# IDK-S: Incremental Distributional Kernel for Streaming Anomaly Detection

arXiv: https://arxiv.org/abs/2512.05531 · HTML: https://mlsanity.com/paper/2512.05531/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 24 references that are in the map.
- First posted on arXiv 5 Dec 2025.

## Builds on (most cited first, 4 of 4)

- [Kernel Mean Embedding of Distributions: A Review and Beyond](https://mlsanity.com/paper/1605.09522/) (2016)
- [MemStream: Memory-Based Streaming Anomaly Detection](https://mlsanity.com/paper/2106.03837/) (2021)
- [Nearest-Neighbour-Induced Isolation Similarity and its Impact on Density-Based Clustering](https://mlsanity.com/paper/1907.00378/) (2019)
- [Improving the Effectiveness and Efficiency of Stochastic Neighbour Embedding with Isolation Kernel](https://mlsanity.com/paper/1906.09744/) (2019)

## Built on by (most cited first, 1 of 1)

- [Stochastic Voronoi Ensembles for Anomaly Detection](https://mlsanity.com/paper/2601.03664/) (2026)

## Abstract (arXiv)

Anomaly detection on data streams presents significant challenges, requiring methods to maintain high detection accuracy among evolving distributions while ensuring real-time efficiency. Here we introduce IDK-S, a novel Incremental Distributional Kernel for Streaming anomaly detection that effectively addresses these challenges by creating a new dynamic representation in the kernel mean embedding framework. The superiority of IDK-S is attributed to two key innovations. First, it inherits the strengths of the Isolation Distributional Kernel, an offline detector that has demonstrated significant performance advantages over foundational methods like Isolation Forest and Local Outlier Factor due to the use of a data-dependent kernel. Second, it adopts a lightweight incremental update mechanism that significantly reduces computational overhead compared to the naive baseline strategy of performing a full model retraining. This is achieved without compromising detection accuracy, a claim supported by its statistical equivalence to the full retrained model. Our extensive experiments on thirteen benchmarks demonstrate that IDK-S achieves superior detection accuracy while operating substantially faster, in many cases by an order of magnitude, than existing state-of-the-art methods.