# ADDAEIL: Anomaly Detection with Drift-Aware Ensemble-Based Incremental Learning
## 3 Methodology
### Module 1: Distribution-Based Drift Detection  
To detect the level of concept drift in streaming time series, this module compares the statistical properties of the current data window and the base window using robust, nonparametric hypothesis tests. Let \(T_{b}\in\mathbb{R}^{W}\) denote the base window and \(T_{j}\in\mathbb{R}^{W}\) the current sliding window, each containing \(W\) standardized values from a univariate time series. The base window \(T_{b}\) is updated adaptively as the most recent past window. This is denoted as \(T_{b}=T_{j-1}\), with \(T_{0}\) as the initial training set. This design provides a consistent basis for drift detection by comparing the current window with the most recent window and supports incremental learning over streaming data. The degree of change between \(T_{b}\) and \(T_{j}\) is quantified using two well-established nonparametric statistical tests:  
* **KS test [24]:** The Kolmogorov-Smirnov (KS) test quantifies the maximum distance between the empirical cumulative distribution functions (ECDFs) of two samples: \[D_{\text{KS}}=\sup_{x}\big{|}F_{b}(x)-F_{j}(x)\big{|},\] where \(F_{b}(x)\) and \(F_{j}(x)\) are the ECDFs of the base window \(T_{b}\) and the current window \(T_{j}\), respectively. A larger \(D_{\text{KS}}\) value indicates a stronger distributional difference. The corresponding p-value is given by \[p_{\text{KS}}=Q_{\text{KS}}(D_{\text{KS}})\] where \(Q_{\text{KS}}(\cdot)\) is the complementary cumulative distribution function (CCDF) of the Kolmogorov distribution under the null hypothesis that both samples are drawn from the same distribution. It represents the probability of observing a KS statistic greater than or equal to \(D_{\text{KS}}\). A smaller \(p_{\text{KS}}\) value indicates a stronger statistical rejection of the null hypothesis, suggesting that the two samples likely come from different distributions. The KS test is particularly sensitive to global changes in distribution shape (e.g., spread or skewness), but may be less responsive to subtle shifts in central tendency such as mean or median changes. * **MWU test [26]:** The Mann-Whitney U (MWU) test evaluates whether two samples originate from the same distribution by comparing their central tendencies, particularly the median. The test is non-parametric and based on rank statistics. The U statistic is computed as follows: \[U=\min(U_{b},U_{j}),\quad\text{where}\quad U_{b}=R_{b}-\frac{n_{b}(n_{b}+1)}{ 2},\quad U_{j}=R_{j}-\frac{n_{j}(n_{j}+1)}{2}\] Here, \(R_{b}\) and \(R_{j}\) are the sums of ranks for elements in \(T_{b}\) and \(T_{j}\), respectively, and \(n_{b},n_{j}\) are the sample sizes. The corresponding \(p\)-value is computed as follows: \[p_{\text{MWU}}=F_{\text{MWU}}(U)\] where \(F_{\text{MWU}}(\cdot)\) is the cumulative distribution function (CDF) of the Mann-Whitney U distribution under the null hypothesis that both samples have equal medians. When the sample sizes are sufficiently large, \(F_{\text{MWU}}\) can be approximated by a normal distribution. A smaller \(p_{\text{MWU}}\) value indicates stronger evidence of a location shift (e.g., in the median), suggesting that concept drift may have occurred. The MWU test is particularly sensitive to changes in distribution center, making it complementary to the KS test, which is more responsive to differences in overall shape. The combination of KS and MWU tests enhances the ability to comprehensively detect distributional changes. While MWU captures shifts in location, KS is sensitive to differences in overall distribution shape. Together, they offer a broader and more reliable assessment of distributional shifts, reducing the likelihood of missed changes in streaming data. The unified drift score is defined as follows:  
\[drift\_score=\frac{(1-p_{\text{KS}})+(1-p_{\text{MWU}})}{2}\]  
We use equal-weighted averaging as a simple yet effective combination strategy, reflecting equal importance to shape and location changes. The resulting score lies in \([0,1]\), with higher values indicating stronger evidence of drift.