Continual Contrastive Anomaly Detection under Natural Data Distribution Shifts

This article carries out a research on the topic of data-driven anomaly detection with a focus on its continual learning ability for nonstationary data streams. The study has two primary objectives: to process the precious label information in a semi-supervised paradigm, and to deal with the stability-plasticity dilemma caused by natural data distribution shifts. It means that the anomaly detector should adapt to the new data distribution while retaining and utilizing the previous knowledge. To address these objectives, a novel continual anomaly detection framework, called Continual Contrastive Anomaly Detection (CCAD), is proposed through the lens of contrastive learning. CCAD is highlighted by prototype learning through a continual contrastive loss function that includes both homologous sample-to-prototype and heterologous sample-to-sample contrastive components, which aim to find out the prototypical representation for new data and to constrain the updated representation space within the proximal region of previous ones, respectively. In addition, it provides a natural rehearsal selection method based on the affinity of samples to prototypes. The efficacy of CCAD is experimentally demonstrated through a case study over a network intrusion detection system spanning approximately a decade. The source code is available at https://github.com/JingyuYang1997/CCAD.