PaperlayerView exact revision on arXiv

Source-linked AI summary

Deep Learning Advancements in Anomaly Detection: A Comprehensive Survey

Haoqi Huang, Ping Wang, Jianhua Pei, Jiacheng Wang, Shahen Alexanian, Dusit Niyato

arXiv:2503.13195v1cs.LG

TL;DR

Anomaly detection must handle increasingly complex, high-dimensional data that traditional methods may not model effectively. This survey reviews over 180 studies from 2019 to 2024, categorizes reconstruction-, prediction-, and hybrid approaches, and examines traditional–deep learning integration. It concludes that deep learning captures intricate patterns across challenging AD tasks, while hybrid methods seek robustness and efficiency.

  • Problem

    Complex, high-dimensional, and unstructured data challenge traditional anomaly detection methods, while recent advances and hybrid techniques require updated synthesis.

  • Method

    The survey analyzes over 180 research papers and categorizes AD methods into reconstruction-based, prediction-based, and hybrid approaches, including traditional–deep learning integrations.

  • Results

    Deep learning methods capture intricate patterns and dependencies that traditional methods often miss across diverse and challenging anomaly detection tasks.

  • Takeaways & Limitations

    Hybrid approaches combine traditional methods’ simplicity, interpretability, and efficiency with deep learning techniques to enhance robustness and efficiency.

Abstract

from arXiv · show

The rapid expansion of data from diverse sources has made anomaly detection (AD) increasingly essential for identifying unexpected observations that may signal system failures, security breaches, or fraud. As datasets become more complex and high-dimensional, traditional detection methods struggle to effectively capture intricate patterns. Advances in deep learning have made AD methods more powerful and adaptable, improving their ability to handle high-dimensional and unstructured data. This survey provides a comprehensive review of over 180 recent studies, focusing on deep learning-based AD techniques. We categorize and analyze these methods into reconstruction-based and prediction-based approaches, highlighting their effectiveness in modeling complex data distributions. Additionally, we explore the integration of traditional and deep learning methods, highlighting how hybrid approaches combine the interpretability of traditional techniques with the flexibility of deep learning to enhance detection accuracy and model transparency. Finally, we identify open issues and propose future research directions to advance the field of AD. This review bridges gaps in existing literature and serves as a valuable resource for researchers and practitioners seeking to enhance AD techniques using deep learning.

I. INTRODUCTION

Anomaly detection identifies observations that deviate from expected behavior, a task increasingly difficult as IoT data becomes high-dimensional, noisy, and anomaly-prone. The survey contrasts traditional and deep learning approaches, emphasizing recent advances and hybrid methods.

  • Anomaly detection identifies observations that significantly deviate from expected system behavior and can reveal critical information for decision-making.
  • IoT systems generate massive real-time datasets across domains, but their high dimensionality, noise, and diverse anomaly sources complicate detection.
  • Traditional AD methods include statistical, distance-based, and clustering techniques that generally estimate normal-data distributions to identify anomalies.
  • Deep neural networks learn complex patterns and hierarchical representations from raw high-dimensional or unstructured data, reducing reliance on manual feature engineering.
  • Hybrid approaches integrate traditional methods with deep learning to combine interpretability, simplicity, and efficiency with deep models’ flexibility.
  • Earlier surveys often stopped at 2020 or undercovered conditional, cycle-consistent, self-supervised, and hybrid GAN-based methods, motivating this survey’s 2019–2024 coverage.

C. Contributions and Structure

The survey reviews recent AD research, addresses gaps in coverage, compares major deep learning paradigms, and examines hybrid integration with traditional methods. It organizes these analyses across data types, applications, methods, and open issues.

  • C. Contributions and Structure: The survey reviews over 160 AD papers from 2019 to 2024 across leading journals and conferences.
  • C. Contributions and Structure: It addresses prior-survey gaps by analyzing conditional GANs, cycle-consistent GANs, and GAN–VAE hybrid frameworks, including their strengths and weaknesses.
  • C. Contributions and Structure: The survey compares reconstruction-based and prediction-based methods and uses structured tables to summarize strengths, weaknesses, applications, and trade-offs.
  • C. Contributions and Structure: It examines hybrid approaches combining clustering, normalizing flows, or support vector data descriptions with deep learning for complex AD challenges.
  • C. Contributions and Structure: The paper organizes its coverage around data characteristics, anomaly types, applications, deep learning methods, hybrid methods, and open issues.
  • C. Contributions and Structure: The survey distinguishes image, video, textual, and tabular data by their structures and corresponding anomaly manifestations.

2) Categorization by Temporal Characteristics: •

AD data can be categorized by temporal structure and anomaly form, while preprocessing addresses dimensionality, sparsity, missingness, and noise. The survey also reports autoencoders’ advantage over linear PCA on a nonlinear benchmark.

  • 2) Categorization by Temporal Characteristics: •: Time-based data is represented as X = {x_t,j}_t∈T,j∈J, covering univariate series when |J| = 1 and multivariate series when |J| > 1.
  • 2) Categorization by Temporal Characteristics: •: Non-temporal AD analyzes data characteristics, patterns, or statistical properties without relying on temporal dependencies.
  • 2) Categorization by Temporal Characteristics: •: Anomalies include point, contextual, subsequence, cluster-based, and correlation anomalies, distinguished by deviations in individual points, context, sequences, groups, or relationships.
  • High dimensionality, missingness, sparsity, skewed classes, and noise can obscure patterns and hinder AD performance, making preprocessing important.
  • 1) Dimensionality:: 26.83% relative AUC improvement was achieved by an autoencoder over linear PCA on the nonlinear, high-dimensional synthetic Lorenz dataset.
  • Improved low-rank and sparse decomposition models Gaussian-mixture sparse components to capture anomalous patterns in complex hyperspectral data.

3) Class Imbalance:

Class imbalance, noise, privacy, and computational demands complicate AD across application domains. The survey discusses learning and augmentation strategies while noting their remaining limitations.

  • 3) Class Imbalance:: Because anomalies are rarer than normal observations, models may favor the majority class and produce high accuracy alongside low anomaly recall.
  • 3) Class Imbalance:: Noise can obscure anomalies, increase false positives, and encourage models to overfit reconstruction errors from noisy inputs.
  • Federated learning enables collaborative AD model training across clients while protecting local data privacy in sensitive domains.
  • Time-series AD supports applications including traffic monitoring, incident detection, power systems, and other domains where temporal irregularities matter.

2) Power System:

Anomaly detection is presented across power systems, healthcare, financial data, cybersecurity, and visual data, with applications tied to reliability, security, diagnosis, fraud prevention, and operational efficiency.

  • Power System: In electrical grids, anomaly detection identifies deviations that may indicate faults or cyberattacks, supporting stability, security, and reliable power supply.The passage describes real-time detection as important for preventing outages and maintaining consistent service.
  • Healthcare: Healthcare anomaly detection monitors vital signs and medical signals to identify abnormal conditions, noise, or changes in patient state.Medical imaging applications include X-rays, brain imaging, and CT scans, where anomalies can closely resemble normal tissue.
  • Financial Data: Non-temporal anomaly detection addresses fraud, credit-scoring irregularities, and unusual trading activity using transaction characteristics and data patterns.These tasks often involve independent events rather than temporal sequences.
  • Cybersecurity: Cybersecurity applications use anomaly detection to identify unauthorized access, malicious activity, and network intrusions that deviate from established norms.The stated purpose is to support network security and prevent potential breaches.
  • Visual Data: Visual-data anomaly detection supports manufacturing inspection, medical imaging, surveillance, and production quality control.Deep learning can automate irregularity analysis and reduce reliance on manual inspection.

2) Video Monitoring:

Video anomaly detection is framed as a deep learning application for complex surveillance data, while GAN-based methods use reconstruction, discrimination, representation learning, and augmentation to identify deviations from normal patterns.

  • Video Monitoring: Video anomaly detection identifies unusual patterns or behaviors in surveillance footage, and reported results show improved performance on pedestrian and street-scene datasets.The cited model is described as outperforming existing approaches across multiple surveillance video datasets.
  • Deep Learning Approaches: Deep learning anomaly detection is organized into reconstruction-based, prediction-based, and hybrid approaches for complex, unstructured, or temporal data.The survey compares these approaches and summarizes their strengths, weaknesses, and applications in structured tables.
  • Reconstruction-based Methods: Reconstruction-based methods learn normal-data distributions and flag inputs with high reconstruction error, using models such as GANs, autoencoders, and diffusion models.The reconstruction error measures the difference between original and reconstructed data.
  • GAN-based Anomaly Detection: GAN training is formulated as a minimax objective in which the generator minimizes and the discriminator maximizes classification performance between real and generated data.The discriminator updates toward distinguishing real from generated samples, while the generator attempts to fool it.
  • GAN-based Anomaly Detection: GANs also support representation learning and anomaly-data augmentation by modeling data distributions and generating synthetic anomalies.Synthetic anomalies can address scarcity and imbalance while broadening the anomaly features available during training.
  • GAN-based Anomaly Detection: GAN anomaly detection can use a generator to reconstruct test samples or a discriminator to assign low realness probability to anomalous samples.The generator-based route trains on normal data, whereas the discriminator-based route evaluates whether test samples appear real.

2) AE-based Anomaly Detection:

AE-based anomaly detection methods learn representations or data distributions to identify deviations, with VAE variants adding probabilistic latent modeling and KL-based regularization. The survey also covers adversarial extensions that improve robustness and representation learning in challenging settings.

  • AE enhancements improve anomaly-detection robustness by incorporating ℓ2,1-norm to reduce sensitivity to noise and outliers during training.
  • VAEs map inputs into a probabilistic latent space through an encoder-decoder architecture to model the distribution of normal data.The encoder learns distribution parameters such as mean µ and variance σ2, enabling generation of latent variables z.
  • VAEs optimize reconstruction quality together with KL divergence, unlike traditional AEs that focus solely on reconstruction error.KL divergence measures the difference between the encoded latent distribution and a predefined prior, typically a standard normal distribution.
  • KL-based regularization structures the latent space, reducing overfitting and helping distinguish normal from anomalous data in complex, high-dimensional datasets.
  • Adversarial autoencoders use GAN discriminators to match latent distributions, with extensions targeting contaminated training data and multivariate time-series anomaly detection.The reviewed AAE-based framework learned normal-sample distributions from impure data, while ACAE improved feature representation through adversarial and contrastive learning.

3) Diffusion model-Based for Anomaly Detection:

Diffusion-based anomaly detection combines progressive noising with learned iterative denoising to model normal data and reconstruct observations. Its fidelity and distribution coverage offer advantages over GAN and VAE generation, although iterative sampling is slower.

  • Diffusion models add Gaussian noise to data through a fixed forward process, transforming x0 into pure noise xT over T steps.The noise level is controlled by βt, while xt denotes the data state at step t.
  • A learned reverse process parameterizes pθ(xt−1|xt) to remove noise step by step and reconstruct the original data.Training minimizes a variational bound on data likelihood.
  • In anomaly detection, diffusion models train on normal data and flag observations with higher reconstruction error as deviations from learned normal patterns.
  • Diffusion models iteratively refine coarse structures into details, producing high-fidelity samples while maintaining diversity and avoiding GAN mode collapse and VAE blurriness.
  • Diffusion sampling is slower because of its iterative nature, but the models are presented as well-suited to anomaly detection because they accurately reconstruct data and cover the training distribution.
  • Applications span image, radio, graph, vehicle-trajectory, smart-grid, and multi-class anomaly detection, with reported improvements in vehicle-trajectory AUC and F1 scores.

B. Deep learning methods for Anomaly Detection based on Prediction

Prediction-based anomaly detection forecasts future values or estimates missing attributes, then compares predictions with observations to identify deviations. RNN, LSTM, and GRU architectures model temporal dependencies, while recurrent hybrids address noise, imbalance, and representation challenges.

  • Prediction-based methods detect anomalies by comparing forecast or estimated values with observations, using substantial deviations as anomaly indications.They leverage relationships between variables or temporal correlations across multiple data types.
  • RNNs maintain a recurrent state to retain information from previous steps and model sequential patterns in ordered data.The survey identifies applications including event logs, system monitoring, cybersecurity, and industrial processes.
  • LSTMs mitigate RNN gradient-vanishing issues through input, output, and forget gates that control historical and current information.
  • RNNs, LSTMs, and GRUs use windows from t−w to t−1 to predict single-step or multi-step future values in univariate or multivariate time series.Anomalies are detected when prediction differences exceed a threshold, with their spatiotemporal location identified.
  • GRUs simplify LSTMs by using update and reset gates while representing short- and long-term information with the hidden state alone.
  • Recurrent anomaly-detection systems are combined with pruning, autoencoders, VAEs, and other methods to address uneven data, noise, anomalies, and representation needs.

2) Attention-based Anomaly Detection:

Attention-based anomaly detection models use attention to capture dependencies across sequential, spatial, spatiotemporal, and multimodal data. Surveyed approaches combine these mechanisms with convolutional, recurrent, adversarial, and reconstruction components, while performance gains are accompanied by overfitting risks when data are limited.

  • Attention mechanisms: Self-attention captures global dependencies across temporal, spatial, and spatiotemporal inputs by weighting interactions among input values.Queries, keys, and values are transformed from the input, and the output is computed as Attention (Q, K, V) = αV.
  • Attention mechanisms: Multi-head attention captures multiple feature patterns by concatenating outputs from separately parameterized attention heads.The model architecture embeds sequential data, applies positional encoding and multi-head attention, refines representations with a feedforward layer, and sends enhanced features to an FNN for final detection.
  • Attention mechanisms: Attention-based methods can capture long-term dependencies, improve computational efficiency, and support interpretability through visualized attention weights.These capabilities broaden attention-based anomaly detection beyond temporal data to spatial, spatiotemporal, and multimodal settings.
  • Applications and results: Hybrid attention architectures combine CNNs, LSTMs, self-attention, autoencoders, contrastive learning, and GANs to extract local and global features or improve anomaly detection.Examples include convolution-LSTM-self-attention autoencoders and Transformer-based models with data augmentation and geometric distribution masking.

3) GNN-based Anomaly Detection:

GNN-based anomaly detection represents multivariate time series as graphs to model relationships among variables and time steps. Detection can use prediction, reconstruction, graph-structure discrepancies, or combinations of these signals, but large graphs and graph construction remain challenging.

  • GNN foundations: GNNs represent data as nodes, edges, and graphs, enabling message passing over relationships in graph-structured anomaly detection.Node features are updated after neighboring messages are aggregated through an update function.
  • GNN foundations: For multivariate time series, GNNs treat each variable as a node and capture complex dependencies across dimensions, including static and dynamic relationships.The approach can support both predictive and reconstruction-based anomaly detection.
  • Detection strategies: GNN-based methods detect anomalies using prediction errors or graph-structure differences, with reconstruction errors serving as a supplementary indicator.The illustrated pipeline embeds time series into a graph, extracts spatial-temporal dependencies, reconstructs the data, and evaluates relational and prediction discrepancies.
  • Limitations: GNN-based anomaly detection faces high computational complexity on large-scale graphs and difficulty constructing optimal edge and graph configurations.These constraints define practical boundaries for applying GNNs to large or structurally ambiguous datasets.
  • Detection strategies: Prediction-based GNNs use learned graph structure and attention weights to forecast time-series values, while reconstruction-based methods reconstruct sequences and score reconstruction errors.Examples include GDN for prediction and MTAD-GAT for reconstruction.

C. Deep learning methods for Anomaly Detection based on Hybrid Method

Hybrid anomaly detection methods combine reconstruction, prediction, clustering, probabilistic modeling, and boundary-based learning to address complex data and anomaly types. Their central aim is to retain deep learning’s flexibility while adding interpretability, distribution modeling, or decision-boundary precision.

  • Hybrid deep learning methods: Reconstruction-based methods learn intrinsic data patterns, prediction-based methods model temporal dependencies, and hybrid methods combine their strengths for complex scenarios.The survey emphasizes reconstruction for high-dimensional unsupervised data and prediction for time-series anomalies.
  • Traditional-deep integration: Hybrid models integrate traditional methods with deep learning to improve detection power and model transparency while preserving robustness and flexibility.Traditional approaches contribute simplicity and interpretability, whereas deep models handle complex, high-dimensional, and unstructured data.
  • Clustering method: Clustering-enhanced deep models use K-means or hierarchical clustering to distinguish normal and abnormal data, detect multiple anomaly types, and reduce computational costs.Reported examples address fuzzy video-class boundaries and unsupervised online detection of point and group anomalies.
  • Normalizing flows: 99.4% AUC was achieved by FastFlow on MVTec AD while maintaining high inference efficiency through normalizing flows integrated with deep feature extractors.Other normalizing-flow hybrids model normal video embeddings or entity-specific multivariate time-series densities across benchmark datasets.
  • Normalizing flows: Normalizing-flow hybrids combine probabilistic precision with deep networks or graph structures to model complex distributions and provide scalable, robust anomaly detection.The survey presents this synergy as applicable across diverse anomaly detection tasks.

C. Support Vector Data Description

Support Vector Data Description defines a boundary around normal data and is useful for interpretable one-class anomaly detection. Deep integrations jointly improve latent representations and boundary precision, but anomaly detection remains constrained by scarce and imbalanced labeled data.

  • SVDD foundations: SVDD defines a boundary around normal data points for one-class classification, offering computational efficiency and interpretable separation between normal and anomalous instances.Unlike binary classification, SVDD can operate when only normal data are available.
  • Deep SVDD hybrids: Deep SVDD hybrids combine neural feature learning with SVDD’s boundary modeling to improve latent-space separability and anomaly detection.Deep SVDD-VAE jointly optimizes VAE reconstruction and a spherical latent-space boundary.
  • Deep SVDD hybrids: Deep SVDD-VAE, LSTM-SVDD, and DSPSVDD outperform traditional SVDD or AE-based methods across image and time-series settings.Reported evaluations include MNIST, CIFAR-10, GTSRB, MVTec AD, and unsupervised, semisupervised, and supervised time-series settings.
  • Practical implications: Combining SVDD with deep learning can provide a scalable and interpretable framework by pairing enhanced feature representations with precise normal-data boundaries.The survey presents this combination as addressing limitations in both constituent methods across diverse domains.
  • Data limitations: Data scarcity and class imbalance constrain supervised anomaly detection because anomalies are rare, costly to label, and easily overwhelmed by normal samples.These challenges are especially consequential in cybersecurity, healthcare, and industrial monitoring.
  • Data limitations: Synthetic generation and augmentation may not capture real-world anomaly diversity, while models can remain biased toward normal samples and overfit the majority class.The survey identifies self-supervised learning, more diverse synthetic samples, and adaptive frameworks as future directions.

B. Computational Complexity

Deep-learning anomaly detection faces a persistent trade-off between detection accuracy and practical deployment constraints. Real-time and large-scale systems must balance computational complexity, memory usage, interpretability, and adaptability across anomaly types.

  • B. Computational Complexity: High-dimensional or streaming data can require substantial memory, motivating memory-efficient architectures, compression, and sparse modeling.
  • B. Computational Complexity: Real-time anomaly detection requires rapid processing, lightweight models, and parallel techniques such as GPU acceleration, while maintaining high accuracy remains challenging.These constraints matter in applications including autonomous driving and fraud detection, where even minimal delays can have severe consequences.
  • B. Computational Complexity: Complex deep-learning models can improve anomaly detection but may be impractical for real-time or large-scale applications.Simpler models reduce computational demands but may miss nuanced anomalies; hybrid or multi-stage frameworks are proposed as a compromise.
  • Interpretability: Deep-learning models are often criticized as black boxes, creating a need for explanations in healthcare, finance, industrial monitoring, and other safety-critical settings.Attention mechanisms, LIME, and SHAP are discussed as ways to improve transparency without changing model structure.
  • D. Handling Diverse Types of Anomalies: Models must generalize across point, contextual, and collective anomalies without sacrificing accuracy or flexibility.Hybrid and multimodal approaches are identified as possible directions for handling mixed anomaly patterns in real-world environments.
  • Survey Scope: The survey reviews reconstruction-based, prediction-based, and hybrid deep-learning approaches, including integrations with traditional methods to improve robustness and efficiency.It analyzes more than 180 studies published from 2019 to 2024 and identifies gaps and future research opportunities.
Loading 2503.13195v1…