Abstract: Aiming at the low performance of existing anomaly detection algorithms based on random forest, a random forest algorithm combining double features and relaxation boundary was proposed for anomaly detection. Firstly, in the process of constructing binary decision tree of random forest with normal class data only, the range of two features (each feature had a corresponding eigenvalue range) were recorded in each node of the binary decision tree, and the double-feature eigenvalue ranges were used as the basis for abnormal point judgment. Secondly, during the anomaly detection, if a sample did not satisfy the double-feature eigenvalue range in the decision tree node, the sample would be marked as a candidate exception class; otherwise, the sample would enter the lower nodes of the decision tree and continue the comparision with the corresponding double-feature eigenvalue range. The sample would be marked as candidate normal class if there were no lower nodes. Finally, the discriminative mechanism in random forest algorithm was used to distinguish the class of the samples. Experimented results on five UCI datasets show that the proposed method has better performance than the existing random forest algorithms for anomaly detection, and its comprehensive performance is equivalent to or better than isolation Forest (iForest) and One-Class SVM (OCSVM), and stable at a high level.

Key words: anomaly detection, Random Forest (RF), double-feature filtering, relaxation boundary

摘要： 针对现有基于随机森林的异常检测算法性能不高的问题，提出一种结合双特征和松弛边界的随机森林算法用于异常点检测。首先，在只使用正常类数据构建随机森林的分类决策树过程中，在二叉决策树的每个节点里记录两个特征的取值范围（每个特征对应一个值域），以此双特征值域作为异常点判断的依据。然后，在进行异常检测时，当某样本不满足决策树节点中的双特征值域时，该样本被标记为候选异常类；否则，该样本进入决策树的下层树节点继续作特征值域的比较，若无下层节点则被标记为候选正常类。最后，由随机森林算法中的判别机制决定该样本的类别。在5个UCI数据集上进行的异常点检测实验结果表明，所提方法比现有的异常检测随机森林算法性能更好，其综合性能与孤立森林（iForest）和一类支持向量机（OCSVM）方法相当或更好，且稳定于较高水平。

关键词: 异常点检测, 随机森林, 双特征过滤, 松弛边界