Detecting and Adapting to Normality Shifts in Learning-Based Security Anomaly Detection
Conference
Dwivedi, G, Perez-Pons, A. (2026). Detecting and Adapting to Normality Shifts in Learning-Based Security Anomaly Detection
. 10.1109/ICAIC67076.2026.11395775
Dwivedi, G, Perez-Pons, A. (2026). Detecting and Adapting to Normality Shifts in Learning-Based Security Anomaly Detection
. 10.1109/ICAIC67076.2026.11395775
Learning-based security applications are faced with many issues such as concept drift, which regularly leads to frustrations and decreased performance of the models as they get stale. It is a common assumption of these applications that both training and deployment models are identical, or the close-world assumption. Zero-positive anomaly detection is one of the most significant tasks in the security domains as it is resistant to the drift of abnormal behavior when trained without abnormal data. However, when normality shifts, this immunity results in more serious effects. The normality shift for zero-positive anomaly identification has received little attention in previous works, which have mostly concentrated on the drift concept of anomalous behavior. This paper promotes a general framework, to close this gap for deep learning-based anomaly detection in security applications. It recognizes, elaborates, and adjusts to normality shift in practice. By detecting shifts in unsupervised manner, eliminating the requirement for manual labeling, and improving adaption performance by distribution-level tackling helps in surpassing earlier methods. Three security-related anomaly detection applications are used to demonstrate the effectiveness of the model in various practical experiments with real-world long-term data. Results show that model offers superior normality shift adaption performance with reduced labeling overhead.
