Online Isolation Forest

TL;DR

Online-iForest tackles streaming anomaly detection by maintaining an ensemble of online histograms (Online-iTrees) that incrementally learn from recent data and forget older points via a sliding window. An anomaly score is derived from leaf-depth statistics across trees and normalized by a data-driven factor, enabling fast, one-pass updates with theoretical average and worst-case complexity bounds that scale with window size and memory. Empirical results on stationary and non-stationary data show Online-iForest achieves substantially faster processing than competitive online methods while delivering competitive ROC AUC performance, making it well-suited for real-time applications like cybersecurity and fraud detection. The work also outlines clear directions for future work, including removing the sliding window and automating histogram-split parameters to further enhance online adaptability and efficiency.

Abstract

The anomaly detection literature is abundant with offline methods, which require repeated access to data in memory, and impose impractical assumptions when applied to a streaming context. Existing online anomaly detection methods also generally fail to address these constraints, resorting to periodic retraining to adapt to the online context. We propose Online-iForest, a novel method explicitly designed for streaming conditions that seamlessly tracks the data generating process as it evolves over time. Experimental validation on real-world datasets demonstrated that Online-iForest is on par with online alternatives and closely rivals state-of-the-art offline anomaly detection techniques that undergo periodic retraining. Notably, Online-iForest consistently outperforms all competitors in terms of efficiency, making it a promising solution in applications where fast identification of anomalies is of primary importance such as cybersecurity, fraud and fault detection.

Figures (11)

• Figure 1: Online-iForest dynamically adapts to the data distribution of the stream and improves the anomaly scores estimate over time.
• Figure 2: Online-iForest
• Figure 3: Split procedure of a leaf node $N = (h, \mathcal{R})$ in a tree $T$. (b) As soon as a node $N$ reaches the maximum bin height $\widehat{h}$, we randomly select a dimension $q$ and a split value $p$. (c) We randomly sample a set $\mathcal{X}$ of $\widehat{h}$ points from the support $\mathcal{R}$ and use them to initialize bins of newborn child nodes $N_l = (h_l, \mathcal{R}_l)$ and $N_r = (h_r, \mathcal{R}_r)$.
• Figure 4: Online-iTree -- learn point
• Figure 5: Following the forgetting procedure, support $\mathcal{R}$ of node $N$ is the minimal hyperrectangle that encloses supports $\mathcal{R}_l, \mathcal{R}_r$ of child nodes $N_l, N_r$.