# ADDAEIL: Anomaly Detection with Drift-Aware Ensemble-Based Incremental Learning
## 3 Methodology
### Module 2: Performance-Based Drift Detection  
This module assesses the structural alignment of each base detector in \(M_{b}\) by analyzing the change in its path length distributions between consecutive time windows. In iForest, the anomaly score of a sample is determined by the path length required to reach a leaf node. Concept drift alters the data distribution, which in turn affects the decision pathswithin the tree structures of Isolation Forest. As a result, analyzing deviations in path length distributions provides an effective signal of model degradation.  
This effect can be visualized by comparing detector behavior before and after drift. Figure 2 illustrates this intuition using an example from a real-world time series. The left plot shows two consecutive windows before and after a drift event. The right plot compares the path length distributions of a single base detector on these two windows. After drift, the path lengths become more variable and the median shifts significantly, indicating that the detector has become misaligned with the new data.  
To generalize this process across detectors, the following notation is defined: Let \(L_{i}^{(b)}\) and \(L_{i}^{(j)}\) denote the sets of path lengths observed from the \(i\)-th base detector when applied to the baseline window \(T_{b}\) and the current window \(T_{j}\), respectively:  
\[L_{i}^{(b)}=\{\ell_{i,1}^{(b)},\ldots,\ell_{i,W}^{(b)}\},\quad L_{i}^{(j)}=\{ \ell_{i,1}^{(j)},\ldots,\ell_{i,W}^{(j)}\}\]  
For each base detector \(i\in\{1,2,\ldots,N\}\), the MWU test is applied to assess whether the path length distributions have changed significantly. The resulting two-sided p-value \(p_{i}\) quantifies the statistical evidence of change:  
\[p_{i}=\text{MWU}(L_{i}^{(b)},L_{i}^{(j)})\]  
All base detectors are then ranked in ascending order of their \(p_{i}\) values. Detectors with smaller \(p_{i}\) are interpreted as being more affected by drift, and are given higher priority for replacement.  
This structure-based performance evaluation strategy offers several practical advantages. First, it operates entirely unsupervised, without relying on ground truth labels or auxiliary models. Second, it directly monitors changes in internal model behavior. Specifically, it uses the distribution of path lengths, which fundamentally governs anomaly scoring in iForest. A shift in this distribution indicates that the partitioning structure of a base detector no longer matches the current data, signaling potential degradation.  
By analyzing these changes at the structural level, ADDAEIL provides explainable insight into how individual detectors are affected by drift. This enables targeted model adaptation according to structure-based performance evaluation. The procedure is summarized in Algorithm 2.  
Figure 2: Structural impact of concept drift on Isolation Forest. (**Left**) time series segments before and after the concept drift. (**Right**) Path length distributions before and after concept drift. Colored boxes represent distributions for Window A and Window B, with red lines indicating the medians. A clear shift is observed, reflecting detector misalignment.  
```
1:Input: Base model \(M_{b}\) with \(N\) base detectors, windows \(T_{b}\), \(T_{j}\)
2:Output: Ranked list of base detectors: \(ranked\_list\)
3:for\(i=1\) to \(N\)do
4: Compute \(L_{i}^{(b)}\leftarrow\) path length distribution on \(T_{b}\)
5: Compute \(L_{i}^{(j)}\leftarrow\) path length distribution on \(T_{j}\)
6:\(p_{i}\leftarrow\) MWU test between \(L_{i}^{(b)}\) and \(L_{i}^{(j)}\)
7:endfor
8:\(ranked\_list\leftarrow\texttt{argsort}(p_{1},p_{2},\ldots,p_{N})\)
9:return\(ranked\_list\)
```  
**Algorithm 2** Performance-Based