Online Continual Learning for Anomaly Detection in IoT under Data Distribution Shifts

• URL: http://arxiv.org/abs/2603.07507v1
• Date: Sun, 08 Mar 2026 07:24:37 GMT
• Title: Online Continual Learning for Anomaly Detection in IoT under Data Distribution Shifts
• Abstract summary: We present OCLADS, a novel communication framework with continual learning (CL) for Internet of Things (IoT) anomaly detection (AD)<n>OCLADS keeps track of data distribution shifts to timely update the on-device IoT AD model.<n>Our proposed framework achieves high inference accuracy while realizing a significantly smaller number of model updates compared to the baseline schemes.
• Score: 33.554121482192635
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: In this work, we present OCLADS, a novel communication framework with continual learning (CL) for Internet of Things (IoT) anomaly detection (AD) when operating in non-stationary environments. As the statistical properties of the observed data change with time, the on-device inference model becomes obsolete, which necessitates strategic model updating. OCLADS keeps track of data distribution shifts to timely update the on-device IoT AD model. To do so, OCLADS introduces two mechanisms during the interaction between the resource-constrained IoT device and an edge server (ES): i) an intelligent sample selection mechanism at the device for data transmission, and ii) a distribution-shift detection mechanism at the ES for model updating. Experimental results with TinyML demonstrate that our proposed framework achieves high inference accuracy while realizing a significantly smaller number of model updates compared to the baseline schemes.

Related papers

• K-Means Based TinyML Anomaly Detection and Distributed Model Reuse via the Distributed Internet of Learning (DIoL) [0.13750624267664155]
  This paper presents a lightweight K-Means anomaly detection model and a distributed model-sharing workflow designed for resource-constrained microcontrollers (MCUs)<n>Using real power measurements from a mini-fridge appliance, the system performs on-device feature extraction, clustering, and threshold estimation to identify abnormal appliance behavior.<n>To avoid retraining models on every device, we introduce the Distributed Internet of Learning (DIoL), which enables a model trained on one MCU to be exported as a portable, text-based representation and reused directly on other devices.
  arXiv  Detail & Related papers  (2026-03-28T20:19:39Z)
• Incremental Federated Learning for Intrusion Detection in IoT Networks under Evolving Threat Landscape [0.5161531917413708]
  This study provides a comprehensive performance analysis of incremental federated learning in enhancing the long term performance of non stationary IDS models in IoT networks.<n>Our results show that cumulative incremental learning and representative learning provide the most stable performance under drift.<n>The study aims to inform the development of more resilient IDS solutions considering the resource constraints in IoT devices.
  arXiv  Detail & Related papers  (2026-03-11T13:51:11Z)
• Multi-Agent Collaborative Intrusion Detection for Low-Altitude Economy IoT: An LLM-Enhanced Agentic AI Framework [60.72591149679355]
  The rapid expansion of low-altitude economy Internet of Things (LAE-IoT) networks has created unprecedented security challenges.<n>Traditional intrusion detection systems fail to tackle the unique characteristics of aerial IoT environments.<n>We introduce a large language model (LLM)-enabled agentic AI framework for enhancing intrusion detection in LAE-IoT networks.
  arXiv  Detail & Related papers  (2026-01-25T12:47:25Z)
• Link-Aware Energy-Frugal Continual Learning for Fault Detection in IoT Networks [12.624687243042503]
  This letter introduces an event-driven communication framework that strategically integrates continual learning in IoT networks for energy-efficient fault detection.<n>Our framework enables the IoT device and the edge server to collaboratively update the lightweight ML model by adapting to the wireless link conditions for communication and the available energy budget.
  arXiv  Detail & Related papers  (2025-12-15T13:54:38Z)
• Undermining Federated Learning Accuracy in EdgeIoT via Variational Graph Auto-Encoders [23.39841886729196]
  EdgeIoT brings mobile edge computing with Internet of Things (IoT) devices, allowing for data processing close to the data source.<n>Federated learning allows each device to upload a shared machine-learning model update with locally processed data.<n>This paper introduces a new attack method targeting federated learning in EdgeIoT, known as data-independent model manipulation attack.
  arXiv  Detail & Related papers  (2025-04-14T10:09:38Z)
• Enhanced Anomaly Detection in IoMT Networks using Ensemble AI Models on the CICIoMT2024 Dataset [0.7753092380426906]
  The rapid proliferation of Internet of Medical Things (IoMT) devices in healthcare has introduced unique cybersecurity challenges.<n>This research aims to develop an advanced, real-time anomaly detection framework tailored for IoMT network traffic.
  arXiv  Detail & Related papers  (2025-02-17T14:46:58Z)
• Effective Intrusion Detection in Heterogeneous Internet-of-Things Networks via Ensemble Knowledge Distillation-based Federated Learning [52.6706505729803]
  We introduce Federated Learning (FL) to collaboratively train a decentralized shared model of Intrusion Detection Systems (IDS) FLEKD enables a more flexible aggregation method than conventional model fusion techniques. Experiment results show that the proposed approach outperforms local training and traditional FL in terms of both speed and performance.
  arXiv  Detail & Related papers  (2024-01-22T14:16:37Z)
• Parallel Successive Learning for Dynamic Distributed Model Training over Heterogeneous Wireless Networks [50.68446003616802]
  Federated learning (FedL) has emerged as a popular technique for distributing model training over a set of wireless devices. We develop parallel successive learning (PSL), which expands the FedL architecture along three dimensions. Our analysis sheds light on the notion of cold vs. warmed up models, and model inertia in distributed machine learning.
  arXiv  Detail & Related papers  (2022-02-07T05:11:01Z)
• Spatio-Temporal Federated Learning for Massive Wireless Edge Networks [23.389249751372393]
  An edge server and numerous mobile devices (clients) jointly learn a global model without transporting huge amount of data collected by the mobile devices to the edge server. The proposed FL approach exploits spatial and temporal correlations between learning updates from different mobile devices scheduled to join STFL in various trainings. An analytical framework of STFL is proposed and employed to study the learning capability of STFL via its convergence performance.
  arXiv  Detail & Related papers  (2021-10-27T16:46:45Z)
• Automated Machine Learning Techniques for Data Streams [91.3755431537592]
  This paper surveys the state-of-the-art open-source AutoML tools, applies them to data collected from streams, and measures how their performance changes over time. The results show that off-the-shelf AutoML tools can provide satisfactory results but in the presence of concept drift, detection or adaptation techniques have to be applied to maintain the predictive accuracy over time.
  arXiv  Detail & Related papers  (2021-06-14T11:42:46Z)
• Fast-Convergent Federated Learning [82.32029953209542]
  Federated learning is a promising solution for distributing machine learning tasks through modern networks of mobile devices. We propose a fast-convergent federated learning algorithm, called FOLB, which performs intelligent sampling of devices in each round of model training.
  arXiv  Detail & Related papers  (2020-07-26T14:37:51Z)
• Deep Anomaly Detection for Time-series Data in Industrial IoT: A Communication-Efficient On-device Federated Learning Approach [40.992167455141946]
  This paper proposes a new communication-efficient on-device federated learning (FL)-based deep anomaly detection framework for sensing time-series data in IIoT. We first introduce a FL framework to enable decentralized edge devices to collaboratively train an anomaly detection model, which can improve its generalization ability. Second, we propose an Attention Mechanism-based Convolutional Neural Network-Long Short Term Memory (AMCNN-LSTM) model to accurately detect anomalies. Third, to adapt the proposed framework to the timeliness of industrial anomaly detection, we propose a gradient compression mechanism based on Top-textitk selection to
  arXiv  Detail & Related papers  (2020-07-19T16:47:26Z)
• Meta-learning framework with applications to zero-shot time-series forecasting [82.61728230984099]
  This work provides positive evidence using a broad meta-learning framework. residual connections act as a meta-learning adaptation mechanism. We show that it is viable to train a neural network on a source TS dataset and deploy it on a different target TS dataset without retraining.
  arXiv  Detail & Related papers  (2020-02-07T16:39:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.