# ADDAEIL: Anomaly Detection with Drift-Aware Ensemble-Based Incremental Learning
## 1 Introduction  
Time series anomaly detection has become increasingly important with the rapid growth of sensors, IoT devices, and real-time monitoring systems. Anomalies often represent unexpected events that may lead to critical consequences, such as financial fraud, system malfunctions, or medical emergencies. Timely detection is essential to mitigate their potential impact, including economic loss, infrastructure disruption, and risks to human wellbeing [1, 2]. Although traditional anomaly detection methods have demonstrated successes under static assumptions, their performance frequently declines as the data distribution changes over time. This phenomenon is known as concept drift [3]. This issue is particularly prevalent in streaming environments, where data rarely follows stationary patterns. Edge computing scenarios further amplify these challenges. This is driven by the fact that full model retraining cannot satisfy the constraints on memory, latency, and energy consumption in edge deployments. Meanwhile, streaming data exhibits non-stationarity, which calls for frequent and costly model retraining. Many real-world applications, such as environmental monitoring, system health tracking, and automated metrics analysis, require timely and adaptive anomaly detection in streaming settings [4]. Unlike video anomaly detection, which identifies rare visual events in high-dimensional spatiotemporal data such as unexpected object movements [5], our work focuses on detecting anomalies in low-dimensional, non-visual time series, such as sensor readings and system logs. These two problem settings differ fundamentally in data modality. Video anomaly detection relies on structured visual data with both spatial and temporal continuity. In contrast, our setting involves sequential numerical data, where each observation is a single scalar value, such as temperature or voltage, recorded over time. This distinction in data modality leads to different definitions of anomalies and detection objectives. In video data, anomalies are defined as unexpected changes in motion or appearance. In contrast, our focus is on abrupt changes or deviations in temporal patterns of numerical data. Ensemble-based methods have recently attracted increasing attention for addressing concept drift in streaming data environments [6; 7; 8]. In these methods, base detectors are designed to evolve over time or to be selectively replaced in response to distributional changes. This kind of model structure supports long-term adaptation without requiring full model retraining. However, ensemble frameworks specifically designed for unsupervised anomaly detection remain relatively limited. Most existing efforts target supervised classification tasks, and few have explored unsupervised ensemble designs for anomaly detection under non-stationary conditions. Among unsupervised ensemble approaches, Isolation Forest [9] (iForest) has emerged as the most widely used model for anomaly detection. It is well recognized for its efficiency, scalability, and robustness in fully unsupervised settings, where labeled data is often unavailable. Its low computational overhead makes it even more attractive for edge computing applications, where resource constraints are critical. Nevertheless, iForest and its variants are typically built under static training assumptions and do not incorporate any inherent mechanisms for model adaptation. As a result, their detection performance tends to degrade over time when facing non-stationary data streams affected by concept drift. Several methods have been proposed to support anomaly detection in data streams. For example, the Lightweight Online Detector of Anomalies (LODA) [10] is an ensemble-based approach using random projections and sparse histograms. It provides efficient scoring but lacks any form of model adaptation. MemStream [11] introduces a memory-augmented architecture that incrementally adapts to concept drift.