Online anomaly detection from a data stream is critical for the safety and
security of many applications but is facing severe challenges due to complex
and evolving data streams from IoT devices and cloud-based infrastructures.
Unfortunately, existing approaches fall too short for these challenges; online
anomaly detection methods bear the burden of handling the complexity while
offline deep anomaly detection methods suffer from the evolving data
distribution. This paper presents a framework for online deep anomaly
detection, ARCUS, which can be instantiated with any autoencoder-based deep
anomaly detection methods. It handles the complex and evolving data streams
using an adaptive model pooling approach with two novel techniques:
concept-driven inference and drift-aware model pool update; the former detects
anomalies with a combination of models most appropriate for the complexity, and
the latter adapts the model pool dynamically to fit the evolving data streams.
In comprehensive experiments with ten data sets which are both high-dimensional
and concept-drifted, ARCUS improved the anomaly detection accuracy of the
streaming variants of state-of-the-art autoencoder-based methods and that of
the state-of-the-art streaming anomaly detection methods by up to 22% and 37%,
respectively.

该研究提出了一种名为 ARCUS 的在线深度异常检测框架，它使用自适应模型池方法和两个新技术：概念驱动推理和漂移感知模型池更新来处理来自物联网设备和云基础架构的复杂和不断演化的数据流，并在实验中证明其在高维和概念漂移数据集上提高了最先进的自编码器方法和流式异常检测方法的检测准确性。