{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,27]],"date-time":"2026-05-27T17:13:53Z","timestamp":1779902033080,"version":"3.53.1"},"reference-count":52,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2025,6,3]],"date-time":"2025-06-03T00:00:00Z","timestamp":1748908800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,6,3]],"date-time":"2025-06-03T00:00:00Z","timestamp":1748908800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Intell Inf Syst"],"published-print":{"date-parts":[[2026,2]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Anomaly detection provides an effective decision support capability in several real-world domains. One limitation of conventional approaches is their inability to preserve knowledge as models are constantly updated with recent data, leading to catastrophic forgetting. Continual learning approaches overcome this limitation by providing strategies that provide a trade-off between model stability and plasticity. However, to deal with concept-agnostic scenarios, transitions between tasks\/concepts must be detected and provided as auxiliary information to the models. While change point detection methods are a natural fit, the most effective ones for complex and evolving data rely on choosing an appropriate distance measure. However, a fundamental knowledge gap in current research stands in how distance measures for change point detection impact models\u2019 ability to adapt and perform over time as new concepts emerge from evolving data. In this paper, we address this issue by proposing a modular approach to identify transitions in concept-agnostic scenarios and investigating how different distances in change detection affect the predictive performance of anomaly detection models in continual learning scenarios. We perform experiments with different continual learning strategies and compare them with concept-incremental scenarios across multiple real-world datasets. Our key results highlight that it is feasible to perform concept-agnostic learning with a small decline in anomaly detection performance compared to concept-incremental. Moreover, this decline can be mitigated with proper selection of the distance measure for change detection. Finally, our results reveal that even moderately accurate identification of changes can lead to competitive anomaly detection performance.<\/jats:p>","DOI":"10.1007\/s10844-025-00949-1","type":"journal-article","created":{"date-parts":[[2025,6,3]],"date-time":"2025-06-03T03:13:54Z","timestamp":1748920434000},"page":"37-75","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Distance-based change point detection for novelty detection in concept-agnostic continual anomaly detection"],"prefix":"10.1007","volume":"64","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-3963-4721","authenticated-orcid":false,"given":"Collin","family":"Coil","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4221-0017","authenticated-orcid":false,"given":"Kamil","family":"Faber","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4206-9052","authenticated-orcid":false,"given":"Bartlomiej","family":"Sniezynski","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8366-6059","authenticated-orcid":false,"given":"Roberto","family":"Corizzo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,6,3]]},"reference":[{"key":"949_CR1","doi-asserted-by":"crossref","unstructured":"Al-Essa, M., Andresini, G., Appice, A., et\u00a0al. (2024). Panacea: a neural model ensemble for cyber-threat detection. Machine Learning 1\u201344","DOI":"10.1109\/DSAA60987.2023.10302518"},{"key":"949_CR2","doi-asserted-by":"crossref","unstructured":"Amalapuram, SK., Reddy\u00a0Tamma, B., Channappayya, SS. (2024). Spider: A semi-supervised continual learning-based network intrusion detection system. In: IEEE INFOCOM 2024 - IEEE Conference on Computer Communications, 571\u2013580","DOI":"10.1109\/INFOCOM52122.2024.10621428"},{"issue":"2","key":"949_CR3","doi-asserted-by":"publisher","first-page":"339","DOI":"10.1007\/s10115-016-0987-z","volume":"51","author":"S Aminikhanghahi","year":"2017","unstructured":"Aminikhanghahi, S., & Cook, D. J. (2017). A survey of methods for time series change point detection. Knowledge and Information Systems, 51(2), 339\u2013367.","journal-title":"Knowledge and Information Systems"},{"key":"949_CR4","doi-asserted-by":"crossref","unstructured":"Andresini, G., Pendlebury, F., Pierazzi, F., et\u00a0al. (2021). Insomnia: Towards concept-drift robustness in network intrusion detection. In: Proceedings of the 14th ACM workshop on artificial intelligence and security, 111\u2013122","DOI":"10.1145\/3474369.3486864"},{"key":"949_CR5","doi-asserted-by":"crossref","unstructured":"Breunig, MM., Kriegel, HP., Ng, RT., et\u00a0al. (2000). Lof: identifying density-based local outliers. In: Proceedings of the 2000 ACM SIGMOD international conference on Management of data, 93\u2013104","DOI":"10.1145\/342009.335388"},{"key":"949_CR6","doi-asserted-by":"crossref","unstructured":"Bugarin, N., Bugaric, J., Barusco, M., et\u00a0al. (2024). Unveiling the anomalies in an ever-changing world: A benchmark for pixel-level anomaly detection in continual learning. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 4065\u20134074","DOI":"10.1109\/CVPRW63382.2024.00410"},{"key":"949_CR7","doi-asserted-by":"crossref","unstructured":"Buzzega, P., Boschini, M., Porrello, A., et\u00a0al. (2021). Rethinking experience replay: a bag of tricks for continual learning. In: 2020 25th International Conference on Pattern Recognition (ICPR), IEEE, 2180\u20132187","DOI":"10.1109\/ICPR48806.2021.9412614"},{"key":"949_CR8","doi-asserted-by":"crossref","unstructured":"Cai, S., Tang, H., Chen, J., et al. (2025). Cdda-md: An efficient malicious traffic detection method based on concept drift detection and adaptation technique. Computers & Security,148, 104121","DOI":"10.1016\/j.cose.2024.104121"},{"key":"949_CR9","doi-asserted-by":"crossref","unstructured":"Coil, C., Corizzo, R. (2024). Assessing distance measures for change point detection in continual learning scenarios. In: International Symposium on Methodologies for Intelligent Systems, Springer, 260\u2013270","DOI":"10.1007\/978-3-031-62700-2_23"},{"key":"949_CR10","doi-asserted-by":"crossref","unstructured":"Corizzo, R., Ceci, M., Pio, G., et\u00a0al. (2021). Spatially-aware autoencoders for detecting contextual anomalies in geo-distributed data. In: International Conference on Discovery Science, Springer, 461\u2013471","DOI":"10.1007\/978-3-030-88942-5_36"},{"key":"949_CR11","doi-asserted-by":"crossref","unstructured":"Davis, J., Goadrich, M. (2006). The relationship between precision-recall and roc curves. In: Proceedings of the 23rd international conference on Machine learning, 233\u2013240","DOI":"10.1145\/1143844.1143874"},{"key":"949_CR12","unstructured":"D\u00edaz-Rodr\u00edguez, N., Lomonaco, V., Filliat, D., et\u00a0al. (2018). Don\u2019t forget, there is more than forgetting: new metrics for continual learning. arXiv:1810.13166"},{"key":"949_CR13","doi-asserted-by":"crossref","unstructured":"Doshi, K., Yilmaz, Y. (2020). Continual learning for anomaly detection in surveillance videos. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition workshops, 254\u2013255","DOI":"10.1109\/CVPRW50498.2020.00135"},{"key":"949_CR14","doi-asserted-by":"crossref","unstructured":"Du, H., Duan, Z. (2021). Finder: A novel approach of change point detection for multivariate time series. Applied Intelligence","DOI":"10.1007\/s10489-021-02532-x"},{"key":"949_CR15","doi-asserted-by":"crossref","unstructured":"Duan, G., Lv, H., Wang, H., et\u00a0al. (2024). Practical cyber attack detection with continuous temporal graph in dynamic network system. IEEE Transactions on Information Forensics and Security","DOI":"10.1109\/TIFS.2024.3385321"},{"key":"949_CR16","doi-asserted-by":"crossref","unstructured":"Faber, K., Corizzo, R., Sniezynski, B., et\u00a0al. (2021). Watch: Wasserstein change point detection for high-dimensional time series data. In: 2021 IEEE International Conference on Big Data (Big Data), IEEE, 4450\u20134459","DOI":"10.1109\/BigData52589.2021.9671962"},{"key":"949_CR17","doi-asserted-by":"crossref","unstructured":"Faber, K., Corizzo, R., Sniezynski, B., et\u00a0al. (2022). Lifewatch: Lifelong wasserstein change point detection. In: 2022 International Joint Conference on Neural Networks (IJCNN), IEEE, 1\u20138","DOI":"10.1109\/IJCNN55064.2022.9892891"},{"key":"949_CR18","doi-asserted-by":"crossref","unstructured":"Faber, K., Corizzo, R., Sniezynski, B., et\u00a0al. (2023a). Vlad: Task-agnostic vae-based lifelong anomaly detection. Neural Networks","DOI":"10.1016\/j.neunet.2023.05.032"},{"key":"949_CR19","doi-asserted-by":"crossref","unstructured":"Faber, K., Sniezynski, B., Corizzo, R. (2023b). Distributed continual intrusion detection: A collaborative replay framework. In: 2023 IEEE International Conference on Big Data (BigData), IEEE, 3255\u20133263","DOI":"10.1109\/BigData59044.2023.10386211"},{"key":"949_CR20","doi-asserted-by":"publisher","first-page":"41364","DOI":"10.1109\/ACCESS.2024.3377690","volume":"12","author":"K Faber","year":"2024","unstructured":"Faber, K., Corizzo, R., Sniezynski, B., et al. (2024). Lifelong continual learning for anomaly detection: New challenges, perspectives, and insights. IEEE Access, 12, 41364\u201341380.","journal-title":"IEEE Access"},{"issue":"525","key":"949_CR21","doi-asserted-by":"publisher","first-page":"169","DOI":"10.1080\/01621459.2017.1385466","volume":"114","author":"P Fearnhead","year":"2019","unstructured":"Fearnhead, P., & Rigaill, G. (2019). Changepoint detection in the presence of outliers. Journal of the American Statistical Association, 114(525), 169\u2013183.","journal-title":"Journal of the American Statistical Association"},{"key":"949_CR22","doi-asserted-by":"crossref","unstructured":"Frikha, A., Krompa\u00df, D., Tresp, V. (2021). Arcade: A rapid continual anomaly detector. In: 2020 25th International Conference on Pattern Recognition (ICPR), IEEE, 10449\u201310456","DOI":"10.1109\/ICPR48806.2021.9412627"},{"issue":"6","key":"949_CR23","doi-asserted-by":"publisher","first-page":"2243","DOI":"10.1214\/14-AOS1245","volume":"42","author":"P Fryzlewicz","year":"2014","unstructured":"Fryzlewicz, P. (2014). Wild binary segmentation for multiple change-point detection. The Annals of Statistics, 42(6), 2243\u20132281.","journal-title":"The Annals of Statistics"},{"key":"949_CR24","doi-asserted-by":"crossref","unstructured":"Goldstein, M., & Uchida, S. (2016). A comparative evaluation of unsupervised anomaly detection algorithms for multivariate data. PloS one,11(4), Article e0152173.","DOI":"10.1371\/journal.pone.0152173"},{"issue":"5","key":"949_CR25","doi-asserted-by":"publisher","first-page":"1293","DOI":"10.1007\/s11222-016-9687-5","volume":"27","author":"K Haynes","year":"2017","unstructured":"Haynes, K., Fearnhead, P., & Eckley, I. A. (2017). A computationally efficient nonparametric approach for changepoint detection. Statistics and Computing, 27(5), 1293\u20131305.","journal-title":"Statistics and Computing"},{"key":"949_CR26","doi-asserted-by":"crossref","unstructured":"Hinkley, DV. (1970). Inference about the change-point in a sequence of random variables","DOI":"10.2307\/2334932"},{"key":"949_CR27","unstructured":"Holm, S. (1979). A simple sequentially rejective multiple test procedure. Scandinavian Journal of Statistics 65\u201370"},{"issue":"500","key":"949_CR28","doi-asserted-by":"publisher","first-page":"1590","DOI":"10.1080\/01621459.2012.737745","volume":"107","author":"R Killick","year":"2012","unstructured":"Killick, R., Fearnhead, P., & Eckley, I. A. (2012). Optimal detection of changepoints with a linear computational cost. Journal of the American Statistical Association, 107(500), 1590\u20131598.","journal-title":"Journal of the American Statistical Association"},{"key":"949_CR29","first-page":"64","volume":"31","author":"J Knoblauch","year":"2018","unstructured":"Knoblauch, J., Jewson, J. E., & Damoulas, T. (2018). Doubly robust bayesian inference for non-stationary streaming data with beta-divergences. Advances in Neural Information Processing Systems, 31, 64\u201375.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"949_CR30","doi-asserted-by":"crossref","unstructured":"Kriegel, HP., Schubert, M., Zimek, A. (2008). Angle-based outlier detection in high-dimensional data. In: Proceedings of the 14th ACM SIGKDD international conference on Knowledge discovery and data mining, 444\u2013452","DOI":"10.1145\/1401890.1401946"},{"key":"949_CR31","doi-asserted-by":"crossref","unstructured":"Lebichot, B., Siblini, W., Paldino, G., et al. (2024). Assessment of catastrophic forgetting in continual credit card fraud detection. Expert Systems with Applications,249, Article 123445.","DOI":"10.1016\/j.eswa.2024.123445"},{"key":"949_CR32","doi-asserted-by":"crossref","unstructured":"Li, W., Zhan, J., Wang, J., et\u00a0al. (2022). Towards continual adaptation in industrial anomaly detection. In: Proceedings of the 30th ACM International Conference on Multimedia, 2871\u20132880","DOI":"10.1145\/3503161.3548232"},{"key":"949_CR33","doi-asserted-by":"crossref","unstructured":"Li, Z., Zhao, Y., Botta, N., et\u00a0al. (2020). Copod: copula-based outlier detection. In: 2020 IEEE International Conference on Data Mining (ICDM), IEEE, 1118\u20131123","DOI":"10.1109\/ICDM50108.2020.00135"},{"key":"949_CR34","doi-asserted-by":"crossref","unstructured":"Liu, FT., Ting, KM., Zhou, ZH. (2008). Isolation forest. In: 2008 Eighth IEEE International Conference on Data Mining, IEEE, 413\u2013422","DOI":"10.1109\/ICDM.2008.17"},{"issue":"4","key":"949_CR35","doi-asserted-by":"publisher","first-page":"3639","DOI":"10.1609\/aaai.v38i4.28153","volume":"38","author":"J Liu","year":"2024","unstructured":"Liu, J., Wu, K., Nie, Q., et al. (2024). Unsupervised continual anomaly detection with contrastively-learned prompt. Proceedings of the AAAI Conference on Artificial Intelligence, 38(4), 3639\u20133647.","journal-title":"Proceedings of the AAAI Conference on Artificial Intelligence"},{"key":"949_CR36","doi-asserted-by":"crossref","unstructured":"Mallya, A., Lazebnik, S. (2018). Packnet: Adding multiple tasks to a single network by iterative pruning. In: Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, 7765\u20137773","DOI":"10.1109\/CVPR.2018.00810"},{"issue":"505","key":"949_CR37","doi-asserted-by":"publisher","first-page":"334","DOI":"10.1080\/01621459.2013.849605","volume":"109","author":"DS Matteson","year":"2014","unstructured":"Matteson, D. S., & James, N. A. (2014). A nonparametric approach for multiple change point analysis of multivariate data. Journal of the American Statistical Association, 109(505), 334\u2013345.","journal-title":"Journal of the American Statistical Association"},{"key":"949_CR38","doi-asserted-by":"crossref","unstructured":"Moustafa, N., Slay, J. (2015). Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In: 2015 Military Communications and Information Systems Conference (MilCIS), 1\u20136","DOI":"10.1109\/MilCIS.2015.7348942"},{"issue":"2","key":"949_CR39","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3439950","volume":"54","author":"G Pang","year":"2021","unstructured":"Pang, G., Shen, C., Cao, L., et al. (2021). Deep learning for anomaly detection: A review. ACM Computing Surveys (CSUR), 54(2), 1\u201338.","journal-title":"ACM Computing Surveys (CSUR)"},{"key":"949_CR40","doi-asserted-by":"publisher","first-page":"54","DOI":"10.1016\/j.neunet.2019.01.012","volume":"113","author":"GI Parisi","year":"2019","unstructured":"Parisi, G. I., Kemker, R., Part, J. L., et al. (2019). Continual lifelong learning with neural networks: A review. Neural Networks, 113, 54\u201371.","journal-title":"Neural Networks"},{"key":"949_CR41","doi-asserted-by":"publisher","first-page":"137","DOI":"10.1016\/j.neunet.2017.09.001","volume":"96","author":"GI Parisi","year":"2017","unstructured":"Parisi, G. I., Tani, J., Weber, C., et al. (2017). Lifelong learning of human actions with deep neural network self-organization. Neural Networks, 96, 137\u2013149.","journal-title":"Neural Networks"},{"key":"949_CR42","doi-asserted-by":"crossref","unstructured":"Richardson, E., Trevizani, R., Greenbaum, J. A., et al. (2024). The receiver operating characteristic curve accurately assesses imbalanced datasets. Patterns,5(6), Article 100994.","DOI":"10.1016\/j.patter.2024.100994"},{"key":"949_CR43","unstructured":"Sch\u00f6lkopf, B., Williamson, RC., Smola, AJ., et\u00a0al. (2000). Support vector method for novelty detection. In: Advances in neural information processing systems, 582\u2013588"},{"key":"949_CR44","doi-asserted-by":"crossref","unstructured":"Sengupta, S., Basak, S., Saikia, P., et al. (2020). A review of deep learning with special emphasis on architectures, applications and recent trends. Knowledge-Based Systems,194, Article 105596.","DOI":"10.1016\/j.knosys.2020.105596"},{"key":"949_CR45","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, AH., Ghorbani, AA. (2018). Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: International Conference on Information Systems Security and Privacy","DOI":"10.5220\/0006639801080116"},{"key":"949_CR46","doi-asserted-by":"crossref","unstructured":"Sharif\u00a0Razavian, A., Azizpour, H., Sullivan, J., et\u00a0al. (2014). Cnn features off-the-shelf: an astounding baseline for recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition workshops, 806\u2013813","DOI":"10.1109\/CVPRW.2014.131"},{"issue":"1","key":"949_CR47","doi-asserted-by":"publisher","first-page":"9","DOI":"10.1186\/s42400-023-00199-0","volume":"7","author":"M Soltani","year":"2024","unstructured":"Soltani, M., Khajavi, K., Jafari Siavoshani, M., et al. (2024). A multi-agent adaptive deep learning framework for online intrusion detection. Cybersecurity, 7(1), 9.","journal-title":"Cybersecurity"},{"key":"949_CR48","doi-asserted-by":"crossref","unstructured":"Svoboda, R., Basterrech, S., Kozal, J., et\u00a0al. (2024). A natural gas consumption forecasting system for continual learning scenarios based on hoeffding trees with change point detection mechanism. Knowledge-Based Systems p 112482","DOI":"10.1016\/j.knosys.2024.112482"},{"key":"949_CR49","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., Lu, W., et\u00a0al. (2009). A detailed analysis of the kdd cup 99 data set. In: 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, 1\u20136","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"949_CR50","unstructured":"Van\u00a0de Ven, GM., Tolias, AS. (2019). Three scenarios for continual learning. arXiv:1904.07734"},{"key":"949_CR51","doi-asserted-by":"publisher","first-page":"35469","DOI":"10.1109\/ACCESS.2022.3155451","volume":"10","author":"YH Wang","year":"2022","unstructured":"Wang, Y. H., Lin, C. Y., Thaipisutikul, T., et al. (2022). Single-head lifelong learning based on distilling knowledge. IEEE Access, 10, 35469\u201335478.","journal-title":"IEEE Access"},{"key":"949_CR52","first-page":"3837","volume-title":"ICASSP 2019\u20132019 IEEE International Conference on Acoustics","author":"F Wiewel","year":"2019","unstructured":"Wiewel, F., & Yang, B. (2019). Continual learning for anomaly detection with variational autoencoder. ICASSP 2019\u20132019 IEEE International Conference on Acoustics (pp. 3837\u20133841). IEEE: Speech and Signal Processing (ICASSP)."}],"container-title":["Journal of Intelligent Information Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10844-025-00949-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10844-025-00949-1","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10844-025-00949-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,16]],"date-time":"2026-02-16T07:39:54Z","timestamp":1771227594000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10844-025-00949-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,3]]},"references-count":52,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2026,2]]}},"alternative-id":["949"],"URL":"https:\/\/doi.org\/10.1007\/s10844-025-00949-1","relation":{},"ISSN":["0925-9902","1573-7675"],"issn-type":[{"value":"0925-9902","type":"print"},{"value":"1573-7675","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,6,3]]},"assertion":[{"value":"30 October 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"12 May 2025","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"19 May 2025","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 June 2025","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing Interests"}}]}}