## 2 Related Work
### Incremental Anomaly Detection  
The time-varying characteristics of data streams require an anomaly detection model to have incremental learning ability. Existing state-of-the-art SIL-based anomaly detection approaches mainly include improved classical machine learning methods and competitive neural networks. [PERSON] [12] proposed a model integrating autoencoder and incremental clustering, providing a reliable machine learning-based monitoring method for electrical applications with varying power cycle patterns. [PERSON] [13] designed a two-layer cluster-based anomaly detection, which is fast, noise-resilient, and incremental, to lower the false alarm rate of real-time anomaly detection for dynamic data. [PERSON] [14] designed a two-stage filtering and hedging algorithm for sequential anomaly detection, where an incremental decision tree is used to construct a multimodal probability density function, and an adaptive thresholding scheme is used to detect anomalies. Furthermore, deep learning is also generally selected as the baseline algorithm for incremental anomaly detection, and its advantage is its spatiotemporal feature-catching ability. [PERSON] [15] proposes the incremental spatiotemporal learner for real-time video surveillance, and the learner is an unsupervised deep-learning module to continuously update and distinguish between new anomalies and normality over time. [PERSON] [16] develops an LSTM-autoencoder-based incremental anomaly detection model to detect machine chatter, not only capturing changes in system dynamics over time but also incrementally improving the detection accuracy via transfer learning. The existing incremental anomaly detection approaches based on improved classical machine learning or deep learning algorithms always aim to design a continuous learning strategy for detected data via an offline setting, paying little attention to evolving data streams. Furthermore, many deep learning-based incremental anomaly detection models focus on learning temporal relationships in local sequences and incrementally updating the initial model, which is not suitable for handling arbitrarily evolving data streams. On the other hand, the optimization of computational overhead for deep anomaly detection models is another challenge for real-time streaming anomaly detection. Competitive neural network-based incremental anomaly detection methods are always shallow neural networks, which can not dynamically learn the data stream characteristics and also have lower computation complexity. Typical algorithms of such methods are the Self-Organizing Incremental Neural Network (SOINN), Growing Neural Gas (GNG), Adaptive Resonance Theory (ART), and their variants. [PERSON] [17] designed a SOINN-based abnormal trajectory detection for efficient video condensation; the feature extraction module can compress the original video size to 10%, while the detection accuracy is maintained at 95%. [PERSON] [18] developed a novel algorithm for fault diagnosis of redundant inertial measurement units. The method introduces SOINN and PCA to achieve high accuracy of tiny faults with low computational complexity. Based on the original GNG algorithm, [PERSON] [19] integrates a fuzzy inference system with GNG for online anomaly detection of data streams; the selection trick of winning neurons in GNG is improved, and the algorithm shows better accuracy on public datasets over existing clustering models. [PERSON] [20] optimizes the adjustment of the learning rate and neuron addition and deletion strategies; the accuracy and computational efficiency of GNG are both improved in online anomaly detection. Therefore, in comparison with improved machine learning models, the competitive neural network-based incremental anomaly detection approach has the disadvantages of good precision and timeliness, which is more suitable for streaming anomaly detection. It is worth noting that promoting the ability to present complex data streams and optimize the adjustment strategy of the network structure is challenging.