Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Weighted Isolation and Random Cut Forest Algorithms for Anomaly Detection

Sijin Yeom, Jae-Hun Jung

TL;DR

This work tackles anomaly detection by addressing a key shortcoming of Isolation Forests and Robust Random Cut Forests: split decisions largely ignore the data’s density and shape. It introduces a density measure μ and density-aware partitioning, enabling weighted variants: Weighted Isolation Forest (WIF) and Weighted Random Cut Forest (WRCF). Theoretical results establish invariances and termination guarantees for the density-aware scheme, while experiments show that WIF/WRCF converge faster and improve detection, especially in dense regions and time-series contexts. The approach yields practical benefits for real-time anomaly detection in both time-series and Euclidean data, with robust performance on benchmark datasets.

Abstract

Random cut forest (RCF) algorithms have been developed for anomaly detection, particularly in time series data. The RCF algorithm is an improved version of the isolation forest (IF) algorithm. Unlike the IF algorithm, the RCF algorithm can determine whether real-time input contains an anomaly by inserting the input into the constructed tree network. Various RCF algorithms, including Robust RCF (RRCF), have been developed, where the cutting procedure is adaptively chosen probabilistically. The RRCF algorithm demonstrates better performance than the IF algorithm, as dimension cuts are decided based on the geometric range of the data, whereas the IF algorithm randomly chooses dimension cuts. However, the overall data structure is not considered in both IF and RRCF, given that split values are chosen randomly. In this paper, we propose new IF and RCF algorithms, referred to as the weighted IF (WIF) and weighted RCF (WRCF) algorithms, respectively. Their split values are determined by considering the density of the given data. To introduce the WIF and WRCF, we first present a new geometric measure, a density measure, which is crucial for constructing the WIF and WRCF. We provide various mathematical properties of the density measure, accompanied by theorems that support and validate our claims through numerical examples.

Weighted Isolation and Random Cut Forest Algorithms for Anomaly Detection

TL;DR

This work tackles anomaly detection by addressing a key shortcoming of Isolation Forests and Robust Random Cut Forests: split decisions largely ignore the data’s density and shape. It introduces a density measure μ and density-aware partitioning, enabling weighted variants: Weighted Isolation Forest (WIF) and Weighted Random Cut Forest (WRCF). Theoretical results establish invariances and termination guarantees for the density-aware scheme, while experiments show that WIF/WRCF converge faster and improve detection, especially in dense regions and time-series contexts. The approach yields practical benefits for real-time anomaly detection in both time-series and Euclidean data, with robust performance on benchmark datasets.

Abstract

Random cut forest (RCF) algorithms have been developed for anomaly detection, particularly in time series data. The RCF algorithm is an improved version of the isolation forest (IF) algorithm. Unlike the IF algorithm, the RCF algorithm can determine whether real-time input contains an anomaly by inserting the input into the constructed tree network. Various RCF algorithms, including Robust RCF (RRCF), have been developed, where the cutting procedure is adaptively chosen probabilistically. The RRCF algorithm demonstrates better performance than the IF algorithm, as dimension cuts are decided based on the geometric range of the data, whereas the IF algorithm randomly chooses dimension cuts. However, the overall data structure is not considered in both IF and RRCF, given that split values are chosen randomly. In this paper, we propose new IF and RCF algorithms, referred to as the weighted IF (WIF) and weighted RCF (WRCF) algorithms, respectively. Their split values are determined by considering the density of the given data. To introduce the WIF and WRCF, we first present a new geometric measure, a density measure, which is crucial for constructing the WIF and WRCF. We provide various mathematical properties of the density measure, accompanied by theorems that support and validate our claims through numerical examples.
Paper Structure (34 sections, 9 theorems, 98 equations, 25 figures, 7 tables, 2 algorithms)

This paper contains 34 sections, 9 theorems, 98 equations, 25 figures, 7 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Isolation Forest
  3. Binary Trees
  4. Isolation Trees
  5. Anomaly Score
  6. Robust Random Cut Forest
  7. Robust Random Cut Trees
  8. Anomaly Score
  9. RRCF with Bagging
  10. RRCF for time series data
  11. Deleting a point from a tree
  12. Inserting a point to a tree
  13. Application to time series data
  14. Density Measure
  15. Motivation
  16. ...and 19 more sections

Key Result

Proposition 1

Let $T$ be an RRCT of $X$ and $D$ be a node in $T$ with $D \neq X$ and $T'$ be the tree obtained by deleting the subtree of $D$ in $T$. Then where $D_\text{s}$ is the sibling node of $D$.

Figures (25)

  • Figure 1: The graph of $T$
  • Figure 2: The graph of $T'$
  • Figure 3: The graph of $T$
  • Figure 4: The graph of $T'$
  • Figure 8: The desired graph of $T$ (Example \ref{['ex1']})
  • ...and 20 more figures

Theorems & Definitions (38)

  • Definition 1
  • Definition 2
  • Definition 3
  • Definition 4
  • Definition 5
  • Definition 6
  • Definition 7
  • Remark 1
  • Remark 2
  • Definition 8
  • ...and 28 more