WassDRO-AD: distributionally robust anomaly detection for multivariate IoT data streams

Anomaly detection in multivariate IoT data streams must handle distributional shift between training and deployment, yet most methods assume i.i.d. data. We propose WassDRO-AD, which formulates anomaly detection as a Wasserstein distributionally robust optimization (DRO) problem. Given feature vectors from normal windows, WassDROAD solves a minimax problem hedging against all distributions within a Wasserstein ball around the empirical training distribution. The solution yields a robust center and Mahalanobis scoring with a finite-sample guarantee. We also introduce WassDRO-MS, a multi-scale variant aggregating detection across temporal resolutions. Experiments on five diverse benchmarks spanning IoT monitoring, server telemetry, and spacecraft telemetry show that WassDRO-AD achieves the best average F1 of 0.732, ahead of WassDRO-MS (0.726) and the strongest baseline Threshold(3σ) (0.694). The single-scale detector excels on high-dimensional multivariate streams while remaining efficient (runtime < 1 s per dataset).