A hybrid ABC-based online evolving spiking neural network for unsupervised anomaly detection in streaming data

Anomaly detection

Anomalies are phenomena that significantly deviate from expected patterns or typical conditions. Anomaly detection, on the other hand, is the method used to identify data points that fall outside the normal distribution within a dataset, highlighting unusual or unexpected behavior (Hossen et al., 2024). These anomalies often indicate unusual events, such as network intrusions, structural defects, medical conditions like seizures, or disruptions in ecological systems. The anomalies are defined differently depending on the specific domain of the application. For instance, in the medical field, even a slight deviation, such as a small change in body temperature, might be considered unusual. Conversely, a comparable fluctuation in the stock market may be seen as normal. Therefore, adapting a method designed for one domain to another is not a straightforward process.

Anomaly detection has emerged as a crucial element in numerous real-world applications, where identifying unusual trends or behaviors is necessary to preserve system efficiency, safety, and integrity. As a fundamental tool for early warning and automated decision-making, anomaly detection can be used to detect a wide range of issues, including fraudulent transactions in financial systems, intrusions in cybersecurity networks, medical abnormalities in healthcare diagnostics, and industrial equipment problems (Blázquez-García et al., 2021). Recent advancements have introduced a variety of adaptive and context-aware approaches, including generative modeling (Wang et al., 2023), self-supervised learning (Wang et al., 2025), and prompt-enhanced architectures (Pu et al., 2024). These approaches have been successfully applied to domain-specific anomaly detection tasks in hyperspectral sensing, video surveillance, and medical imaging (Lu et al., 2024; Bhowmick et al., 2025).

According to Filho et al. (2022), anomaly detection techniques can be categorized based on their learning methods as follows:

• Supervised Anomaly Detection: in this approach, both normal and anomalous data are labeled and available during training. The objective is to develop a predictive model that can distinguish between normal and anomalous instances.

• Semi-Supervised Anomaly Detection: this method trains the model using only normal data, flagging any data that does not conform to the learned patterns as anomalies.

• Unsupervised Anomaly Detection: this approach does not require labeled training data. It operates on the assumption that normal data points are significantly more frequent than anomalies. However, this assumption may lead to a high false positive rate if it does not hold.

As outlined by Chandola, Banerjee & Kumar (2009), anomalies can be categorized into three types, which significantly influence the design and effectiveness of anomaly detection algorithms: point anomalies, contextual anomalies, and collective anomalies. Figure 1, adapted from Park & Jang (2024), illustrates these three types of anomalies.

• Point Anomalies: point anomalies occur when a single instance in a dataset significantly deviates from the expected pattern. These anomalies are typically detected by observing whether a data point falls outside the usual range of values. For instance, temperature data recorded from a building might exhibit a consistent pattern over time, and any sharp deviation or sudden spike in the temperature readings, which might not align with known environmental factors, could signal an anomaly. Such anomalies are usually associated with sensor malfunctions or rare external events.

• Contextual Anomalies: contextual anomalies are detected when an observation appears normal in one context but becomes anomalous in another. The context is crucial in understanding whether the data behavior is abnormal. For example, heavy traffic during office hours on a highway is expected and deemed normal. However, the same traffic pattern observed late at night, when the road is generally less busy, would be abnormal. Contextual anomalies are often more challenging to detect because they require a deeper understanding of the underlying context to distinguish normal from anomalous behavior.

• Collective Anomalies: collective anomalies occur when a group of data points, although individually normal, exhibit abnormal behavior when analyzed collectively. For example, analyzing individual heartbeats within a single time interval may reveal no signs of abnormality. However, when several intervals are examined collectively, it might reveal abnormal heart behavior, such as irregularities in the heart’s rhythm. These anomalies often occur in temporal or spatial data and require the consideration of relationships between data points over time or space.

Spiking neural networks

Spiking neural networks (SNNs), also referred to as “third-generation neural networks,” use spikes in the form of pulses instead of digital data to represent the input and output of neurons (Almasri & Sahran, 2014). SNNs have earned considerable attention due to their ability to model the temporal dynamics of data more effectively than traditional neural networks. Their event-driven nature, which only activates neurons upon the receipt of input spikes, allows them to mimic biological neural processes and achieve substantial energy efficiency (Wang et al., 2024). This characteristic makes SNNs particularly suitable for low-power applications such as Internet of Things (IoT) devices and edge computing, where resource constraints and real-time processing are critical (Dan et al., 2024; Lucas & Portillo, 2024).

Unlike the neuron models used in artificial neural networks (ANNs), spiking neurons do not operate based on matrix-vector multiplication, but fire spikes when their membrane potential reaches the spiking threshold (Plagwitz et al., 2023). In ANNs, neurons take continuous real-valued inputs and outputs. As illustrated in Fig. 2, derived from Yamazaki et al. (2022), the ANN neurons compute a weighted sum of the input signal, followed by applying a nonlinear activation function to produce the output signal. In contrast, spiking neurons in SNN offer a more detailed and realistic representation of biological neurons. Spiking neurons, similar to their biological counterparts, are connected through synapses, and the membrane potential and activation threshold primarily govern their behavior. The spike signal received by the dendrites alters the membrane potential of the neuron, and once this accumulated potential reaches the threshold, the neuron emits a spike signal from its axon to the next neuron (Wu et al., 2024). Numerous enhancements and variations of the spiking neuron model have been introduced, including the evolving spiking neural network (eSNN), which involves the incremental growth of the number of spiking neurons over time. This gradual evolution allows eSNNs to efficiently capture and interpret temporal patterns from continuous data streams, making them ideal for adaptive learning in real-time scenarios (Maciąg et al., 2021).

Online evolving spiking neural networks

One of the most promising SNN designs is the evolving spiking neural network (eSNN) (Lobo et al., 2020). By gradually merging the generated neurons to find the pattern in the given issue, the eSNN improves the flexibility of SNN (Kasabov, 2019). To gather clusters and patterns from new data, the spiking neurons in this type of network are created (evolved) and incrementally combined. The eSNN repeatedly generated repositories for every class to provide new data without retraining the learned dataset (Schliebs & Kasabov, 2013). The neural model of eSNN facilitates rapid real-time simulations of large-scale networks with minimal computational overhead. These characteristics position eSNNs as highly suitable for online learning environments (Wysoski, Benuskova & Kasabov, 2006).

Motivated by these advantages, Lobo et al. (2018) further enhanced the eSNN model and developed the Online eSNN (OeSNN) to address the evolving demands of online data processing. OeSNN networks were developed to handle classification tasks in streaming data, building upon the eSNN architecture, which was initially designed for classifying batch data with distinct training and testing phases (Kasabov, 2007). Both eSNN and OeSNN share a similar structure consisting of input and output layers; however, the number of output neurons in OeSNN is limited, whereas eSNN permits an unlimited number of output neurons. This restriction in OeSNN is driven by the demands of classifying data streams, where vast amounts of input data are typically processed, and strict memory limitations must be observed (Maciąg et al., 2021). The OeSNN constructs a repository of output neurons corresponding to training patterns. For each class-specific training pattern, a new output neuron is created and connected to all pre-synaptic neurons in the preceding layer through synaptic weights $w_{ji}$. The architecture of OeSNN is presented in Fig. 3, adapted from Maciąg et al. (2021).

To classify real-valued datasets using OeSNN, data samples are transformed into Spatio-temporal spike patterns using neural encoding techniques. A widely adopted method is the rank-order population encoding, an extension of the rank-order encoding proposed by Thorpe & Gautrais (1998). This technique prioritizes spikes based on their temporal order across synapses, providing additional information to the network, and utilizes the Gaussian Receptive Field (GRF) encoding scheme, as described by Bohte, Kok & La Poutré (2002), which distributes continuous input values across several neurons with overlapping Gaussian activation functions. Each neuron in this scheme fires only once within the coding interval, ensuring a robust representation of input features.

The population encoding based on GRF is explained in Fig. 4, derived from Hamed, Kasabov & Shamsuddin (2011). The intersection points with each Gaussian are calculated (triangles) with an input value v = 0.75 (thick straight line in the top figure). These intersection points are then converted into spike time delays (see the lower figure). During encoding, Gaussian Receptive Field Neurons (GRFNs) are employed to distribute input samples with overlapping sensitivity profiles, ensuring each feature is transformed into a spatio-temporal spike pattern. This approach effectively captures the temporal dynamics of the input data, facilitating precise and robust classification. The center $C_j$ and width $W_j$ of each GRF pre-synaptic neuron are computed as follows:

(1) $$C_j=I_{min}^n+{\displaystyle \frac{2j-3}{2}\left({\displaystyle \frac{I_{max}^n-I_{min}^n}{nGRFs-2}}\right).}$$

(2) $$W_j={\displaystyle \frac{1}{\beta }\left({\displaystyle \frac{I_{max}^n-I_{min}^n}{nGRFs-2}}\right).}$$

Here, $I_{max}^n$ and $I_{min}^n$ representing the interval values of the n^th feature in a given window size, $nGRFs$ is the number of receptive fields (GRF) for each feature. $\beta \in \left[1,2\right]$ is the overlap factor parameter, which regulates how much Gaussian Random Fields overlap. The output of neuron j is represented as:

(3) $$outpu{t}_j=exp\cdot \left({\displaystyle \frac{{\left(x-C_j\right)}^2}{2W_j^2}}\right).$$

Here x is the input sample, the firing time for each pre-synaptic neuron j is defined as:

(4) $$T_j=T\cdot \left(1-outpu{t}_j\right).$$

Here, T is the spike interval.

The LIF model is utilized to generate initial neurons. The neuron fires only once and only when the postsynaptic potential (PSP) value is higher than its threshold value. PSP of the ith neuron is identified as:

(5) $$PS{P}_i=\{\begin{array}{cc}0\hfill & iffired\hfill \\ {\sum }_j{w}_{ji}\cdot mo{d}^{order\left(j\right)}\hfill & otherwise\end{array}.$$

Here $w_{ji}$ represents the synaptic weight between pre-synaptic neuron j and output neuron i, while order(j) denotes the firing rank of the pre-synaptic neuron, and mod represents the modulation factor, takes a value within the range [0, 1]. For each training sample belonging to the same class, a new output neuron is created and connected to all pre-synaptic neurons in the preceding layer, with weights assigned based on their rank order as follows:

(6) $$w_{ji}=mo{d}^{order\left(j\right)}.$$

The threshold $\gamma i$ of a newly generated output neuron is defined as:

(7) $${\gamma }_i=PS{P}_{max,i}\cdot C.$$

Here $C$ is a user-fixed value in (0, 1].

The weight vector of a newly produced output neuron is compared with those of existing neurons in the repository. If the Euclidean Distance between the new neuron’s weight vector and that of any existing output neuron is less than or equal to the SIM, the neurons are merged. In this case, the threshold ${\gamma }_i$ and the weight vector $w_{ji}$ are updated using the following formulas:

(8) $$w_{ji}={\displaystyle \frac{w_{new}+\left(w_{ji}\cdot M\right)}{M+1}.}$$

(9) $${\gamma }_i={\displaystyle \frac{{\gamma }_{new}+\left({\gamma }_i\cdot M\right)}{M+1}.}$$

The variable “M” indicates how many mergers the same output neuron has been involved in during the OeSNN’s learning phase. Following a merger, the model proceeds using the updated neuron representation and discards the weight vector of the newly created neuron. On the other hand, the newly created output neuron is added to the repository if no existing neuron in the repository meets the similarity criteria (based on the SIM value).

Building upon the adaptation of the OeSNN by Lobo et al. (2018), Maciąg et al. (2021) recently introduced the OeSNN-UAD method for detecting anomalies in streaming data. In contrast to the original OeSNN, the OeSNN-UAD operates in an unsupervised manner, without isolating output neurons into distinct groups. Instead, it integrates three additional modules: value correction, anomaly classification, and output value generation for candidate output neurons. The OeSNN-UAD identifies an input as anomalous under two specific conditions: firstly, when no output neurons in the repository are activated, and secondly, when the deviation between the predicted and actual input values exceeds the sum of the prediction error and a user-defined multiple of the recent standard deviation.

Overview of the ABC algorithm

In the present era, the popularity of metaheuristic optimization algorithms has increased exponentially due to their tangible impact on the resolution of optimization problems. Numerous metaheuristic algorithms are inspired by the collective intelligence found in swarms of insects and animals, including ants, whales, lemurs, chimps, and wolves (Abasi et al., 2022). For instance, the proficient swarm intelligence behaviors displayed by honeybees have inspired the development of algorithms for problem-solving and optimization tasks (Hussein, Sahran & Sheikh Abdullah, 2017; Qasem et al., 2022). These algorithms typically start with a set of randomly generated solutions and iteratively improve them using intelligent operators designed to balance exploration and exploitation of the search space. The exploration phase searches to investigate diverse regions of the solution space, while the exploitation phase focuses on refining existing solutions to achieve optimality. By combining these phases and leveraging accumulated knowledge from prior iterations, metaheuristic algorithms have been widely successful in tackling both global and local optimization challenges (Alorf, 2023).

The ABC algorithm is a metaheuristic optimization algorithm inspired by the intelligent foraging behaviors observed in honeybee swarms. It has proven effective in solving a range of optimization issues (Abdullah, Nseef & Turky, 2018; Alrosan et al., 2021). The ABC, first proposed by Karaboga (2005), models the behaviors of three types of bees: employed bees, onlooker bees, and scout bees. The employed bees are responsible for locating food sources and disseminating this information to the onlooker bees via a waggle dance, which conveys the quality and location of the food source. Subsequently, onlookers probabilistically select food sources based on this information, while scout bees explore new areas if a food source becomes unproductive (Hacılar et al., 2024).

Since its introduction in 2005, the ABC algorithm has gained widespread acceptance due to its simplicity, flexibility, and efficiency in solving complex optimization problems, particularly in high-dimensional and multimodal search spaces. One of the key strengths of ABC is its capacity to effectively balance exploration and exploitation through its three bee types, employed, onlooker, and scout bees. This balance prevents the algorithm from becoming trapped in local optima while enabling efficient convergence towards global solutions. In ABC, the food sources represent potential solutions, and the quality of the food source is indicative of the fitness of a solution. The algorithm operates in cycles, whereby solutions are iteratively improved. In each iteration of the algorithm, the employed bees modify the current solution to produce a new one. This is achieved through the application of a greedy selection mechanism, whereby the superior solution is retained. Subsequently, onlooker bees select the superior solutions for further refinement. Suppose a solution fails to improve after a predefined number of attempts. In that case, it is abandoned and the scout bees embark on a random search for new candidate solutions, thereby ensuring diversity within the solution space (Yang et al., 2024).

The ABC algorithm begins by initializing its control parameters. These include the Solutions Number (SN), which represents the population size or the number of potential food sources. Maximum Cycles Number (MCN) is the maximum number of iterations or evaluations that serve as a termination criterion. Limit (abandonment criteria) is the parameter that defines the maximum number of exploitations allowed before a food source is abandoned.

In the first foraging cycle, the scout bees are responsible for discovering new food sources, and they randomly assign initial positions to these food sources using a method Eq. (10), which helps guide this random placement.

(10) $$x_i^j=x_{min}^j+rand\left[0,1\right]\left(x_{max}^j-x_{min}^j\right).$$

Here, $\mathrm{i}=1,2,\dots ,\mathrm{S}\mathrm{N},\mathrm{j}=1,2,\dots ,\mathrm{D}$, the value of D represents the dimension of the problem (number of optimization parameters), whereas SN refers to the number of food sources, $x_{max}^j,x_{min}^j$. The upper and lower boundaries of $j_{th}$ parameter, respectively.

Each food source is assessed and assigned both a cost function value ( $f_i$) and a counter value ( $trai{l}_i$). The scout bees associated with more profitable food sources transition into employed bees, tasked with exploring the surrounding areas of these sources using Eq. (11) to identify superior alternatives for exploitation:

(11) $$v_{ij}=x_{ij}+{\phi }_{ij}\times \left(x_{ij}-x_{kj}\right)$$where k is a randomly selected neighboring index where $\mathrm{k}\ne \mathrm{i}\in \{1,2,\dots ,\mathrm{S}\mathrm{N}\},\mathrm{j}\in 1,2,\dots ,\mathrm{D}$ represents a randomly chosen dimension index, and ${\phi }_{ij}$ ∈ [−1,1] is a random number generated from a uniform distribution.

If the newly generated solution $v_{ij}$ proves superior to the current solution $x_{ij}$, the current solution is replaced, and $trai{l}_i$ is reset to zero. Otherwise, the current solution is kept in the population, and $trai{l}_i$ is increased by 1.

During the initial cycle, onlooker bees (who were initially scout bees of less profitable solutions) remain in the hive. They select a more profitable food source based on the information provided by the employed bees. This is simulated by assigning a probability to each food source based on the profitability values using Eqs. (12) and (13) and implementing a roulette wheel selection method, in which more bees are likely to be recruited to more profitable sources, and low-quality solutions have a lower chance of being chosen.

(12) $$fitnes{s}_i=\{\begin{array}{cc}\frac{1}{\left(1+f_i\right)}\hfill & if{f}_i\ge 0\hfill \\ 1+\left|f_i\right|\hfill & if{f}_i<0\hfill \end{array}$$

(13) $$p_i=\frac{fitnes{s}_i}{{\sum }_{i=1}^{SN}fitnes{s}_i}$$where the $f_i$ is the objective function and $p_i$ the probability of the food source i.

Once an onlooker bee has selected a food source, it proceeds to perform the same search operation as the employed bee, as described by Eq. (11). A greedy selection process is then used to update the counter ( $trai{l}_i$) associated with the chosen solution. These counters are compared with the predefined limit parameter during the scout bee phase to identify which sources have been sufficiently exploited. If the counter ( $trai{l}_i)$ exceeds the limit, the corresponding solution $x_i$ is considered exhausted, and a new, previously unexplored solution is generated using Eq. (10) in place of $x_i$. This sequence of operations is repeated until the termination criterion is met.

Initialization hase

The ABC can be formulated as a 2D matrix $n\times m$ where n refers to the number of bees and m refers to the solution size, as expressed in Eq. (14).

(14) $$ABC=\left[\begin{array}{ccc}{x}_1^1& x_1^2\cdots & x_1^m\\ ⋮& ⋮\cdots & ⋮\\ x_n^1& x_n^2\dots & x_n^m⋮\end{array}\right]\left[\begin{array}{c}{F}_{x_1}\\ ⋮\\ F_{x_n}\end{array}\right]\left[\begin{array}{c}fi{t}_{x_1}\\ ⋮\\ fi{t}_{x_n}\end{array}\right].$$

All the candidate solutions (Set 1, Set 2, or Set 3) in the population are randomly initiated from the possible ranges of OeSNN hyperparameters using Eq. (10). Further, the objective function, F1-score, is calculated using OeSNN, and the fitness value for all solutions is evaluated, which gives the initial global Best solution.

Employee bees phase

In this phase, the employee bees generate new candidate solutions using Eq. (11), compute the objective function with the OeSNN, and assess the fitness of each solution using Eq. (12). Then, a greedy selection process is employed to evaluate the newly generated solutions. If the new solution demonstrates an improvement over the existing one, it replaces the current solution; otherwise, no changes are made. This process is repeated for every employee bee in the population to ensure a comprehensive exploration of potential solutions.

Onlooker bees phase

The onlooker phase commences with the calculation of the probability value (P) for each food source obtained from the employed bees by using Eq. (13). Subsequently, a single food source is selected based on its probability value (Pi), resulting in the generation of a new solution by using Eq. (11). The objective function utilizing OeSNN is then calculated, and the fitness value for the novel solution is evaluated using Eq. (12). To assess the efficacy of the new solution, greedy selection is employed. In the event of an enhancement being observed, the new solution is updated with the current solution; conversely, no alterations are made. These procedures are repeated for each onlooker bee within the population.

Scout bees phase

The Scout Bee Phase starts when a food source has not been updated for a specified number of cycles, signaling that the food source has been abandoned. At this point, the abandoned food source is replaced by a randomly chosen one from the search space. The bee previously associated with the abandoned source becomes a scout bee, and a new solution is generated for this scout using Eq. (10).

Memories best solution

Updating and retaining the Best Solution found so far.

Stop criteria

Repeat Steps 2–5 till the termination condition is met.

Return the best solution

These steps will be repeated for each set of the hyperparameters. Furthermore, the results will be thoroughly analyzed to determine the optimal set of hyperparameters. All the above steps of the HABCOeSNN are illustrated as a flowchart in Fig. 5.

The pseudocode of the HABCOeSNN is given below:

Experimental setup

For the experiments, all evaluation was carried out on a PC with an 11th Gen Intel(R) Core™ i5-11260H processor at 2.60 GHz and 16 GB of RAM, running Windows 11 64-bit. The programming language used for the experiments is Dev C++ 6.3.

Evaluation measures

To assess the performance of HABCOeSNN in the anomaly detection task, multiple evaluation metrics are employed to offer a well-rounded perspective, particularly in handling imbalanced datasets:

Parameters setting

Before the experiment, the ABC and OeSNN parameters were established. According to research on the ABC algorithm, it is observed that increasing the colony size generally leads to better performance. However, after reaching a certain threshold, further increasing the colony size does not yield significant improvements in the algorithm’s performance (Karaboga & Basturk, 2008). The conducted experiments on different test problems recommended that a colony size of 50 to 100 is sufficient to achieve acceptable convergence without unnecessarily increasing computational costs. Table 2 lists the ABC parameters that established before the experimental conditions and were derived from Karaboga & Basturk (2008). The setting of the hyperparameter values for OeSNN is provided based on the works of Kasabov et al. (2014), Tu, Kasabov & Yang (2017), and Maciąg et al. (2021), as shown in Table 3.

Experimental I: anomaly detection in the Yahoo Webscope dataset

Results

The findings shown in Table 5 and the heatmap analysis in Fig. 6 highlight the differences in performance between the three sets of hyperparameters (Sets 1, Set 2, and Set 3) when applied to different benchmark datasets. Set 2 proves to be the most efficient configuration, achieving the most excellent F1 scores across the majority of datasets, including A2Benchmark with a value of 0.942 and A1Benchmark with 0.852. This demonstrates the resilience of the proposed HABCOeSNN in detecting anomalies, striking a balance between precision and recall. Although Set 3 has competitive recall values, especially in A2Benchmark, its lower F1 scores, as seen in A4Benchmark with a value of 0.713, indicate compromises between precision and recall. Regarding Set 1, it is noticeably less flexible in most datasets but produces excellent outcomes in some situations, as indicated by its lower F1 scores in A3Benchmark (0.571) and A4Benchmark (0.469). These variations in performance are influenced by the inherent characteristics of the datasets, which include both real and synthetic time series. Overall, Set 2 demonstrates the most balanced and robust performance across diverse datasets.

Table 5:

Evaluation measures of the HABCOeSNN on the Yahoo Webscope dataset.

Categories	Set 1					Set 2					Set 3
	Prec.	Rec.	F1	BA	MCC	Prec.	Rec.	F1	BA	MCC	Prec.	Rec.	F1	BA	MCC
A1Benchmark	0.876	0.828	0.832	0.911	0.838	0.872	0.886	0.852	0.938	0.861	0.761	0.901	0.785	0.946	0.803
A2Benchmark	0.910	0.934	0.881	0.966	0.895	0.938	0.997	0.942	0.998	0.951	0.770	0.995	0.786	0.990	0.812
A3Benchmark	0.826	0.477	0.571	0.738	0.606	0.968	0.770	0.847	0.885	0.857	0.958	0.743	0.823	0.871	0.836
A4Benchmark	0.668	0.450	0.469	0.724	0.505	0.894	0.680	0.749	0.840	0.766	0.883	0.638	0.713	0.819	0.734

DOI: 10.7717/peerj-cs.3184/table-5

Note:

The bold numbers indicate the best results.

Moreover, to evaluate the performance of hyperparameter sets comprehensively across multiple time series, a complementary Multi-Criteria Decision Making (MCDM) approach was employed, integrating the Weighted Sum Model (WSM) and the Technique for Order Preference by Similarity to Ideal Solution (TOPSIS). Table 6 shows the evaluation of the performance of the hyperparameters: Set 1, Set 2, and Set 3. Set 2 consistently emerges as the best-performing configuration, achieving the highest scores in the WSM score (e.g., 0.888 in A1Benchmark and 0.967 in A2Benchmark) and being ranked first across all datasets in TOPSIS, indicating its robustness and balance across evaluation metrics. Set 1 performs competitively in some cases, such as a WSM score of 0.921 in A2Benchmark, but is generally ranked second, reflecting slightly less optimization than Set 2. Set 3 exhibits variability, with strong performance in A3Benchmark and A4Benchmark, but lower rankings in A1Benchmark and A2Benchmark, indicating inconsistent results across datasets. Overall, Set 2 demonstrates the most balanced and reliable performance, making it the optimal configuration for these benchmarks.

Table 6:

Comparison of weighted sum and TOPSIS for hyperparameter sets across Yahoo Webscope dataset.

Categories	Weighted sum scores			TOPSIS ranks
	Set 1	Set 2	Set 3	Set 1	Set 2	Set 3
A1Benchmark	0.864	0.888	0.848	2	1	3
A2Benchmark	0.921	0.967	0.878	2	1	3
A3Benchmark	0.660	0.872	0.853	3	1	2
A4Benchmark	0.585	0.796	0.769	3	1	2

DOI: 10.7717/peerj-cs.3184/table-6

Note:

The bold numbers indicate the best results.

Table 7 presents a comparative analysis of various anomaly detection methods across four benchmark datasets (A1Benchmark to A4Benchmark), focusing on the performance of HABCOeSNN. The proposed method utilizing Set 2 demonstrates superior effectiveness, consistently outperforming competing techniques. In particular, HABCOeSNN surpasses popular methods such as Twitter Anomaly and Yahoo EGADS on the A1, A2, and A4 benchmarks, achieving F1-scores of 0.852, 0.942, and 0.749, respectively. Although DeepAnT performs well in the A3Benchmark, the proposed HABCOeSNN with Set 2 consistently succeeds across all datasets.

Table 7:

Average F1-score evaluation of HABCOeSNN compared with the selected unsupervised anomaly detectors on the Yahoo Webscope dataset.

Categories	Yahoo EGADS1	Twitter Anomaly1	DeepAnT1	OeSNN-UAD2	OeSNN-D3	Set 1	Set 2	Set 3
A1Benchmark	0.470	0.470	0.460	0.700	0.405	0.832	0.852	0.785
A2Benchmark	0.580	0.000	0.940	0.690	0.451	0.881	0.942	0.786
A3Benchmark	0.480	0.300	0.870	0.410	0.110	0.571	0.847	0.823
A4Benchmark	0.290	0.340	0.680	0.340	0.147	0.469	0.749	0.713

DOI: 10.7717/peerj-cs.3184/table-7

Notes:

The bold numbers indicate the best results.

1 Presented by Munir et al. (2019).

2 Presented by Maciąg et al. (2021).

3 Presented by Bäßler, Kortus & Gühring (2022).

Comparative analysis with other optimization algorithms

Figure 7 illustrates the comparative performance of the HABCOeSNN model against several optimization algorithms, including PSO, GWO, FPA, WOA, and GS, using three distinct sets of hyperparameters (Sets 1, Set 2, and Set 3). The results indicate that HABCOeSNN with Set 2 consistently achieves the highest overall performance across benchmarks. Set 3 demonstrates strong results in the A3Benchmark, while Set 1 excels in the A1 and A2Benchmarks. In contrast, the PSO and FPA algorithms exhibit varying degrees of success, with PSO performing well in A1 and A2 benchmarks. However, WOA, GWO, and GS perform poorly, particularly in the more complex A3 and A4 benchmarks. These findings highlight the robustness of HABCOeSNN, particularly when optimized with Set 2 hyperparameters across diverse datasets.

Experimental II: anomaly detection in the NAB dataset

Results

The results presented in Table 11, accompanied by the heatmap visualization in Fig. 8, underscore the superior performance of the HABCOeSNN when employing the Set 2 hyperparameter configuration. Across the time series in the NAB dataset, Set 2 consistently achieves the highest F1-scores, particularly excelling in ArtificialWithAnomaly and RealTraffic, with an F1-score of 0.878 and a Balanced Accuracy (BA) of 0.940. This highlights its capability to balance precision and recall effectively, which is critical for robust anomaly detection. In contrast, Set 1 serves as a baseline with modest performance, while Set 3 exhibits inconsistent results across datasets despite performing well in specific scenarios. Besides, the heatmap clearly illustrates the robustness and adaptability of the HABCOeSNN, reinforcing its role as the optimal configuration for diverse anomaly detection tasks in dynamic streaming environments. Also, the efficacy of various hyperparameter configurations was analyzed across multiple time series using MCDM approaches, including WSM and TOPSIS. According to Table 12, Set 2 is consistently the best arrangement, particularly with datasets such as ArtificialWithAnomaly and RealAdExchange.

Table 11:

Evaluation measures of the proposed HABCOeSNN regarding hyperparameters on the NAB dataset.

Categories	Set 1					Set 2					Set 3
	Prec.	Rec.	F1	BA	MCC	Prec.	Rec.	F1	BA	MCC	Prec.	Rec.	F1	BA	MCC
ArtificialWithAnomaly	0.758	0.877	0.800	0.921	0.790	0.867	0.896	0.878	0.940	0.867	0.864	0.769	0.791	0.877	0.786
RealAdExchange	0.414	0.529	0.408	0.706	0.370	0.476	0.503	0.473	0.712	0.417	0.479	0.411	0.384	0.671	0.358
RealAWSCloudwatch	0.523	0.674	0.540	0.783	0.508	0.488	0.715	0.561	0.811	0.526	0.528	0.673	0.550	0.787	0.517
RealKnownCause	0.443	0.534	0.455	0.727	0.413	0.463	0.601	0.491	0.759	0.456	0.428	0.600	0.477	0.751	0.432
RealTraffic	0.541	0.616	0.545	0.776	0.513	0.620	0.630	0.603	0.790	0.571	0.632	0.590	0.577	0.772	0.553
RealTweets	0.321	0.587	0.395	0.712	0.334	0.372	0.561	0.427	0.724	0.374	0.362	0.569	0.421	0.721	0.365

DOI: 10.7717/peerj-cs.3184/table-11

Note:

The bold numbers indicate the best results.

Table 12:

Performance evaluation of hyperparameter sets using weighted sum method and TOPSIS across the NAB dataset.

Time series	Weighted sum scores			TOPSIS ranks
	Set 1	Set 2	Set 3	Set 1	Set 2	Set 3
ArtificialWithAnomaly	0.841	0.897	0.818	2	1	3
RealAdExchange	0.521	0.551	0.463	2	1	3
RealAWSCloudwatch	0.633	0.647	0.614	3	1	2
RealKnownCause	0.548	0.585	0.542	3	1	2
RealTraffic	0.626	0.667	0.627	3	1	2
RealTweets	0.509	0.528	0.493	3	1	2

DOI: 10.7717/peerj-cs.3184/table-12

Note:

The bold numbers indicate the best results.

To further assess the HABCOeSNN approach, its performance is compared with that of the state-of-the-art detectors described in Maciąg et al. (2021). Table 13 indicates that Set 2 consistently outperforms the other sets across multiple time series datasets. Specifically, Set 2 exhibits superior performance in the RealAWSCloudwatch and RealKnownCause time series, with consistently higher precision, recall, and balanced accuracy. While Set 3 also produces competitive results, particularly in the RealKnownCause and RealTraffic time series, Set 2 remains the most robust. Its resilience in anomaly detection tasks, demonstrated by consistent performance across all key metrics, provides strong evidence that Set 2 is the most reliable and effective hyperparameter configuration for HABCOeSNN.

Table 13:

Average F1-score of HABCOeSNN in comparison with the state-of-art algorithms on the NAB dataset.

Time series	Bayesian changepoint	Context OSE	EXPoSE	HTM JAVA	KNN CAD	Numenta	NumentaTM	Relative entropy	Skyline	Twitter ADVec	Windowed Gaussian	DeepAnT	OeSNN-UAD	Set 1	Set 2	Set 3
ArtificialWithAnomaly	0.009	0.004	0.004	0.017	0.003	0.012	0.017	0.021	0.043	0.017	0.013	0.156	0.427	0.800	0.878	0.791
RealAdExchange	0.018	0.022	0.005	0.034	0.024	0.040	0.035	0.024	0.005	0.018	0.026	0.132	0.234	0.408	0.473	0.384
RealAWSCloudwatch	0.006	0.007	0.015	0.018	0.006	0.017	0.018	0.018	0.053	0.013	0.060	0.146	0.342	0.540	0.561	0.550
RealKnownCause	0.007	0.005	0.005	0.013	0.008	0.015	0.012	0.013	0.008	0.017	0.006	0.200	0.324	0.455	0.491	0.477
RealTraffic	0.012	0.020	0.011	0.032	0.013	0.033	0.036	0.033	0.091	0.020	0.045	0.223	0.340	0.545	0.603	0.577
RealTweets	0.003	0.003	0.003	0.010	0.004	0.009	0.010	0.006	0.035	0.018	0.026	0.075	0.310	0.395	0.427	0.421

DOI: 10.7717/peerj-cs.3184/table-13

Note:

The bold numbers indicate the best results.

Comparative analysis with other optimization algorithms

The results presented in Fig. 9 highlight the comparison of the proposed method, using hyperparameters (Sets 1, Set 2, and Set 3) against five optimization algorithms: PSO, FPA, WOA, GWO, and GS. The HABCOeSNN, when utilizing Set 2 hyperparameters, consistently outperforms the other configurations, achieving the highest F1-scores in most time series, such as ArtificialWithAnomaly for (0.878) and RealTraffic with (0.603). This indicates that the hyperparameters in Set 2 significantly enhance the generalization ability of the suggested method, allowing for more accurate anomaly detection in both synthetic and real-world data. Although algorithms like PSO and FPA yield competitive results, they generally underperform compared to the proposed method, particularly in complex datasets such as RealAdExchange and RealTweets.

Significance analysis

To ascertain the efficacy of the HABCOeSNN, a one-way analysis of variance (ANOVA) test was conducted to determine whether a statistically significant difference exists between the HABCOeSNN and other state-of-the-art methods. The high F-statistic and a corresponding p-value of less than 0.05 imply that the performance differences are statistically significant (Barbara & Fidell, 2013). As illustrated in Table 16, the HABCOeSNN utilizing Set 2 hyperparameters demonstrated a pronounced superiority over a range of benchmark anomaly detectors, as evidenced by high F-statistic values and extremely low p-values (p < 0.05). These findings support the resilience of the HABCOeSNN and reliability with Set 2 hyperparameters, establishing it as a novel and effective solution for unsupervised anomaly detection in streaming data.

Ablation study

To determine the contribution of the components in HABCOeSNN, an ablation study is presented across both the Yahoo Webscope and NAB datasets. Three configurations are assessed in the ablation study: (1) standard OeSNN with default hyperparameters and no optimization, (2) Offline-Optimized OeSNN, in which hyperparameters are adjusted once using ABC on a validation subset and then fixed, and (3) the full HABCOeSNN model with adaptive ABC optimization in real-time. As reported in Table 17, standard OeSNN achieved an average F1-score of 0.376 across six NAB time series categories, which improved to 0.436 with Offline-Optimized OeSNN. The HABCOeSNN model significantly outperformed both, reaching an average F1-score of 0.572. Similarly, in the Yahoo Webscope benchmark, the average F1-score increased from 0.646 (Standard OeSNN) to 0.824 (Offline-Optimized OeSNN), with the proposed HABCOeSNN further improving performance to 0.848.

These results reveal a clear and consistent performance gain at each step of model enhancement. The notable improvements from static ABC optimization validate that proper hyperparameter tuning is critical to effective anomaly detection using evolving spiking neural networks. However, the additional boost achieved by HABCOeSNN underscores the importance of online, adaptive optimization in non-stationary streaming contexts. Overall, the ablation results validate that both optimization and adaptivity are essential, and their combination in HABCOeSNN is key to achieving robust, real-time anomaly detection in unsupervised streaming environments.