Extended isolation forest algorithm based on random subspace

doi:10.11772/j.issn.1001-9081.2020091436

Abstract

Abstract: Aiming at the problem of excessive time overhead of the Extended Isolation Forest (EIF) algorithm, a new algorithm named Extended Isolation Forest based on Random Subspace (RS-EIF) was proposed. Firstly, multiple random subspaces were determined in the original data space. Then, in each random subspace, the extended isolated tree was constructed by calculating the intercept vector and slope of each node, and multiple extended isolated trees were integrated into a subspace extended isolation forest. Finally, the average traversal depth of data point in the extended isolation forest was calculated to determine whether the data point was abnormal. Experimental results on 9 real datasets in Outliter Detection DataSet (ODDS) and 7 synthetic datasets with multivariate distribution show that, the RS-EIF algorithm is sensitive to local anomalies and reduces the time overhead by about 60% compared with the EIF algorithm; on the ODDS datasets with many samples, its recognition accuracy is 2 percentage points to 12 percentage points higher than those of the isolation Forest (iForest) algorithm, Lightweight On-line Detection of Anomalies (LODA) algorithm and COPula-based Outlier Detection (COPOD) algorithm. The RS-EIF algorithm has the higher recognition efficiency in the dataset with a large number of samples.

Key words: anomaly detection, random subspace, Extended Isolation Forest (EIF) algorithm, extended isolated tree, average traversal depth

摘要： 针对扩展隔离林（EIF）算法时间开销过大的问题，提出了一种基于随机子空间的扩展隔离林（RS-EIF）算法。首先，在原数据空间确定多个随机子空间；然后，在不同的随机子空间中通过计算每个节点的截距向量与斜率来构建扩展孤立树，并将多棵扩展孤立树集成为子空间扩展隔离林；最后，通过计算数据点在扩展隔离林中的平均遍历深度来确定数据点是否异常。在离群值检测数据库（ODDS）中的9个真实数据集与呈多元分布的7个人工数据集上的实验结果表明，所提RS-EIF算法对局部异常很敏感，相较EIF算法减少了约60%的时间开销；在样本数量较多的ODDS数据集上，该算法识别精度高出孤立森林（iForest）算法、轻型在线异常检测（LODA）算法和基于连接函数的异常检测（COPOD）算法2~12个百分点。RS-EIF算法在样本数量大的数据集中识别效率更高。

关键词: 异常检测, 随机子空间, 扩展隔离林算法, 扩展孤立树, 平均遍历深度

CLC Number:

TP181

XIE Yu, JIANG Yu, LONG Chaoqi. Extended isolation forest algorithm based on random subspace[J]. Journal of Computer Applications, 2021, 41(6): 1679-1685.

谢雨, 蒋瑜, 龙超奇. 基于随机子空间的扩展隔离林算法[J]. 计算机应用, 2021, 41(6): 1679-1685.

References

[1] 陈斌, 陈松灿, 潘志松, 等. 异常检测综述[J]. 山东大学学报(工学版), 2009, 39(6):13-23.(CHEN B,CHEN S C,PAN Z S,et al. Survey of outlier detection technologies[J]. Journal of Shandong University (Engineering Science), 2009, 39(6):13-23.)
[2] CHANDOLA V,BANERJEE A,KUMAR V. Anomaly detection:a survey[J]. ACM Computing Surveys, 2009, 41(3):Article No. 15.
[3] WANG H,BAH M J,HAMMAD M. Progress in outlier detection techniques:a survey[J]. IEEE Access, 2019, 7:107964-108000.
[4] KRIEGEL H P,SCHUBERT M,ZIMEK A. Angle-based outlier detection in high-dimensional data[C]//Proceedings of the 2008 14th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York:ACM,2008:444-452.
[5] LI Z,ZHAO Y,BOTTA N,et al. COPOD:copula-based outlier detection[C]//Proceedings of the2020 IEEE International Conference on Data Mining. Piscataway:IEEE,2020:1118-1123.
[6] RAMASWAMY S,RASTOGI R,SHIM K. Efficient algorithms for mining outliers from large data sets[J]. ACM SIGMOD Record, 2000,29(2):427-438.
[7] BREUNIG M M,KRIEGEL H P,NG R T,et al. LOF:identifying density-based local outliers[C]//Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data. New York:ACM,2000:93-104.
[8] CHEN J,SATHE S,AGGARWAL C,et al. Outlier detection with autoencoder ensembles[C]//Proceedings of the 2017 SIAM International Conference on Data Mining. Philadelphia:SIAM, 2017:90-98.
[9] LAZAREVIC A,KUMAR V. Feature bagging for outlier detection[C]//Proceedings of the 2005 11th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York:ACM,2005:157-166.
[10] RAYANA S, AKOGLU L. Less is more:building selective anomaly ensembles[J]. ACM Transactions on Knowledge Discovery from Data,2016,10(4):Article No. 42.
[11] LIU F T,TING K M,ZHOU Z. Isolation forest[C]//Proceedings of the 2008 8th IEEE International Conference on Data Mining. Piscataway:IEEE,2008:413-422.
[12] LIU F T,TING K M,ZHOU Z. Isolation-based anomaly detection[J]. ACM Transactions on Knowledge Discovery from Data, 2012,6(1):Article No. 3.
[13] 杨先圣, 姜磊, 彭雄, 等. 基于大数据的异常检测方法研究[J]. 计算机工程与科学, 2018, 40(7):1180-1186.(YANG X S, JIANG L,PENG X,et al. A new outlier detection method based on large data[J]. Computer Engineering and Science,2018,40(7):1180-1186.)
[14] BANDARAGODA T R, TING K M, ALBRECHT D, et al. Isolation-based anomaly detection using nearest-neighbor ensembles[J]. Computational Intelligence, 2018, 34(4):968-998.
[15] 杨晓晖, 张圣昌. 基于多粒度级联孤立森林算法的异常检测模型[J]. 通信学报, 2019, 40(8):133-142.(YANG X H,ZHANG S C. Anomaly detection model based on multi-grained cascade isolation forest algorithm[J]. Journal on Communications,2019, 40(8):133-142.)
[16] 王茹雪, 张丽翠, 刘姝岐. 基于瀑布型混合技术的异常检测算法[J]. 吉林大学学报(信息科学版), 2017, 35(5):544-550. (WANG R X, ZHANG L C, LIU S Q. Anomaly detection algorithm based on waterfall hybrid technology[J]. Journal of Jilin University (Information Science Edition), 2017, 35(5):544-550.)
[17] HARIRI S,KIND M C,BRUNNER R J. Extended isolation forest[EB/OL].[2020-09-01]. https://arxiv.org/pdf/1811.02141.pdf.
[18] 于玲, 吴铁军. 集成学习:Boosting算法综述[J]. 模式识别与人工智能,2004,17(1):52-59. (YU L,WU T J. Assemble learning:a survey of Boosting algorithms[J]. Pattern Recognition and Artificial Intelligence,2004,17(1):52-59.)
[19] 李建中, 刘显敏. 大数据的一个重要方面:数据可用性[J]. 计算机研究与发展, 2013, 50(6):1147-1162.(LI J Z,LIU X M. An important aspect of big data:data usability[J]. Journal of Computer Research and Development, 2013, 50(6):1147-1162.)
[20] HARMAN R, LACKO V. On decompositional algorithms for uniform sampling from n-spheres and n-balls[J]. Journal of Multivariate Analysis,2011,101(10):2297-2304.
[21] 李倩, 韩斌, 汪旭祥. 基于模糊孤立森林算法的多维数据异常检测方法[J]. 计算机与数字工程, 2020, 48(4):862-866.(LI Q, HAN B,WANG X X. Multidimensional data anomaly detection method based on fuzzy isolated forest algorithm[J]. Computer and Digital Engineering,2020,48(4):862-866.)
[22] RAYANA S. ODDS library[DS/OL].[2020-09-01]. http://odds.cs.stonybrook.edu.
[23] PEVNÝ T. Loda:lightweight on-line detector of anomalies[J]. Machine Learning,2016,102(2):275-304.
[24] ZHAO Y,NASRULLAH Z,LI Z. PyOD:a Python toolbox for scalable outlier detection[J]. Journal of Machine Learning Research,2019,20:1-7.