Cybersecurity

Learning adaptive metrics for streaming anomaly detection

Developed Online-KISSME-Stream, an instance-based classifier with online Mahalanobis metric learning tailored to data streams.

Streaming accuracy gain

+6%

Concept drift recovery

< 200 samples

Conference

IJCNN 2016

Overview

High-velocity data streams required adaptive models that respect feature correlations and evolving concepts.

Our researchers proposed an online metric learning method that plugs into k-NN stream classifiers.

Euclidean distance failed to capture relationships between features in dynamic streams.
Heavy optimization methods were infeasible given streaming time and memory constraints.
Evaluation protocols for streams needed to reflect real deployment conditions.

Online Mahalanobis updates
Adapted the KISSME formulation to incremental constraints, maintaining a PSD metric with low computational overhead.
Hybrid k-NN pipeline
Integrated the learned metric into a k-NN classifier equipped with concept drift detection for robust streaming performance.
Stream-proper evaluation
Benchmarked against state-of-the-art instance-based methods using prequential protocols and statistical tests suited for streams.

Achieved competitive or superior accuracy versus leading stream classifiers on synthetic and real datasets.
Demonstrated that task-specific metrics can be learned online without violating latency budgets.
Reinforced best practices for evaluating streaming models under concept drift.

Distance metrics should adapt alongside data distributions in streaming settings.
Lightweight updates keep advanced techniques viable under strict compute constraints.
Proper evaluation methodology is essential for trustworthy stream analytics.

Let's discuss how we can help you achieve similar results with a tailored approach for your organization.