Deep Learning for Anomaly Detection: A Survey

Survey scope

• The survey reviews deep anomaly detection methods and their adoption across application domains, assessing their effectiveness.It presents a structured and comprehensive review of research methods in DAD and discusses applications across diverse domains.Source: §1 · p. 1

Anomaly detection

• Anomaly detection identifies data instances that differ substantially from others and may reflect errors or previously unknown processes.Anomalies are observations suspected to arise from a different mechanism, although they can also result from data errors.Source: §1 · p. 1

Deep learning

• Deep learning learns hierarchical data representations and has gained popularity for anomaly detection across diverse tasks.The passage states that deep learning provides performance and flexibility through nested conceptual representations and has been applied to varied anomaly-detection tasks.Source: §1 · p. 1

Motivation

• Deep learning outperforms traditional machine learning as data scale increases, with studies reporting that it completely surpasses traditional anomaly-detection methods (Javaid et al. [2016], Peng and Marculescu [2015]).The passage points to Figure 1 for scaling behavior and Figure 2 for the diversity of deep learning-based anomaly-detection applications.Source: §1 · p. 1

• Anomalies are sparse data points or regions located farther from the majority of observations, which are treated as normal.The examples distinguish majority regions N1 and N2 from anomalous region O3 and points O1 and O2.Source: §2 · p. 1
• Anomalies may result from malicious actions, system failures, or intentional fraud, and detecting them is essential for decision-making systems because they can reveal valuable information.Source: §2 · p. 2

• Novelty detection identifies new or unobserved patterns that are incorporated into the regular data model rather than classified as anomalous points.Novelty detection and anomaly detection techniques are often used interchangeably.Source: §3 · p. 2
• A novelty score and decision threshold can distinguish previously unseen data from points that significantly deviate as anomalies or outliers.Source: §3 · p. 2
• In the image example, white tigers represent novelties among regular tigers, whereas horses, panthers, lions, and cheetahs represent anomalies.Source: §3 · p. 2, Figure 4 · p. 3

Motivation

• Traditional outlier detectors struggle with complex image and sequence structures and cannot readily scale to gigabyte-scale data.Source: §4 · p. 3
• DAD techniques learn hierarchical discriminative features automatically from raw inputs, reducing reliance on manually engineered domain-specific features.Source: §4 · p. 3

Challenges

• Unclear and continually evolving boundaries between normal and anomalous behavior challenge both conventional and deep learning-based detectors.Source: §4 · p. 3

Prior Reviews

• Existing reviews cover deep anomaly detection in fraud detection [2017], cyber-intrusion detection [2017], medical applications [2017], IoT and big-data anomaly detection [2017], sensor networks [2017], and video anomaly detection [2018].These reviews demonstrate broad application of deep learning-based anomaly detection while remaining focused on particular domains.Source: §5 · pp. 3–4

Research Gap

• The literature lacks comprehensive comparative analysis of deep learning architectures for outlier detection, including which architectures best suit particular datasets and application domains.This gap is notable because substantial anomaly-detection research uses deep autoencoders.Source: §5 · p. 4

Survey Contribution

• This survey aims to bridge the architectural comparison gap by providing a comprehensive reference covering research methods and application domains for deep learning-based anomaly detection.Table 1 presents the set of research methods and application domains covered by the survey.Source: §5 · p. 4

Scope and organization

• The survey aims to comprehensively cover state-of-the-art deep anomaly detection research and real-world applications, beyond reviews limited to particular domains or research areas.It follows the survey approach of Chandola et al. [2007] and addresses the narrower scope of prior surveys, including Kiran et al. [2018], Mohammadi et al. [2017], Litjens et al. [2017], Kwon et al. [2017], Adewumi and Akinyelu [2017], and Ball et al. [2017].Source: §6 · p. 4
• It classifies deep anomaly detection techniques into an organized schema and adds hybrid models and one-class neural networks as sub-categories based on the training objective.The taxonomy is illustrated in Figure 5 and reflects recent techniques with reduced computational requirements, including Erfani et al. [2016a] and Chalapathy et al. [2018a].Source: §6 · p. 4
• For each category, the survey discusses assumptions, adopted techniques, performance considerations, challenges, advantages, disadvantages, and computational complexity.This framing is intended to support understanding of how deep anomaly detection methods operate across research and application settings.Source: §6 · p. 4

Problem formulation

• Section 8 examines the formulation and complexity of anomaly detection problems, including contextual and collective or group anomalies.The paper also discusses point, contextual, and collective deep learning-based anomaly detection techniques in Section 8.4.Source: §7 · pp. 4–5

Application domains

• Section 9 surveys application domains in which deep learning-based anomaly detection has been applied.Source: §7 · p. 4

Technique categorization

• The survey categorizes deep learning-based anomaly detection techniques as supervised, hybrid, one-class neural network, and unsupervised methods, and discusses training and testing complexity for each category.It also organizes coverage by the research areas to which the techniques belong.Source: §7 · p. 5

Limitations and conclusions

• Section 12 discusses limitations and relative performance of existing techniques, followed by concluding remarks in Section 13.Source: §7 · p. 5

8.1 Nature of Input Data

• Architecture choice follows input structure: sequential versus non-sequential data and low- versus high-dimensionality, with deeper networks generally improving high-dimensional performance.Examples of sequential data include voice, text, music, time series, and protein sequences, while images are non-sequential.Source: §8.1 · p. 5

8.2.1 Supervised deep anomaly detection

• Supervised DAD trains binary or multi-class classifiers with normal and anomalous labels, but limited labels and class imbalance reduce adoption and can make performance sub-optimal.The survey therefore excludes supervised DAD from its detailed review, despite applications to rare brands, prohibited drug mentions, and fraudulent health-care transactions.Source: §8.2.1 · p. 5

8.2 Based on Availability of labels

• Semi-supervised and unsupervised DAD are favored because normal labels are easier to obtain; autoencoders model normality, while unsupervised methods require normal instances to predominate.Semi-supervised autoencoders trained on anomaly-free samples produce low reconstruction errors for normal instances; unsupervised methods can yield high false-positive rates when abnormal data are prevalent.Source: §8.2.2 · pp. 5–6, §8.2.3 · p. 6

8.3 Based on the training objective

• The survey introduces deep hybrid models and one-class neural networks as categories based on training objectives, with OC-NN directly optimizing representations for anomaly detection.DHM uses deep representations with traditional detectors, whereas OC-NN combines progressive feature extraction with a one-class objective forming a tight envelope around normal data.Source: §8.3 · p. 6, §8.3.1 · p. 6, §8.3.2 · pp. 6–7

8.3.1 Deep Hybrid Models (DHM)

• Deep hybrid models use autoencoders or pretrained transfer-learning models as feature extractors for traditional detectors, but their separate anomaly objectives may fail to learn differential outlier features.Jointly training feature extractors with OC-SVM or SVDD objectives and customized objectives such as Deep one-class classification address this limitation.Source: §8.3.1 · p. 6

8.3.2 One-Class Neural Networks (OC-NN)

• OC-NN customizes hidden representations for anomaly detection, while Deep SVDD maps normal instances near a sphere center and improves performance on MNIST and CIFAR-10.This differs from autoencoder-plus-detector hybrids that learn features separately from the anomaly detection objective.Source: §8.3.2 · pp. 6–7

8.4 Type of Anomaly

• DAD methods address point, contextual, and collective anomalies, although the literature mainly focuses on point anomalies.Contextual anomalies depend on contextual and behavioral features, whereas collective anomalies arise when individually normal points form an unusual group.Source: §8.4 · p. 7, §8.4.1 · p. 7, §8.4.2 · pp. 7–8

8.5 Output of DAD Techniques

• DAD outputs either anomaly scores or binary labels: scores rank outlierness and are thresholded by domain experts, while labels directly classify instances as normal or anomalous.Deep SVDD uses distance from the sphere center as a decision score, and autoencoders derive scores from reconstruction-error magnitudes before ranking or thresholding.Source: §8.5 · p. 8, §8.5.1 · p. 8, §8.5.2 · p. 9

9.1 Intrusion Detection

• Intrusion detection uses deep anomaly detection because signature-based systems cannot efficiently identify attacks lacking known patterns, with HIDS modeling variable-length sequences and NIDS handling high-volume, high-velocity temporal streams.NIDS methods must also adapt as attackers change their behavior to evade existing solutions.Source: §9.1 · p. 9, §9.1.1 · p. 9, §9.1.2 · p. 9

9.2 Fraud Detection

• Fraud detection spans banking, telecommunications, insurance, and healthcare, where adaptive behavior, real-time requirements, rare and unique cases, scalability limits, and evolving high-volume data challenge traditional approaches.Deep anomaly detection techniques are reviewed for credit-card, mobile-network, insurance-claim, and healthcare fraud.Source: §9.2 · p. 11, §9.2.1 · p. 12, §9.2.2 · p. 12

9.3 Malware Detection

• Malware detection must address data sequences reaching two million time steps and adaptive attackers, while deep methods mitigate dependence on manually extracted features and conventional classification.Representative deep anomaly detection techniques are listed for malware detection.Source: §9.3 · p. 13

9.4 Medical Anomaly Detection

• Medical anomaly detection supports rare-event discovery in imaging and clinical EEG, but imbalanced data and limited interpretability remain challenges despite strong deep-learning performance.The survey notes that newer interpretable models can achieve state-of-the-art performance.Source: §9.4 · p. 13

9.5 Social Networks and 9.6 Log Anomaly Detection

• Deep anomaly detection addresses irregular behavior in social networks and unstructured, diverse system logs, where heterogeneous dynamic data and changing failure messages make fixed pattern matching inadequate.The surveyed social-network methods are reported to outperform state-of-the-art methods, while log methods model data as natural-language sequences for real-time outlier detection.Source: §9.5 · p. 15, §9.6 · p. 15

9.7 Internet of things (IoT) Big Data Anomaly Detection and 9.8 Industrial Anomalies Detection

• IoT and industrial anomaly detection target massive interconnected devices and rare equipment damage, requiring methods that handle heterogeneous, high-volume, dynamic data and failures caused by varied factors.The survey covers IoT devices and industrial systems including wind turbines, power plants, energy systems, storage devices, and rotating machinery.Source: §9.7 · p. 16, §9.8 · p. 16

9.9 Anomaly Detection in Time Series

• Time-series anomaly detection covers point, contextual, and collective anomalies in univariate and multivariate data, but lacks defined patterns, suffers from noise, scales computationally with sequence length, and must handle evolving non-stationary dynamics.Deep models extract hierarchical features for univariate data, while RNN/LSTM and attention-based methods support interpretable multivariate detection and fault-isolation diagnostics.Source: §9.9 · pp. 16–17, §9.9.2 · p. 17

9.10 Video Surveillance

• Video surveillance is modeled as anomaly detection because large amounts of data are unlabeled, yet robust continuous monitoring is hindered by the lack of an explicit real-world anomaly definition.The survey classifies state-of-the-art deep models by model type and detection criteria.Source: §9.10 · p. 18

10.1 Supervised deep anomaly detection

• Supervised DAD learns class-separating boundaries through feature-extraction and classifier networks, but requires abundant accurate labels and may fail on highly complex, nonlinear feature spaces.Its computational complexity increases with input dimensionality and the number of hidden layers, whereas testing is fast because instances use a precomputed model.Source: §10.1 · pp. 19–20

10.2 Semi-supervised deep anomaly detection

• Semi-supervised DAD learns a boundary around one-class normal data, and GANs can improve performance with very few labeled examples, but learned features may overfit rare anomalies.Its complexity is similar to supervised methods and depends mainly on input dimensionality and hidden layers used for representative feature learning.Source: §10.2 · pp. 20–21

10.3 Hybrid deep anomaly detection

• Hybrid DAD feeds deep robust features into traditional detectors, reducing dimensionality and improving scalability, but its separate objectives can make representation learning suboptimal.Complexity includes both deep-network and detector costs, plus architecture and parameter search; for SVMs, prediction is O(d), while common kernels cost O(nd).Source: §10.3 · pp. 21–22

10.4 One-class neural networks (OC-NN) for anomaly detection

• OC-NN jointly learns deep representations and a one-class hyperplane or hypersphere, achieving comparable or better performance than existing methods with reasonable training and testing time.Its customized anomaly-detection objective enables combined representation learning and outlier scoring, while training and updates become slower for high-dimensional inputs.Source: §10.4 · p. 22

10.5 Unsupervised Deep Anomaly Detection

• Unsupervised DAD identifies outliers from intrinsic data characteristics without annotated training data, but struggles in complex high-dimensional spaces and is sensitive to noise and compression choices.Autoencoders are fundamental architectures, yet their non-convex quadratic-cost training is more expensive than PCA based on matrix decomposition.Source: §10.5 · pp. 23–24

10.6.1 Transfer Learning based anomaly detection

• Transfer learning addresses insufficient training data by transferring knowledge across domains, while zero-shot learning recognizes unseen classes from language descriptions or attributes but depends on suitable metadata.Both approaches have produced promising or state-of-the-art anomaly-detection results, with transfer learning still requiring investigation of feature transferability.Source: §10.6.1 · p. 24, §10.6.2 · p. 24

10.6.3 Ensemble based anomaly detection

• Ensemble autoencoders improve robustness to noisy data through randomized connectivity, while deep clustering uses learned representations to scale anomaly detection for complex, high-dimensional datasets.Ensembles can increase diversity, reduce overfitting, and reduce training time; clustering complexity otherwise grows linearly with the number of classes, limiting real-time use.Source: §10.6.3 · p. 24, §10.6.4 · p. 24

10.6.5 Deep Reinforcement Learning (DRL) based anomaly detection

• Deep reinforcement learning detects novel anomalies through reward-driven knowledge enhancement without assuming an anomaly concept, whereas statistical deep techniques combine wavelets, neural networks, and Hilbert transforms for real-time detection.DRL anomaly detection remains a novel area requiring further investigation, and statistical DAD techniques also require fuller assessment of their applicability.Source: §10.6.5 · pp. 24–25, §10.6.6 · p. 25

11.1 Deep Neural Networks (DNN)

• Deep Belief Networks use RBM encoder-decoder representations to produce high reconstruction errors for anomalous samples, while scaling efficiently to big data and improving interpretability.Deep architectures also reduce reliance on manual feature engineering and address scalability and generalization limitations of traditional machine learning.Source: §11.1 · p. 25

11.2 Spatio Temporal Networks (STN)

• Spatio Temporal Networks combine CNNs for local spatial correlations with LSTMs for temporal correlations, and these learned features are effective for detecting outliers.The temporal modeling captures correlations between nearby time points, while CNNs model local spatial structure.Source: §11.2 · p. 25

11.3 Sum-Product Networks (SPN)

• Sum-Product Networks provide fast exact inference, traceability over high-treewidth models without approximation, and uncertainty modeling that supports robust anomaly detection.They have shown impressive results across numerous datasets, although outlier-detection research remains incomplete.Source: §11.3 · p. 25

11.4 Word2vec Models

• Word2vec embeddings capture sequential relationships and improve anomaly-detection performance when used as inputs to deep learning architectures.The embeddings model relationships within sentences and time-sequence data.Source: §11.4 · p. 25

11.5 Generative Models

• Generative models learn data distributions through VAEs, GANs, or AAEs, and GAN-based anomaly detectors identify anomalies in high-dimensional complex datasets.KNN performs better than deep generative models when anomalies are less numerous.Source: §11.5 · pp. 25–26

11.6 Convolutional Neural Networks

• CNNs extract complex hidden features from high-dimensional structured data and serve as feature extractors for anomaly detection in sequential and image datasets.CNN-based anomaly-detection evaluation remains an active research area.Source: §11.6 · p. 26

11.7 Sequence Models

• RNNs capture time-sequence features, while LSTMs and GRUs address limitations in long contexts through memory cells or gated information flow; LSTM methods outperform conventional approaches.LSTM-based anomaly-detection algorithms have reported significant performance gains over conventional methods (Ergen et al. [2017]).Source: §11.7 · p. 26

11.8 Autoencoders

• Autoencoders trained on normal data flag samples with large reconstruction errors, support raw-data detection with minimal preprocessing, and require architecture choices suited to images or sequences.Combined CNN-LSTM, GRU-AE, CNN-AE, and LSTM-AE variants are effective, but noisy training data degrades performance.Source: §11.8 · p. 26

• Supervised classification methods are preferable when normal and anomalous instances have equal amounts of labels, with expensive training but usually fast testing.Their computational complexity is especially important in real-domain applications because testing uses a pre-trained model.Source: §12 · pp. 26–27
• Unsupervised methods avoid costly, time-consuming label acquisition but often assume anomaly-distribution priors, reducing robustness to noisy data.Source: §12 · p. 27
• Hybrid models learn robust hidden-layer features for classical anomaly detectors but cannot influence the preceding representational learning, making the approach suboptimal.Source: §12 · p. 27
• One-class neural networks combine progressively rich deep representations with one-class objectives, such as hyperplanes (Chalapathy et al. [2018a]) or hyperspheres (Ruff et al. [2018a]), to separate normal from anomalous data.Further research is needed to better understand the benefits of this architecture.Source: §12 · p. 27

Conclusion

• The survey guides model selection by using each technique’s assumptions about normal and anomalous data to assess suitability and effectiveness for a given domain or dataset.It also discusses the strengths and weaknesses of each technique category.Source: §13 · p. 27
• Deep learning-based anomaly detection remains active research, motivating future updates as more sophisticated techniques are proposed.The survey also presents existing solutions to challenges in deep anomaly detection across application domains.Source: §13 · p. 27