Isolation-based Spherical Ensemble Representations for Anomaly Detection

TL;DR

ISER tackles unsupervised anomaly detection by encoding local density through hypersphere radii across an ensemble of random partitions, achieving linear time $O(n)$ and constant space. It introduces two scoring schemes—average-based $S_{avg}$ and similarity-based $S_{sim}$—to exploit the density-aware ensemble representations, and extends the approach to ISER-IF, which improves Isolation Forest performance in a transformed space. Empirical results on 22 real-world datasets and synthetic scenarios show ISER and ISER-IF consistently outperform 11 baselines on both AUC-ROC and AUC-PR, with compact decision boundaries and scalable runtime. The framework provides a practical, efficient solution for detecting global, local, and dependency anomalies in contaminated data, with open-source code to support reproducibility and extension to streaming settings.

Abstract

Anomaly detection is a critical task in data mining and management with applications spanning fraud detection, network security, and log monitoring. Despite extensive research, existing unsupervised anomaly detection methods still face fundamental challenges including conflicting distributional assumptions, computational inefficiency, and difficulty handling different anomaly types. To address these problems, we propose ISER (Isolation-based Spherical Ensemble Representations) that extends existing isolation-based methods by using hypersphere radii as proxies for local density characteristics while maintaining linear time and constant space complexity. ISER constructs ensemble representations where hypersphere radii encode density information: smaller radii indicate dense regions while larger radii correspond to sparse areas. We introduce a novel similarity-based scoring method that measures pattern consistency by comparing ensemble representations against a theoretical anomaly reference pattern. Additionally, we enhance the performance of Isolation Forest by using ISER and adapting the scoring function to address axis-parallel bias and local anomaly detection limitations. Comprehensive experiments on 22 real-world datasets demonstrate ISER's superior performance over 11 baseline methods.

Figures (7)

• Figure 1: Illustration of ISER ensemble representation construction process. For each partitioning $H_i$, a random subset of $\psi=3$ points is sampled (shown as red centers in the circular partitions and input data $d=2$ in this sample). Each sampled point serves as a hypersphere center with radius determined by the nearest neighbor distance within $Di$. For each point, $\phi_i$ values from all $t$ partitionings are concatenated to form the final ensemble representation $\Phi(x) \in \mathbb{R}^t$.
• Figure 2: Comparison of all methods performance in terms of AUC-ROC and AUC-PR.
• Figure 3: Friedman-Nemenyi test for anomaly detectors at significance level 0.01. If two algorithms are connected by a CD (critical difference) line, there is no significant difference between them.
• Figure 4: Runtime comparison. a) The size of dimensionality is 1. b) The sample size is 1000.
• Figure 5: Demonstration of iForest and ISER-IF on different datasets. Left is original data, middle is standard iForest and right is the proposed ISER-IF in each sub-figure.