Class IsolationForest

java.lang.Object
smile.anomaly.IsolationForest
All Implemented Interfaces:
Serializable
public class IsolationForest extends Object implements Serializable
Isolation forest is an unsupervised learning algorithm for anomaly detection that works on the principle of isolating anomalies. The algorithm recursively generates partitions on the sample by randomly selecting an attribute and then randomly selecting a split value for the attribute, between the minimum and maximum values allowed for that attribute. The recursive partitioning can be represented by a tree structure named Isolation Tree. The number of partitions required to isolate a point can be interpreted as the length of the path, within the tree, to reach a terminating node starting from the root. When the forest of isolation trees collectively produces shorter path lengths for some samples, they are likely to be anomalies.

Rather than selecting a random feature and value within the range of data, Extended isolation forest slices the data using hyperplanes with random slopes. The consistency and reliability of the algorithm is much improved using this extension.

For an N dimensional dataset, we can consider N levels of extension. In the fully extended case, we select our normal vector by drawing each component from N (0, 1) as seen before. This results in hyperplanes that can intersect any of the coordinates axes. However, we can exclude some dimensions in specifying the lines so that they are parallel to the coordinate axes. This is simply accomplished by setting a coordinate of the normal vector to zero. The lowest level of extension of the Extended Isolation Forest is coincident with the standard Isolation Forest. As the extension level of the algorithm is increased, the bias of the algorithm is reduced. The idea of having multiple levels of extension can be useful in cases where the dynamic range of the data in various dimensions are very different. In such cases, reducing the extension level can help in more appropriate selection of split hyperplanes.

References

  1. Fei Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation Forest. ICDM, 413–422, 2008.
  2. Sahand Hariri, Matias Carrasco Kind, and Robert J. Brunner. Extended Isolation Forest. IEEE Transactions on Knowledge and Data Engineering, 2019.
See Also:

  • Constructor Details

    • IsolationForest

      public IsolationForest(int n, int p, int extensionLevel, IsolationTree... trees)
      Constructor.
      Parameters:
      n - the number of samples to train the forest.
      p - the dimensionality of input samples.
      extensionLevel - the extension level, i.e. how many dimension are specified in the random slope. 0 means standard Isolation Forest.
      trees - forest of isolation trees.

  • Method Details

    • fit

      public static IsolationForest fit(double[][] data)
      Fits an isolation forest.
      Parameters:
      data - the training data. When using default options, this fits standard Isolation Forest (extensionLevel = 0).
      Returns:
      the model.

    • fit

      public static IsolationForest fit(double[][] data, IsolationForest.Options options)
      Fits an isolation forest.
      Parameters:
      data - the training data.
      options - the hyperparameters. In particular, options.extensionLevel() controls extension level. 0 means standard Isolation Forest.
      Returns:
      the model.

    • size

      public int size()
      Returns the number of trees in the model.
      Returns:
      the number of trees in the model.

    • trees

      public IsolationTree[] trees()
      Returns the isolation trees in the model.
      Returns:
      the isolation trees in the model.

    • extensionLevel

      public int extensionLevel()
      Returns the extension level. 0 means standard Isolation Forest. Valid range is [0, p-1], where p is input dimensionality.
      Returns:
      the extension level.

    • score

      public double score(double[] x)
      Returns the anomaly score in the range (0, 1]. Scores closer to 1 indicate anomalies; scores around 0.5 are normal. Specifically, a score significantly above 0.5 (e.g., > 0.6) suggests an anomaly, while a score well below 0.5 suggests a normal instance.
      Parameters:
      x - the sample.
      Returns:
      the anomaly score in (0, 1].

    • score

      public double[] score(double[][] x)
      Returns the anomaly scores.
      Parameters:
      x - the samples.
      Returns:
      the anomaly scores in (0, 1].

    • predict

      public boolean predict(double[] x, double threshold)
      Predicts whether a sample is an anomaly using the given threshold.
      Parameters:
      x - the sample.
      threshold - the anomaly score threshold. A sample is considered an anomaly if its score exceeds this value. Typical values are in the range (0.5, 1.0).
      Returns:
      true if the sample is predicted as an anomaly.