Open research questions in Anomaly Detection Techniques and Applications

What the literature leaves open

• In this paper, we have presented a hybrid deep learning framework for anomaly detection in industrial wireless networks that effectively reconciles two often-conflicting objectives: high detection accuracy under dynamic noise conditions and real-time inference capability. Our architecture, which strategically layers convolutional feature extractors with multi- head self-attention, achieves state-of-the-art performance on the Industrial-IDS-2023 benchmark, particularly in high- noise scenarios where conventional models fail. The dynamic noise augmentation strategy we introduced further enhances robustness without imposing additional inference costs. Nevertheless, our approach carries two principal constraints that limit its practical applicability: • Constraint 1: The computational overhead, while manageable on server-class hardware, remains too heavy for edge deployment scenarios where power and memory are severely constrained. • Constraint 2: The model's reliance on fixed temporal windows renders it largely insensitive to low-amplitude attacks distributed over long time horizons. These constraints directly inform our future research agenda. Specifically, we plan to pursue the following directions: 1. Model Compression via Knowledge Distillation. We intend to distill our large teacher model into a smaller student network that retains the essential decision boundaries while reducing the parameter count by at least 70%. Preliminary experiments with simple distillation loss functions have shown promise, but we believe that adversarial distillation— where a discriminator tries to distinguish teacher and student predictions—may yield superior results. 2. Memory-Augmented Online Learning. To address both the cold-start problem and the low-slow attack vulnerability, we plan to equip our architecture with an external memory module (akin to a Differentiable Neural Computer) that stores long-term behavioral profiles. This would enable the model to maintain a running history spanning thousands of windows, allowing it to detect subtle shifts that are invisible in short windows. 3. Context-Aware Labeling. Acknowledging the labeling ambiguities identified in our qualitative analysis, we also plan to collaborate with domain experts to develop a more nuanced annotation framework that distinguishes between different types of "normal" dynamics (e.g., steady-state vs. transitional), potentially transforming anomaly detection into a multi- class classification problem. We believe these directions, pursued rigorously, could further consolidate and extend the contributions we have established here.

  A Hybrid Attention-Augmented Convolutional Neural Network for Anomaly Detection in Industrial Wireless Networks under Dynamic Noise Conditions · 2026 · DOI

• Ground-penetrating radar (GPR) can image such tunnels non-invasively, but manual radargram interpretation does not scale to continuous corridor surveillance, and supervised detectors require tunnel examples that are scarce in practice.

  Unsupervised Detection of Underground Tunnels in Ground-Penetrating Radar Using Depth-Restricted Reconstruction Scoring · 2026

• Butt, “Anatomy of Cloud Monitoring and Metering: A case study and open problems,” in Proceedings of the 6th Asia-Pacific Workshop on Systems, Tokyo Japan: ACM, July 2015, pp.

  Anomaly Detection Optimization in Cloud Technology Metric Time Series · 2026 · DOI

• • Although the proposed framework performs effectively in most scenarios, challenges remain in extremely crowded environments and under severe illumination variations, where visual ambiguity reduces anomaly separability. that dynamically adjust • Future work will investigate adaptive fusion mechanisms the contribution of individual branches based on scene context and environmental conditions.

  A Deployment-Oriented Hybrid CNN–LSTM–MIL System for Real-World Video Anomaly Detection · 2026 · DOI

• Future work will focus on validation across additional datasets and machine conditions, statistical evaluation across repeated runs, and improved feature extraction strategies for extremely noisy scenarios such as 0 dB or lower SNR. The present study was limited to the MIMII fan subset, and deployment-related factors such as memory footprint, embedded implementation, and streaming latency were not fully evaluated.

  Acoustic Anomaly Detection for Industrial Fan Fault Identification Using Mel-Spectrograms and a Denoising Convolutional Autoencoder · 2026 · DOI

• In addition, the role of cyclic process behavior, which is common in discrete industrial automation, remains underexplored for MTSAD for the current state of research.

  Federated Learning for Multivariate Time Series Anomaly Detection in Industrial Automation · 2026

• Mining anomalies from unmanned aerial vehicle (UAV) state-estimation logs is challenging because failures are sparse, temporally structured, and distributed across heterogeneous PX4 telemetry streams with variable sensor availability and missing values.

  AeroTSBoost: Temporal-Statistical Boosting for Real-World UAV Telemetry Anomaly Mining · 2026

• Although the proposed framework achieves strong performance across both the UCF-Crime and XD-Violence datasets, certain challenging scenarios still lead to inaccurate anomaly localization and unstable anomaly con- fidence estimation. To further analyze the behavior of the proposed framework under difficult surveillance conditions, we conduct an error taxonomy analysis on incorrectly localized or misclassified samples from the evaluation set. The failure samples are manually inspected and categorized according to their dominant observ- able prediction characteristics, and the frequency of each category is estimated from the proportion of samples exhibiting the corresponding failure pattern. The dominant error categories observed in the proposed framework are summarized in Table 15. Table 15: Error taxonomy analysis of the proposed PoinCLIP-VAD frame- work under challenging surveillance scenarios.

  PoinCLIP-VAD: a hyperbolic cross-modal fusion framework for video anomaly detection · 2026 · DOI

• While the proposed uncertainty-gated formulation improves robustness under behavioral variability, it does not eliminate the underlying source of unpredictability. The conditional forecasting component may still treat rare but valid behavioral patterns as statistically surprising; the gate primarily attenuates their influence at inference time. The proposed framework therefore manages behavioral uncertainty during anomaly scoring rather than reducing the uncertainty itself at the representation level. A second limitation is the use of factorized output densities in both components. The conditional forecaster employs a diagonal Gaussian output distribution, while the marginal plausibility model uses independent one- dimensional flow densities for each feature. Although the use of factorized conditional and marginal densities promotes tractability, stability, and interpretability, it neglects structured cross-feature dependence that may be important in tightly coupled vehicle systems. From a computational perspective, the marginal plausibility component can be more demanding to train than the conditional forecaster, particularly on longer and more diverse recordings. By contrast, the uncertainty-gating mechanism itself introduces relatively little additional overhead, since gating is implemented using a lightweight feature-wise MLP operating on predicted uncertainty estimates. The primary computational cost arises from fitting the independent flow-based marginal densities across large telemetry datasets. Factorized per-feature https://doi.org/10.53941/jmlis.2026.100010 18 of 21 Hirtopanu et al. J. Mach. Learn. Inf. Secur. 2026, 2(2), 10 marginal density modeling was intentionally adopted to improve computational efficiency and scalability relative to fully multivariate likelihood formulations, although this design sacrifices explicit cross-feature dependence modeling. Similarly, the conditional forecasting component employs a diagonal covariance formulation to maintain computational efficiency during probabilistic forecasting over high-dimensional telemetry signals while still enabling feature-wise uncertainty estimation. Preliminary experiments suggest that partial subsampling of nominal data can substantially reduce computational cost without significantly degrading performance, indicating that the marginal model primarily captures global operating envelopes rather than fine-grained temporal structure. A more systematic study of marginal data efficiency and scalable density modeling remains an important direction for future research. Although the proposed framework demonstrates substantial false-positive reduction across datasets; the current evaluation focuses primarily on operational regimes represented in the evaluated datasets and synthetic fault scenarios. More extreme out-of-distribution conditions, such as severe weather or significant sensor degradation, were not explicitly evaluated. Nevertheless, because the proposed framework combines conditional temporal consistency with global marginal plausibility, it is expected to remain more robust than purely forecasting-based anomaly detectors under moderate distribution shift. Future work will investigate robustness under more extreme operational conditions and adaptive recalibration strategies for long-term deployment. The proposed uncertainty-gating mechanism is expected to require retraining or domain adaptation when applied to substantially different human-machine systems. Although the general mixed-uncertainty formulation may transfer across domains, the learned association between predictive uncertainty and feature-wise anomaly relevance depends on the underlying telemetry structure, temporal dependencies, control interactions, and operational context of the target system. Different domains may therefore exhibit substantially different predictability characteristics and uncertainty distributions. Investigating transferability, domain adaptation, and cross-domain calibration of the gating behavior remains an important direction for future work. Future work may also investigate stronger nominal representation learning for human-driven telemetry, including self-supervised pre-training, domain-adaptive learning, or meta-learning strategies that improve cross- driver invariance. Stronger cross-driver representation learning through self-supervised pre-training, domain adaptation, and meta-learning may reduce reliance on reactive gating and enable the proposed framework to focus more selectively on structurally implausible deviations.

  Uncertainty-Gated Mixture Modeling for Anomaly Detection in Human-in-the-Loop Vehicle Systems · 2026 · DOI

• The proposed framework demonstrates strong stabil- ity and low false alarm rates under reconstruction-based anomaly detection. Nevertheless, improving anomaly sen- sitivity, particularly for rare and subtle events, remains an important direction for future research. Potential enhance- ments include adaptive thresholding strategies that can adjust to evolving system dynamics, as well as the integra- tion of prediction-based components or latent-space regu- larization to improve feature separability. In addition, hy- brid detection schemes that combine reconstruction error with supervised or semi-supervised decision mechanisms may further enhance robustness in complex cyber–physi- cal environments. From a deployment perspective, the relatively com- pact architecture and stable inference behavior indicate that the model is suitable for IoT-enabled engineering sys- tems with constrained resources. Future work may there- fore explore edge-assisted or hierarchical deployment sce- narios, where real-time anomaly detection is required un- der limitations in latency, bandwidth, and computational capacity. This balance between detection performance and efficiency is critical for large-scale smart infrastructure ap- plications. Furthermore, a more comprehensive evaluation is re- quired to strengthen the validity of the approach. This in- cludes benchmarking against alternative methods such as LSTM autoencoders, CNN autoencoders, Isolation Forest, and statistical anomaly detection techniques. In addition, incorporating precision–recall AUC (PR-AUC) is recom- mended to provide a more informative evaluation under highly imbalanced conditions.

  Deep Learning–Driven Anomaly Detection for IoT-Enabled Smart Engineering Systems · 2026 · DOI

• Cluster Computing (2026) 29:251 1 3 Additionally, future work should investigate the hardware requirements for the four major AI areas: prediction, pattern detection, correlation, and classification, focusing on how resource demands vary across these tasks.

  Looking at anomaly detection in EdgeAI through the up-to-date lens of academic and market perspectives · 2026 · DOI

• While advocating for closer collaboration between Aca- demia and industry, this work acknowledges inherent limi- tations. These include the potential to exclude relevant studies due to database constraints or keyword filtering, and the challenge of capturing the most recent developments in this rapidly evolving field. As such, iterative, continuous reviews are imperative to ensure a comprehensive assess- ment of progress in this dynamic domain. Emerging tech- nologies offer additional opportunities to bridge the divide between academic and market perspectives. Both sectors must explore integrating innovations such as quantum computing and advanced IoT protocols, such as ZigBee and LoRa, into anomaly detection frameworks. Further- more, addressing privacy and security challenges remains a mutual priority. Expanding applications across underex- plored domains, including precision agriculture, innova- tive healthcare, and environmental monitoring, could also enhance the relevance and impact of EdgeAI systems. Mar- ket investments in adaptable, cost-effective platforms could further democratize access to these technologies, especially for small and medium enterprises.

  Looking at anomaly detection in EdgeAI through the up-to-date lens of academic and market perspectives · 2026 · DOI

• We outline several intriguing future directions as follows: 1) We should build up a multi-modalities IAD dataset. In actual assembly lines, RGB images are insufficient to detect anomalies. Hence, we may employ additional modalities information, such as X-ray and ultrasound, to enhance anomaly detection performance. 2) Given that test samples are sequentially streamed on the product line, most IAD methods are incapable of making instantaneous predictions upon the arrival of a new test sample. In industrial manufacturing, the inference speed of IAD should be addressed in addition to its accuracy. Adopting multi-objective evolutionary neural architecture search algorithms to find the optimal tradeoff architecture is thus a promising approach. 3) The majority of IAD methods use ImageNet pretrained models to extract the features from industrial images, which inevitably results in the feature drift issue. Consequently, there is a pressing need to construct a pretrained model for industrial images. 4) Most anomaly detection methods focus on the unsupervised setting. Although this setting can reduce the cost of data labeling, it greatly curbs the development of segmentation-based methods. Unsupervised methods and supervised methods should complement each other, and the main reason for the slow development of supervised methods in recent years is the lack of a large number of labeled data sets. Therefore, it is necessary to propose a fully supervised anomaly detection dataset with pixellevel annotations in the future. 5) Previously, we focused on developing data augmentation method for normal images. However, we have not made much effort on synthesizing abnormal samples via data augmentation. In industrial manufacturing, it is very difficult to collect a large number of abnormal samples since most of the production lines are faultless. Hence, more attention should be paid to abnormal synthesis methods in the future, like CutPaste, DRAEM and MemSeg. 6) Current anomaly detection algorithms often focus on detection accuracy, while ignoring the storage size and efficiency of the models. This leads to high computation costs and limits the application of anomaly detection to the production end of enterprises. Therefore, it is necessary to design lightweight but efficient anomaly detection models. 7) Currently, image anomaly detection algorithms can be mainly categorized into two tasks: Industrial image anomaly detection and medical image anomaly detection. Although medical images have more modalities than industrial images[185–189], the two tasks share many similarities in terms of data and experimental settings.

  Deep Industrial Image Anomaly Detection: A Survey · 2024 · DOI

• The SHAP-based feature selection, a hybrid form of bagging and boosting algorithms used for detection, and the residual correction are huge advancements towards better-designed, highly supple, and exceptionally robust-accuracy IDPSs. These statistical approaches mutually enhanced the predictive and explanatory models of intrusion detection. Simultaneously, the combined statistical approach resolves two modeling pitfalls in traditional cyber-security approaches. With the stacking approach, model boosting resolves concerns such as overfitting the data, and model averaging resolves the inherent credibility crisis faced by the intrusion detection models in the ex-ante environment. This solution can open a future research avenue to test other statistical innovations, if possible, to boost the predictive power of IDPSs. Precise areas on which the researchers can build up their findings include the following: Firstly, identifying how these hybrid methods adapt to the dynamic nature of evolving cyber threats is of great importance. Another critical area could be how real-time data processing impacts the effectiveness and efficiency of IDPS models, showing their practical usability. The scalability of these models in large-scale network environments and their resilience against advanced persistent threats are other aspects to be considered. Finally, this trade-off between model complexity and interpretability will contribute to designing more transparent and user-friendly intrusion detection systems. Answering such questions and focusing on the highlighted areas would lead to further steps in improving this field by offering robust and adaptive cybersecurity solutions.

  Hybrid bagging and boosting with SHAP based feature selection for enhanced predictive modeling in intrusion detection systems · 2024 · DOI

• PCA AEs GANS CNN . re- PCA is a technique that duces the dimensionality of data by projecting it to a lower- dimensional subspace that cap- is tures the main variation. It used to detect anomalies by mea- suring the reconstruction error AEs is to identify unusual or ab- normal patterns within data. In the context of anomaly detec- tion, AEs are trained on normal, non-anomalous data to learn the underlying patterns and struc- tures.

  A Comprehensive Survey of Machine Learning Methods for Surveillance Videos Anomaly Detection · 2023 · DOI

• While principal component analysis was employed for its simplicity and efficiency, more expressive approaches to feature extraction could be explored.

  Optimal transport event representation for anomaly detection · 2026 · DOI

• Additionally, this paper assumes an ideal reference data set of inliers; future work could examine relaxations of this assumption, accounting for possible contamination of the calibration data (Barber et al. Although this issue remains unexplored, a starting point may be found in Goeman et al.

  Collective Outlier Detection and Enumeration with Conformalized Closed Testing · 2026 · DOI

• Although there is extensive research on cyber-attack detections in manufacturing systems, very limited studies have been focused on how to respond to the cyber-attacks to remove the impact of the identified poisoned data.

  Certified Removal (CR)-Based Machine Unlearning for Data Poisoning in Cybermanufacturing · 2026 · DOI

• Future research will focus on the integration of streaming temporal segmentation and incorporate synchronized maintenance logs to assess correspondence between anomaly scores and confirmed failure events.

  Hyperparameter optimization of isolation forest using a variable neighborhood search approach for anomaly detection in electric motors · 2026 · DOI

• Furthermore, outlier detection in the presence of sample dependence is frequently encountered in practice; how to exploit auxiliary information under such dependence structures warrants further research.

  Auxiliary Information Assisted MAD Methods for Outlier Detection · 2026 · DOI

• Motivated by the increasing complexity of cyber‐physical systems and growing interest in resource‐aware artificial intelligence, this paper addresses the challenges related to anomaly detection using limited data with online adaptation.

  Resource‐Aware Contrastive Scattering Meta‐Learning for Efficient Few‐Shot Acoustic Anomaly Detection · 2026 · DOI

• Despite substantial progress in CV-related research, video anomaly detection (VAD) focused on women's safety has not yet been adequately addressed.

  An Analysis Focused on Womens Safety: Can VAD Models Be Enhanced by a Multi-modal Dataset? · 2026

• (2) The multi-modal fusion strategy is insufficient, particularly when there is temporal inconsistency between visual and audio information, causing the model to overlook key information, directly affecting the accurate detection and recognition of anomalous events.

  Visual-Guided Long Temporal Context Learning Network for Weakly-Supervised Video Anomaly Detection · 2026 · DOI

• Real automotive inspection lines need robust defect detection under cluttered backgrounds, fluctuating illumination, and operator-introduced clutter, conditions under which fully supervised pipelines are rarely feasible because defective samples are scarce and heterogeneous.

  RGB Ensemble Strategies for Unsupervised Industrial Anomaly Detection on the AutoVI Dataset · 2026 · DOI

• Against the background of highly interconnected global capital markets and rapidly propagating cross-lingual information streams, traditional anomaly detection paradigms based solely on single-modality numerical time-series sensors are insufficient for forward-looking risk sensing.

  A Cross-Modal Temporal Alignment Framework for Artificial Intelligence-Driven Sensing in Multilingual Risk Monitoring · 2026 · DOI

Most-cited papers in Anomaly Detection Techniques and Applications

• Autoencoders and their applications in machine learning: a survey · Artificial Intelligence Review · 2024 · 511 citations
• Generalized Out-of-Distribution Detection: A Survey · International Journal of Computer Vision · 2024 · 441 citations
• Deep Industrial Image Anomaly Detection: A Survey · Machine Intelligence Research · 2024 · 348 citations
• EfficientAD: Accurate Visual Anomaly Detection at Millisecond-Level Latencies · 2024 · 273 citations
• AnomalyGPT: Detecting Industrial Anomalies Using Large Vision-Language Models · Proceedings of the AAAI Conference on Artificial Intelligence · 2024 · 213 citations
• Real-Time Deep Anomaly Detection Framework for Multivariate Time-Series Data in Industrial IoT · IEEE Sensors Journal · 2022 · 192 citations
• A Comprehensive Survey of Deep Transfer Learning for Anomaly Detection in Industrial Time Series: Methods, Applications, and Directions · IEEE Access · 2024 · 174 citations
• RealNet: A Feature Selection Network with Realistic Synthetic Anomaly for Anomaly Detection · 2024 · 169 citations
• VadCLIP: Adapting Vision-Language Models for Weakly Supervised Video Anomaly Detection · Proceedings of the AAAI Conference on Artificial Intelligence · 2024 · 164 citations
• A Diffusion-Based Framework for Multi-Class Anomaly Detection · Proceedings of the AAAI Conference on Artificial Intelligence · 2024 · 156 citations

Most recent work

• Conditional outlier detection for clinical alerting · PubMed · 2026
• Memory-Efficient Artificial Intelligence Framework for Real-Time Multivariate Anomaly Detection · IEEE Internet of Things Journal · 2026
• HYDRA: A Multi-Level Hierarchy-Driven Approach for Robust Anomaly Detection in Time Series · Proceedings of the ACM on Management of Data · 2026
• The Power of Anomaly Detection in Predictive Maintenance: [Experiments & Analysis] · Proceedings of the ACM on Management of Data · 2026
• Reliable and Secure Anomaly Detection in Heterogeneous Federated Learning: A Comprehensive Review · Big Data Mining and Analytics · 2026
• A Deployment-Oriented Hybrid CNN–LSTM–MIL System for Real-World Video Anomaly Detection · Informatica · 2026
• Drop-in density-aware partitioning for tree-based anomaly detection · Machine Learning: Science and Technology · 2026
• DEEP LEARNING-BASED CLASSROOM ANOMALY DETECTION USING OBJECT-CENTRIC TEMPORAL MODELING · IJIREEICE · 2026
• Adaptive Anomaly Detection in IoT Networks Using Ensemble Machine Learning Models · International Research Journal of Modernization in Engineering Technology & Science · 2026
• A Cross-Modal Temporal Alignment Framework for Artificial Intelligence-Driven Sensing in Multilingual Risk Monitoring · Sensors · 2026

Related topics in Computer Science