Abstract:Anomaly detection is of paramount importance in many real-world domains characterized by evolving behavior, such as monitoring cyber-physical systems, human conditions and network traffic. Current research in anomaly detection leverages offline learning working with static data or online learning focusing on constant adaptation to evolving data. At the same time, lifelong learning represents an emerging trend, answering the need for machine learning models that continuously adapt to new challenges in dynamic environments while retaining past knowledge. Although this aspect could be beneficial to build effective and robust anomaly detection models, lifelong learning research is mainly dedicated to proposing new model update strategies in image classification and reinforcement learning domains. The limited scope addressed by lifelong learning works thus far creates a gap in understanding whether such techniques and capabilities can be fruitfully exploited in anomaly detection contexts, which represents the main motivation of this paper. More specifically, anomaly detection provides unique challenges, such as an evolving normal class and limited availability of anomalies, which significantly differs from the landscape and scenarios of lifelong image classification and reinforcement learning. In this paper, we face this issue by exploring, motivating, and discussing lifelong anomaly detection, as well as providing foundations with regard to scenarios, strategies, and metrics. First, we explain why lifelong anomaly detection is relevant, defining challenges and opportunities to design anomaly detection methods that deal with lifelong learning complexities. Second, we formulate and characterize lifelong learning settings tailored for anomaly detection problems, and design a scenario generation procedure that enables researchers to experiment with lifelong anomaly detection using existing datasets. Third, we perform experiments with popular anomaly detection methods on proposed lifelong scenarios, emphasizing the gap in performance that could be filled with the adoption of lifelong learning. In summary, our efforts are directed at assessing the performance of non-lifelong anomaly detection models in lifelong scenarios and how the adoption of lifelong learning impacts their learning capabilities. Overall, we conclude that the adoption of lifelong anomaly detection is important to design more robust models that provide a comprehensive view of the environment, as well as simultaneous adaptation and knowledge retention.

Challenges of Anomaly Detection in the Object-Centric Setting: Dimensions and the Role of Domain Knowledge

Detecting Anomalous Events in Object-centric Business Processes via Graph Neural Networks

Multi-perspective Anomaly Detection in Business Process Execution Events

Advancements and Challenges in Object-Centric Process Mining: A Systematic Literature Review

Object-Centric Event Logs: Specifications, Comparative Analysis and Refinement

Anomaly Mining -- Past, Present and Future

AD-MERCS: Modeling Normality and Abnormality in Unsupervised Anomaly Detection

A Framework for Pattern Mining and Anomaly Detection in Multi-dimensional Time Series and Event Logs

Object-Centric Process Mining: Dealing with Divergence and Convergence in Event Data

Anomaly Detection for Industrial Big Data

Smart Anomaly Detection in Sensor Systems: A Multi-Perspective Review

Applied Machine Learning to Anomaly Detection in Enterprise Purchase Processes

Anomaly detection in cross-country money transfer temporal networks

Knowledge-based anomaly detection: Survey, challenges, and future directions

Extracting Process-Aware Decision Models from Object-Centric Process Data

Lifelong Continual Learning for Anomaly Detection: New Challenges, Perspectives, and Insights

Anomaly Detection in Graph Structured Data: A Survey

Domain-independent detection of known anomalies

Survey and Benchmark of Anomaly Detection in Business Processes

Dynamic and Scalable Data Preparation for Object-Centric Process Mining

Anomaly detection in the CERN cloud infrastructure