# MemStream: Memory-Based Streaming Anomaly Detection

arXiv: https://arxiv.org/abs/2106.03837 · HTML: https://mlsanity.com/paper/2106.03837/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- Builds on 24 of its 97 references that are in the map.
- First posted on arXiv 7 Jun 2021.

## Builds on (most cited first, 24 of 24)

- [Unsupervised Anomaly Detection with Generative Adversarial Networks to Guide Marker Discovery](https://mlsanity.com/paper/1703.05921/) (2017)
- [Memorizing Normality to Detect Anomaly: Memory-augmented Deep Autoencoder for Unsupervised Anomaly Detection](https://mlsanity.com/paper/1904.02639/) (2019)
- [Learning under Concept Drift: A Review](https://mlsanity.com/paper/2004.05785/) (2020)
- [GANomaly: Semi-Supervised Anomaly Detection via Adversarial Training](https://mlsanity.com/paper/1805.06725/) (2018)
- [Deep Learning for Anomaly Detection: A Survey](https://mlsanity.com/paper/1901.03407/) (2019)
- [Unsupervised Anomaly Detection via Variational Auto-Encoder for Seasonal KPIs in Web Applications](https://mlsanity.com/paper/1802.03903/) (2018)
- [Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection](https://mlsanity.com/paper/1802.09089/) (2018)
- [Adversarially Learned Anomaly Detection](https://mlsanity.com/paper/1812.02288/) (2018)
- [Deep Structured Energy Based Models for Anomaly Detection](https://mlsanity.com/paper/1605.07717/) (2016)
- [Anomaly Detection using One-Class Neural Networks](https://mlsanity.com/paper/1802.06360/) (2018)
- [Extended Isolation Forest](https://mlsanity.com/paper/1811.02141/) (2018)
- [Nonlinear Information Bottleneck](https://mlsanity.com/paper/1705.02436/) (2017)
- [Maximum Entropy Generators for Energy-Based Models](https://mlsanity.com/paper/1901.08508/) (2019)
- [A Survey of Network-based Intrusion Detection Data Sets](https://mlsanity.com/paper/1903.02460/) (2019)
- [Robust Anomaly Detection in Images using Adversarial Autoencoders](https://mlsanity.com/paper/1901.06355/) (2019)
- [DOPING: Generative Data Augmentation for Unsupervised Anomaly Detection with GAN](https://mlsanity.com/paper/1808.07632/) (2018)
- [Fence GAN: Towards Better Anomaly Detection](https://mlsanity.com/paper/1904.01209/) (2019)
- [MIDAS: Microcluster-Based Detector of Anomalies in Edge Streams](https://mlsanity.com/paper/1911.04464/) (2019)
- [TAnoGAN: Time Series Anomaly Detection with Generative Adversarial Networks](https://mlsanity.com/paper/2008.09567/) (2020)
- [Training Adversarial Discriminators for Cross-channel Abnormal Event Detection in Crowds](https://mlsanity.com/paper/1706.07680/) (2017)
- [MSTREAM: Fast Anomaly Detection in Multi-Aspect Streams](https://mlsanity.com/paper/2009.08451/) (2020)
- [Memory Augmented Generative Adversarial Networks for Anomaly Detection](https://mlsanity.com/paper/2002.02669/) (2020)
- [PySAD: A Streaming Anomaly Detection Framework in Python](https://mlsanity.com/paper/2009.02572/) (2020)
- [Identifying and Alleviating Concept Drift in Streaming Tensor Decomposition](https://mlsanity.com/paper/1804.09619/) (2018)

## Built on by (most cited first, 12 of 12)

- [Fast and Multi-aspect Mining of Complex Time-stamped Event Streams](https://mlsanity.com/paper/2303.03789/) (2023)
- [MemDA: Forecasting Urban Time Series with Memory-based Drift Adaptation](https://mlsanity.com/paper/2309.14216/) (2023)
- [InQMAD: Incremental Quantum Measurement Anomaly Detection](https://mlsanity.com/paper/2210.05061/) (2022)
- [CyberCScope: Mining Skewed Tensor Streams and Online Anomaly Detection in Cybersecurity Systems](https://mlsanity.com/paper/2503.00871/) (2025)
- [IDK-S: Incremental Distributional Kernel for Streaming Anomaly Detection](https://mlsanity.com/paper/2512.05531/) (2025)
- [Multi-Aspect Mining and Anomaly Detection for Heterogeneous Tensor Streams](https://mlsanity.com/paper/2602.04917/) (2026)
- [A Graph-based Framework for Online Time Series Anomaly Detection Using Model Ensemble](https://mlsanity.com/paper/2601.01403/) (2026)
- [Resilient Class-Incremental Learning: on the Interplay of Drifting, Unlabelled and Imbalanced Data Streams](https://mlsanity.com/paper/2602.09681/) (2026)
- [Drift-Aware Variational Autoencoder-based Anomaly Detection with Two-level Ensembling](https://mlsanity.com/paper/2602.12976/) (2026)
- [Catching Every Ripple: Enhanced Anomaly Awareness via Dynamic Concept Adaptation](https://mlsanity.com/paper/2604.14726/) (2026)
- [Contrast to Detect: Dynamic Graph Contrastive Regularization for Unsupervised Anomaly Detection in Multivariate Time Series](https://mlsanity.com/paper/2605.23744/) (2026)
- [In a Streaming World, Should You Stand Still? A Comprehensive Benchmark of Anomaly Detection in Streams](https://mlsanity.com/paper/2609.39215/) (2026)

## Abstract (arXiv)

Given a stream of entries over time in a multi-dimensional data setting where concept drift is present, how can we detect anomalous activities? Most of the existing unsupervised anomaly detection approaches seek to detect anomalous events in an offline fashion and require a large amount of data for training. This is not practical in real-life scenarios where we receive the data in a streaming manner and do not know the size of the stream beforehand. Thus, we need a data-efficient method that can detect and adapt to changing data trends, or concept drift, in an online manner. In this work, we propose MemStream, a streaming anomaly detection framework, allowing us to detect unusual events as they occur while being resilient to concept drift. We leverage the power of a denoising autoencoder to learn representations and a memory module to learn the dynamically changing trend in data without the need for labels. We prove the optimum memory size required for effective drift handling. Furthermore, MemStream makes use of two architecture design choices to be robust to memory poisoning. Experimental results show the effectiveness of our approach compared to state-of-the-art streaming baselines using 2 synthetic datasets and 11 real-world datasets.