# A Meta-level Analysis of Online Anomaly Detectors

arXiv: https://arxiv.org/abs/2209.05899 · HTML: https://mlsanity.com/paper/2209.05899/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 12 of its 81 references that are in the map.
- First posted on arXiv 13 Sep 2022.

## Builds on (most cited first, 12 of 12)

- [OpenML: networked science in machine learning](https://mlsanity.com/paper/1407.7722/) (2014)
- [A review on outlier/anomaly detection in time series data](https://mlsanity.com/paper/2002.04236/) (2020)
- [Current Time Series Anomaly Detection Benchmarks are Flawed and are Creating the Illusion of Progress](https://mlsanity.com/paper/2009.13807/) (2020)
- [Precision and Recall for Time Series](https://mlsanity.com/paper/1803.03639/) (2018)
- [Anomaly Detection in Univariate Time-series: A Survey on the State-of-the-Art](https://mlsanity.com/paper/2004.00433/) (2020)
- [Exathlon: A Benchmark for Explainable Anomaly Detection over Time Series](https://mlsanity.com/paper/2010.05073/) (2020)
- [A Survey of Predictive Modelling under Imbalanced Distributions](https://mlsanity.com/paper/1505.01658/) (2015)
- [MacroBase: Prioritizing Attention in Fast Data](https://mlsanity.com/paper/1603.00567/) (2016)
- [Automating Outlier Detection via Meta-Learning](https://mlsanity.com/paper/2009.10606/) (2020)
- [On the Runtime-Efficacy Trade-off of Anomaly Detection Techniques for Real-Time Streaming Data](https://mlsanity.com/paper/1710.04735/) (2017)
- [One Class Splitting Criteria for Random Forests](https://mlsanity.com/paper/1611.01971/) (2016)
- [Local Subspace-Based Outlier Detection using Global Neighbourhoods](https://mlsanity.com/paper/1611.00183/) (2016)

## Built on by (most cited first, 5 of 5)

- [A Closer Look at AUROC and AUPRC under Class Imbalance](https://mlsanity.com/paper/2401.06091/) (2024)
- [From Explanation to Action: An End-to-End Human-in-the-loop Framework for Anomaly Reasoning and Management](https://mlsanity.com/paper/2304.03368/) (2023)
- [A Comparative Analysis of Influence Signals for Data Debugging](https://mlsanity.com/paper/2506.11584/) (2025)
- [Catching Every Ripple: Enhanced Anomaly Awareness via Dynamic Concept Adaptation](https://mlsanity.com/paper/2604.14726/) (2026)
- [In a Streaming World, Should You Stand Still? A Comprehensive Benchmark of Anomaly Detection in Streams](https://mlsanity.com/paper/2609.39215/) (2026)

## Abstract (arXiv)

Real-time detection of anomalies in streaming data is receiving increasing attention as it allows us to raise alerts, predict faults, and detect intrusions or threats across industries. Yet, little attention has been given to compare the effectiveness and efficiency of anomaly detectors for streaming data (i.e., of online algorithms). In this paper, we present a qualitative, synthetic overview of major online detectors from different algorithmic families (i.e., distance, density, tree or projection-based) and highlight their main ideas for constructing, updating and testing detection models. Then, we provide a thorough analysis of the results of a quantitative experimental evaluation of online detection algorithms along with their offline counterparts. The behavior of the detectors is correlated with the characteristics of different datasets (i.e., meta-features), thereby providing a meta-level analysis of their performance. Our study addresses several missing insights from the literature such as (a) how reliable are detectors against a random classifier and what dataset characteristics make them perform randomly; (b) to what extent online detectors approximate the performance of offline counterparts; (c) which sketch strategy and update primitives of detectors are best to detect anomalies visible only within a feature subspace of a dataset; (d) what are the tradeoffs between the effectiveness and the efficiency of detectors belonging to different algorithmic families; (e) which specific characteristics of datasets yield an online algorithm to outperform all others.