# ADDAEIL: Anomaly Detection with Drift-Aware Ensemble-Based Incremental Learning
## 1 Introduction
However, updates in MemStream are based on recency of data alone, and there is no mechanism to explicitly detect drift intensity or monitor model degradation. These limitations suggest the need for a more robust adaptive framework. Such frameworks should detect concept drift proactively and perform updates efficiently and effectively. This is particularly important in unsupervised and resource-constrained streaming environments. To move toward this goal, several recent efforts have attempted to incorporate concept drift detection into anomaly detection frameworks such as Performance Weighted Probability Averaging Ensemble (PWPAE) [12] and Variational AutoEncoder for identifying Anomaly Sequences (VAEAS) [4]. However, the effectiveness of such systems is heavily dependent on the drift detection mechanism used. Among the existing concept drift detection strategies, distribution- and performance-based methods are the most widely used due to their simplicity and generalizability [13; 14]. Distribution-based methods monitor statistical changes in the data stream without data labels. However, they are often over-sensitive to minor distributional variations that do not actually impact model performance, leading to unnecessary updates and potential instability [13]. On the other hand, performance-based methods observe drift in the model behavior. Most of them use predictive accuracy or error rates to detect drift. However, they commonly require labeled data, which is rarely available in time series anomaly detection settings. Due to these limitations, neither of them alone is sufficient for robust, unsupervised drift detection in real-world anomaly detection tasks. This highlights the need for a hybrid approach that combines statistical sensitivity with structure-based performance evaluation. Recent methods such as AEADF [15] have explored this direction by combining distribution-based and performance-based drift detection. However, AEADF relies on a fixed update strategy anchored to a static initial model, which limits its adaptability over time. Its drift detection also depends on histogram-based divergence measures and output-based performance evaluations, which may reduce stability and interpretability. These limitations motivate the development of a more flexible and robust hybrid framework. To this end, this paper proposes a novel framework that incorporates hybrid drift detection and incremental model adaptation. The main contributions are summarized as follows:  
1. A novel unsupervised anomaly detection framework: ADDAEIL  
This paper introduces Anomaly Detection with Drift-Aware Ensemble-based Incremental Learning (ADDAEIL), an unsupervised framework for anomaly detection in non-stationary streaming time series. ADDAEIL incrementally updates its ensemble model by selectively replacing drift-affected base detectors. This enables the model to autonomously adapt to evolving data distributions while retaining useful historical knowledge. ADDAEIL is designed for long-term stability and efficient operation without full retraining. These characteristics make it well suited for deployment in resource-constrained environments, such as edge computing. 2. An automated hybrid drift detection mechanism  
To robustly detect concept drift, a hybrid detection module is designed that integrates both distribution-based and performance-based concept drift detection approaches:  
1. Distribution-based detection: Using robust statistical tests, the Kolmogorov-Smirnov (KS) test and Mann-Whitney U (MWU) test, ADDAEIL accurately captures both nuanced global shape and location shifts in data distributions across sliding windows. 2. Performance-based detection: ADDAEIL directly evaluates the distributional changes in path lengths of individual base detectors in iForest, as concept drift affects the decision paths within the tree structure and governs anomaly scoring. By analyzing these changes, it identifies which base detectors are most affected by concept drift from a structural perspective.