Online Continual Learning for Anomaly Detection in IoT under Data Distribution Shifts

Matea Marinova; Shashi Raj Pandey; Junya Shiraishi; Martin Voigt Vejling; Valentin Rakovic; Petar Popovski

cs.LGMar 8, 2026

Online Continual Learning for Anomaly Detection in IoT under Data Distribution Shifts

Authors: Matea Marinova, Shashi Raj Pandey, Junya Shiraishi, Martin Voigt Vejling, Valentin Rakovic, Petar Popovski

Organizations: Faculty of Electrical Engineering and Information Technologies, Ss. Cyril and Methodius University in Skopje, 1000 Skopje, North Macedonia · Dept. of Electronic Systems, Aalborg University, Aalborg, Denmark

Abstract

In this work, we present OCLADS, a novel communication framework with continual learning (CL) for Internet of Things (IoT) anomaly detection (AD) when operating in non-stationary environments. As the statistical properties of the observed data change with time, the on-device inference model becomes obsolete, which necessitates strategic model updating. OCLADS keeps track of data distribution shifts to timely update the on-device IoT AD model. To do so, OCLADS introduces two mechanisms during the interaction between the resource-constrained IoT device and an edge server (ES): i) an intelligent sample selection mechanism at the device for data transmission, and ii) a distribution-shift detection mechanism at the ES for model updating. Experimental results with TinyML demonstrate that our proposed framework achieves high inference accuracy while realizing a significantly smaller number of model updates compared to the baseline schemes.

Figures & tables

Fig. 1 : Overview of the OCLADS framework for anomaly detection in online CL under non-stationary conditions.

Panel of Figure 2 — Fig. 3 : Average online macro F1-scores w.r.t. the number of communication rounds and device-side model updates.

Explore similar work

CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification
May 7, 2026Iason Ofeidis, Nikos Papadis, Randeep Bhatia +2IoT Intrusion Detection Network Intrusion Detection
Yale University, New Haven, CT, USA · Nokia Bell Labs, Murray Hill, NJ, USA
Unsupervised Baseline Clustering and Incremental Adaptation for IoT Device Traffic Profiling
Feb 27, 2026Sean M. Alderman, John D. HastingsInternet of Things Clustering
The Beacom College of Computer & Cyber Sciences, Dakota State University, Madison, SD, USA
K-Means Based TinyML Anomaly Detection and Distributed Model Reuse via the Distributed Internet of Learning (DIoL)
Mar 28, 2026Abdulrahman Albaiz, Fathi AmsaadTiny ML Anomaly Detection
Department of Computer Science & Engineering Wright State University Dayton, Ohio, USA

May 7, 2026J/K move · Enter open · S save

CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification

Iason Ofeidis, Nikos Papadis, Randeep Bhatia, Leandros Tassiulas+1

Yale University, New Haven, CT, USA · Nokia Bell Labs, Murray Hill, NJ, USA

IoT Intrusion Detection Network Intrusion Detection Unsupervised Anomaly Detection Clustered Federated Learning Federated Learning

Open paper AskPDF arXiv

The rapid expansion of the Internet of Things (IoT) and Industrial IoT (IIoT) has created a massive, heterogeneous attack surface that challenges traditional network security mechanisms. While Federated Learning (FL) offers a privacy-preserving alternative to centralized Intrusion Detection Systems (IDS), standard approaches struggle to generalize across diverse device behaviors and typically fail to utilize the vast amounts of unlabeled data present in realistic edge environments. To bridge these gaps, we propose CLAD, a holistic framework that seamlessly incorporates Clustered Federated Learning (CFL) with a novel Dual-Mode Micro-Architecture (

\text{DM}^2\text{A}

). This unified approach simultaneously tackles the two primary bottlenecks of IoT security: device heterogeneity and label scarcity. The

\text{DM}^2\text{A}

component features a shared encoder followed by two branches, enabling joint unsupervised anomaly detection and supervised attack classification; this allows the framework to harvest intelligence from both labeled and unlabeled clients. Concurrently, the clustering component dynamically groups devices with congruent traffic patterns, preventing global model divergence. By carefully combining these elements, CLAD ensures that no data is discarded and distinct operational patterns are preserved. Extensive evaluations demonstrate that this integrated approach significantly outperforms state-of-the-art baselines, achieving a 30% relative improvement in detection performance in scenarios with 80% unlabeled clients, with only half the communication cost.

Abstract

Explore similar work

CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification

Unsupervised Baseline Clustering and Incremental Adaptation for IoT Device Traffic Profiling

K-Means Based TinyML Anomaly Detection and Distributed Model Reuse via the Distributed Internet of Learning (DIoL)