# ADDAEIL: Anomaly Detection with Drift-Aware Ensemble-Based Incremental Learning
## 2 Related Work  
### Time Series Anomaly Detection Under Concept Drift  
Anomaly detection in data streams is challenging due to concept drift, where the distribution of the data changes over time. Traditional anomaly detection approachesassume stationarity and are based on offline trained models. Thus, they suffer performance drops in real-world non-stationary scenarios [1; 3]. Classical unsupervised methods such as iForest [9] and Empirical-Cumulative-distribution-based Outlier Detection (ECOD) [16] are unsupervised approaches assuming stationarity of data. Their performance will degrade when applied to non-stationary data. The state-of-the-art spectrum decomposition-based framework [17] achieves promising performance on stationary time series. However, this method assumes the data distribution remains the same. In practice, the data distribution rarely remains stationary in streaming scenarios, so this method cannot handle distributional drift. To address these challenges, some partially adaptive methods have been proposed. LODA [10] applies random projections and histogram-based scoring to support streaming detection. Although its randomized features provide some robustness to minor drift, it lacks explicit drift detection and model adaptation. As a result, it functions as a static model throughout the deployment. Several other approaches aim to improve adaptability in evolving environments. LSTM-VAE [18] model captures temporal dependencies and offers limited robustness to gradual drift, but lacks explicit mechanisms to detect or respond to distributional changes. Context-aware Domain Adaptation [19] tries to align the source and target domains using contextual information. However, these methods usually assume static and predefined domain boundaries, which are usually not satisfied in streaming scenarios where the drift is continuous and unstructured. MemStream [11] uses a memory buffer to update models online. However, the update process is driven by data recency. This method is not capable of monitoring drift intensity or model performance degradation, which can lead to delayed or suboptimal adaptation. Although the above methods exhibit different levels of adaptability, none of them contains a concept drift detection component, which limits their responsiveness to large distributional changes. Recently, there have been some attempts to introduce explicit concept drift detection to unsupervised anomaly detection. Most of these approaches focus on either distribution-based or performance-based evidence, while rarely combining the two. The PWPAE framework [12] follows a performance-based strategy. It uses detectors such as the Drift Detection Method (DDM) [20] and Adaptive Windowing (ADWIN) [21], which detect drift by tracking changes in prediction errors or output statistics. These methods usually rely on label data or assumptions of prediction stability, which are often not available in unsupervised scenarios. In contrast, state-transition-aware anomaly detection under concept drifts (STAD) [22] employs a distribution-based approach by applying KS and AD tests within the latent space of an autoencoder. This enables the detection of subtle changes in data representation. However, STAD does not monitor the performance or internal structural alignment of the model. Its sensitivity to drift is limited by the encoder's ability to consistently capture meaningful features. VAEAS [4] introduces a dual-drift detection strategy by combining statistical testing and performance-based signals within the latent space. However, its statistical tests are conducted exclusively on encoded representations, assuming that the latent space fully reflects changes in the input distribution. If the encoder fails to adapt, important distributional shifts may go undetected. Consequently, despite its hybrid formulation, VAEAS lacks true distribution-level drift detection at the input level, and its effectiveness is constrained by the quality of latent representations.