Isolation Forest Nanjing University（隔离森林南京大学）.pdfVIP

Isolation Forest Fei Tony Liu, Kai Ming Ting Zhi-Hua Zhou Gippsland School of Information Technology National Key Laboratory Monash University, Victoria, Australia for Novel Software Technology {tony.liu},{kaiming.ting}@.au Nanjing University, Nanjing 210093, China zhouzh@ Abstract anomalies. Notable examples such as statistical methods [11], classification-based methods [1], and clustering-based Most existing model-based approaches to anomaly de- methods [5] all use this general approach. Two major draw- tection construct a profile of normal instances, then iden- backs of this approach are: (i) the anomaly detector is opti- tify instances that do not conform to the normal profile as mized to profile normal instances, but not optimized to de- anomalies. This paper proposes a fundamentally different tect anomalies—as a consequence, the results of anomaly model-based method that explicitly isolates anomalies in- detection might not be as good as expected, causing too stead of profiles normal points. To our best knowledge, the many false alarms (having normal instances identified as concept of isolation has not been explored in current liter- anomalies) or too few anomalies being detected; (ii) many ature. The use of isolation enables the proposed method, existing methods are constrained to low dimensional data iForest, to exploit sub-sampling to an extent that is not fea- and small d