# Detection Latencies of Anomaly Detectors: An Overlooked Perspective ?

arXiv: https://arxiv.org/abs/2402.09082 · HTML: https://mlsanity.com/paper/2402.09082/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 81 references that are in the map.
- First posted on arXiv 14 Feb 2024.

## Builds on (most cited first, 9 of 9)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [A Multimodal Anomaly Detector for Robot-Assisted Feeding Using an LSTM-based Variational Autoencoder](https://mlsanity.com/paper/1711.00614/) (2017)
- [Robot Operating System 2: Design, Architecture, and Uses In The Wild](https://mlsanity.com/paper/2211.07752/) (2022)
- [LSTM Fully Convolutional Networks for Time Series Classification](https://mlsanity.com/paper/1709.05206/) (2017)
- [Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection](https://mlsanity.com/paper/1908.00686/) (2019)
- [A review on distance based time series classification](https://mlsanity.com/paper/1806.04509/) (2018)
- [A Survey on Anomaly Detection for Technical Systems using LSTM Networks](https://mlsanity.com/paper/2105.13810/) (2021)
- [ROSpace: Intrusion Detection Dataset for a ROS2-Based Cyber-Physical System](https://mlsanity.com/paper/2402.08468/) (2024)
- [LZR: Identifying Unexpected Internet Services](https://mlsanity.com/paper/2301.04841/) (2023)

## Built on by (most cited first, 1 of 1)

- [Securing Swarms: Cross-Domain Adaptation for ROS2-based CPS Anomaly Detection](https://mlsanity.com/paper/2508.15865/) (2025)

## Abstract (arXiv)

The ever-evolving landscape of attacks, coupled with the growing complexity of ICT systems, makes crafting anomaly-based intrusion detectors (ID) and error detectors (ED) a difficult task: they must accurately detect attacks, and they should promptly perform detections. Although improving and comparing the detection capability is the focus of most research works, the timeliness of the detection is less considered and often insufficiently evaluated or discussed. In this paper, we argue the relevance of measuring the temporal latency of attacks and errors, and we propose an evaluation approach for detectors to ensure a pragmatic trade-off between correct and in-time detection. Briefly, the approach relates the false positive rate with the temporal latency of attacks and errors, and this ultimately leads to guidelines for configuring a detector. We apply our approach by evaluating different ED and ID solutions in two industrial cases: i) an embedded railway on-board system that optimizes public mobility, and ii) an edge device for the Industrial Internet of Things. Our results show that considering latency in addition to traditional metrics like the false positive rate, precision, and coverage gives an additional fundamental perspective on the actual performance of the detector and should be considered when assessing and configuring anomaly detectors.