Online Anomaly Detection

Unlike static batch processing, online algorithms continuously update their statistical parameters with each new sample. This allows the model to adapt to concept drift—legitimate environmental changes like a new cell tower coming online—without flagging them as anomalies. Techniques include stochastic gradient descent applied per-sample and exponential moving averages for running mean and variance calculations.

Every incoming I/Q sample or FFT frame receives an immediate anomaly score. This score quantifies the deviation from the learned normal profile. Common real-time scoring functions include:

• Reconstruction error from an online autoencoder
• Mahalanobis distance from a recursively updated covariance matrix
• Negative log-likelihood under an incremental Gaussian Mixture Model Scores exceeding a dynamic threshold trigger an alert.

To prevent the model from becoming stale or overfitting to obsolete baselines, online detectors employ controlled forgetting. Exponential decay weights recent observations more heavily than older ones. Sliding windows discard data outside a fixed temporal range. This ensures the system rapidly adapts to new legitimate emitters while retaining sensitivity to transient anomalies.

Online algorithms must operate within strict resource budgets on edge hardware like FPGAs or embedded software-defined radios. This demands lightweight models such as:

• Online One-Class SVM with limited support vectors
• Isolation Forest variants optimized for streaming insertion
• Quantized neural networks with reduced precision arithmetic Memory footprint and operations per sample are critical design parameters.

Rather than triggering on a single anomalous sample, robust online detectors use sequential probability ratio tests (SPRT) or cumulative sum (CUSUM) control charts. These methods accumulate evidence over time, minimizing false alarms from momentary noise spikes while guaranteeing rapid detection of persistent anomalies. The trade-off between detection delay and false alarm rate is mathematically bounded.

Online anomaly detection is fundamentally an open-set recognition problem. The system must distinguish between known signal types and previously unseen, unauthorized emissions. Real-time techniques include monitoring the distance to the nearest class prototype in a learned embedding space and applying extreme value theory to model the tail distribution of known-class scores for calibrated novelty thresholds.

The identification of changes in the underlying statistical properties of streaming spectrum data over time. In online anomaly detection, concept drift signals a fundamental shift in the RF environment—such as a new emitter appearing or a change in propagation conditions—requiring the model to adapt its definition of normality incrementally without full retraining.

• Sudden Drift: An abrupt change, like a jammer activating
• Incremental Drift: Gradual environmental shifts, like temperature changes affecting hardware
• Recurring Drift: Periodic patterns, such as diurnal spectrum usage cycles
• Detection methods include the Page-Hinkley test and ADWIN (Adaptive Windowing)

The quantitative difference between an autoencoder's input and its output, serving as the primary anomaly score in online detection. A neural network trained exclusively on normal spectrum data learns to compress and reconstruct it with minimal error. When an anomalous signal—such as an unauthorized transmission—is fed through the network, the reconstruction deviates significantly.

• Calculated using Mean Squared Error (MSE) or Mean Absolute Error (MAE)
• A threshold is set dynamically; exceeding it triggers an alert
• LSTM autoencoders apply this to temporal sequences of I/Q data
• Sensitive to both in-band interference and out-of-distribution modulation schemes

The task of identifying inputs that differ fundamentally from the training data distribution, crucial for open-world spectrum monitoring. Unlike simple anomaly detection which flags statistical outliers, OOD detection specifically recognizes that a signal belongs to an entirely unknown class not seen during training.

• Relies on feature embedding spaces where in-distribution data clusters tightly
• Mahalanobis distance in the embedding space provides a calibrated confidence score
• Essential for detecting novel Low Probability of Intercept (LPI) waveforms
• Prevents the model from confidently misclassifying unknown signals as known classes

A measure of how one probability distribution diverges from a reference distribution, used to quantify the statistical abnormality of a streaming signal segment. In online anomaly detection, the KL divergence between the current window's feature distribution and the learned normal distribution provides a robust, non-parametric anomaly score.

• Also known as relative entropy
• Asymmetric: D_KL(P||Q) ≠ D_KL(Q||P)
• Applied to power spectral density histograms for interference detection
• Often used in Variational Autoencoders (VAEs) as part of the loss function to regularize the latent space

An ensemble method that explicitly isolates anomalies by randomly partitioning data, exploiting the property that anomalous points require fewer splits to be separated from the rest of the dataset. Its linear time complexity and low memory footprint make it highly suitable for online, streaming spectrum applications.

• Builds an ensemble of binary trees using random feature and split value selection
• The path length from root to leaf averaged across trees is the anomaly score
• Requires no distance or density calculations, scaling to high-dimensional RF feature vectors
• Effective for detecting rogue emitters with unusual spectral signatures

A density-based spatial clustering algorithm that identifies core points in high-density regions and classifies points in low-density regions as noise or anomalies. Unlike centroid-based methods, DBSCAN does not require specifying the number of clusters, making it ideal for online spectrum environments where the number of active emitters is unknown.

• Two parameters: epsilon (ε) defining neighborhood radius, and minPts for core point threshold
• Points not reachable from any core point are labeled as anomalies
• Naturally handles arbitrarily shaped clusters in constellation diagrams
• Incremental DBSCAN variants exist for streaming data updates