and efficiently to concept drift in dynamic environments. To address these challenges, we propose DyMETER, a dynamic concept adaptation framework for OAD that unifies on-the-fly parameter shifting and dynamic thresholding within a single online paradigm. DyMETER first learns a static detector on historical data to capture recurring central concepts, and then transitions to a dynamic mode to adapt to new concepts as drift occurs. Specifically, DyMETER employs a novel dynamic concept adaptation mechanism that leverages a hypernetwork to generate instance-aware parameter shifts for the static detector, thereby enabling efficient and effective adaptation without retraining or fine-tuning. To achieve robust and interpretable adaptation, DyMETER introduces a lightweight evolution controller to estimate instance-level concept uncertainty for adaptive updates. Further, DyMETER employs a dynamic threshold optimization module to adaptively recalibrates the decision boundary by maintaining a candidate window of uncertain samples, which ensures continuous alignment with evolving concepts. Extensive experiments demonstrate that DyMETER significantly outperforms existing OAD approaches across a wide spectrum of application scenarios.