# ADDAEIL: Anomaly Detection with Drift-Aware Ensemble-Based Incremental Learning
## 3 Methodology  
### Framework Overview  
The proposed ADDAEIL is an unsupervised ensemble-based anomaly detection framework designed for streaming time series data under non-stationary conditions. Built upon the iForest architecture, ADDAEIL supports incremental concept drift-aware model updating. These characteristics make it particularly suitable for deployment in resource-constrained edge computing environments. An overview of the architecture is shown in Figure 1.  
The framework ADDAEIL operates under a sliding-window paradigm, where the time series data stream is processed in fixed-size windows. The initial model consists of \(N\) base detectors (i.e., decision trees in iForest), each trained on an initial historical training set \(T_{0}\). For each new window \(T_{j}\), the system first evaluates the presence and intensity of concept drift, based on both distribution and performance evaluation. It then incrementally updates the model based on the estimated drift level, ensuring incremental adaptation before performing anomaly detection. To support adaptive learning without full retraining, a drift intensity-guided selective update strategy is implemented. First, module 1 (distribution-based drift detection) employs statistical hypothesis tests to estimate the level of distributional change, and maps this to a replacement ratio. Next, module 2 (performance-based drift detection) evaluates the path length distribution of each base detector. Concept drift affects the tree's decision paths, and deviations in path length indicate which detectors are structurally degraded. From this perspective, the module ranks all base detectors by their level of structural misalignment. In module 3 (model update strategy), a subset of the most drift-affected detectors is replaced by new ones trained on \(T_{j}\), while the remaining detectors are retained. After the update, anomaly scores are computed by aggregating the outputs of all detectors in the updated model. Each module plays a distinct role in enabling incremental, interpretable, and effective adaptation. Interpretability is ensured through transparent statistical tests and structure-based performance evaluation, which together clarify when and why model updates occur. * Module 1: Distribution-based Drift Detection. In the distribution-based drift detection module, the KS test and MWU test are used to simultaneously capture shape and location shifts of the distribution across consecutive windows. The two tests act as complementary statistical measures for drift detection and jointly provide a more complete estimation of drift severity, which can be mapped to the replacement ratios. In other words, these tests can be used to estimate the replacement ratio for model updating according to the drift level in each window. * Module 2: Performance-based Drift Detection. In the performance-based drift detection module, the internal structure of the iForest model is monitored to rank the base detectors according to their replacement priorities. Concept drift will have an impact on the result decision path of the tree structure in Isolation Forest. Analyzing path length deviation will give a very good indication of model performance degradation. Therefore, the framework provides a structure-based detector ranking without requiring additional model training during drift detection. * Module 3: Model Update Strategy. For the model update strategy, a proportion of base detectors is replaced according to the replacement ratio estimated by the distribution-based drift detection module and the base detector ranking from the performance-based drift detection module. The remaining base detectors are preserved, which allows the framework to adaptively retain more useful historical knowledge. Together, these modules form an effective and interpretable framework that delivers robust and efficient anomaly detection under evolving data distributions. In the following  
Figure 1: Overview of the proposed framework ADDAEIL.