How to handle anomaly detections with multiple different timeseries' from network traffic?

I would like to implement an anomaly detection algorithm on multiple timeseries' from different network users. Since each user has different behavior and network traffic usage, my question is how can I implement an anomaly detection algorithm for this case? If possible I would like to have the model to be trained on online data, meaning when new data arrives it should be able to use that data, so that I dont need to train it over and over again. When dealing with new users, it should consider other users as reference and not immediately trigger an anomaly. I was thinking about training an ensemble model of LSTMs with different temporal properties such as sequences of minutes, hours, days, weeks, months in order to predict successfully short-term anomalys and long-term occurences. Does anyone else had the same problem in the past?