Telosian: Reducing False Positives in Real-Time Cyber Anomaly Detection by Fast Adaptation to Concept Drift
Iker Maldonado, Erik Meeuwissen, Puck de Haan, Rob van der Mei · 2025
We propose Telosian * , an unsupervised anomaly detection model that dynamically adapts to concept drift.Telosian uses a novel update scheme that measures drift and adapts the model accordingly.We show that our update is faster than existing methods and results in an increased detection performance by reducing false positives.In practice this will also reduce the workload of security teams.Moreover, through our experiments, we show the importance of considering concept drift when deploying models.Further, the proposed model is designed to be easily implemented in practice, taking into account the ease of deployment and reducing operational costs without sacrificing detection performance.Additionally, we provide clear guidelines on how such an implementation should be done.Moreover, we investigate the presence of drift in popular datasets and conclude that the amount of drift is limited.We call on the academic community to develop more (cyber security) datasets that capture drift.