DocumentCode :
2709629
Title :
Isolation Forest
Author :
Liu, Fei Tony ; Ting, Kai Ming ; Zhou, Zhi-Hua
Author_Institution :
Gippsland Sch. of Inf. Technol., Monash Univ., Clayton, VIC
fYear :
2008
fDate :
15-19 Dec. 2008
Firstpage :
413
Lastpage :
422
Abstract :
Most existing model-based approaches to anomaly detection construct a profile of normal instances, then identify instances that do not conform to the normal profile as anomalies. This paper proposes a fundamentally different model-based method that explicitly isolates anomalies instead of profiles normal points. To our best knowledge, the concept of isolation has not been explored in current literature. The use of isolation enables the proposed method, iForest, to exploit sub-sampling to an extent that is not feasible in existing methods, creating an algorithm which has a linear time complexity with a low constant and a low memory requirement. Our empirical evaluation shows that iForest performs favourably to ORCA, a near-linear time complexity distance-based method, LOF and random forests in terms of AUC and processing time, and especially in large data sets. iForest also works well in high dimensional problems which have a large number of irrelevant attributes, and in situations where training set does not contain any anomalies.
Keywords :
computational complexity; data mining; learning (artificial intelligence); trees (mathematics); LOF; ORCA; data mining; iForest method; isolation forest method; linear time complexity; model-based anomaly detection approach; random forest; training data; Application software; Astronomy; Constraint optimization; Credit cards; Data mining; Detectors; Information technology; Isolation technology; Laboratories; Performance evaluation; anomaly detection; binary trees; isolation forest; model based; novelty detection; outlier detection;
fLanguage :
English
Publisher :
ieee
Conference_Titel :
Data Mining, 2008. ICDM '08. Eighth IEEE International Conference on
Conference_Location :
Pisa
ISSN :
1550-4786
Print_ISBN :
978-0-7695-3502-9
Type :
conf
DOI :
10.1109/ICDM.2008.17
Filename :
4781136
Link To Document :
بازگشت