Self-Adaptive Anomaly Detection with Reinforcement Learning and Human Feedback in Connected Vehicles
For operators of autonomous cyber-physical systems, this work addresses the challenge of evolving normal behavior by integrating automated adaptation and human feedback in a single loop.
This paper introduces an online anomaly detection framework for connected vehicles that combines reinforcement learning, ensemble drift detection, and human-in-the-loop retraining. On a connected-vehicle testbed, the attention-augmented agent achieves an F1 score of 0.69, significantly outperforming single detectors (max 0.11), and recovers from concept drift (F1 from 0.52 to 0.65) without catastrophic forgetting.
Connected vehicles are autonomous cyber-physical systems whose behavior must be continuously monitored during operation to detect deviations from normal operation before they propagate into failures. Such evaluation is challenging because the systems themselves evolve: over-the-air updates, configuration changes, and shifting workloads alter the definition of normal behavior, causing static diagnostic methods to degrade silently over time. Existing approaches typically address either automated model adaptation or operator integration in isolation, rather than as a single coordinated supervisory loop. This paper presents an online anomaly detection framework for autonomous CPS that integrates three coordinated mechanisms. A factorized deep Q-network with self-attention selects the most suitable detector from a candidate pool for each monitored service, exploiting inter-service dependencies in the microservice topology. An ensemble of three statistical drift detectors monitors the input distribution and raises an alarm only when all three concur, prioritizing precision over recall. A human-in-the-loop retraining mechanism, built around a pending transition buffer and a 60/40 prioritized replay strategy, allows the operator to incorporate expert knowledge while preserving the system's learned response to prior data distributions. The framework is evaluated on a connected-vehicle testbed running an automated valet parking application across seven backend microservices. The attention-augmented agent achieves an F1 score of 0.69, compared to at most 0.11 for any single detector applied uniformly. Following a real software update that induces measurable concept drift, F1 drops to 0.52; after operator-triggered retraining, performance recovers to 0.65 on the new distribution while remaining at 0.69 on the prior one, demonstrating sustained adaptation without catastrophic forgetting.