A Review of Tree-Based Approaches for Anomaly Detection

Barbariol, Tommaso; Chiara, Filippo Dalla; Marcato, Davide; Susto, Gian Antonio

doi:10.1007/978-3-030-83819-5_7

Cited by 10 publications

(2 citation statements)

References 79 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…With the rapid development of information technology, the scales of all kinds of data continue to expand. Time series anomaly detection has become a field of interest for many researchers and practitioners [1]. Anomaly detection has been applied in various domains, such as intrusion detection in cybersecurity, medical detection, economic analysis and fault diagnosis in industry [2].…”

Section: Introductionmentioning

confidence: 99%

Hybrid Anomaly Detection via Multihead Dynamic Graph Attention Networks for Multivariate Time Series

2022

View full text Add to dashboard Cite

In the real world, a large number of multivariate time series data are generated by Internet of Things systems, which are composed of many connected sensing devices. Therefore, it is impractical to consider only a single univariate time series for decision-making. High-dimensional time series decrease the performance of traditional anomaly detection methods. Moreover, many previously developed methods capture temporal correlations instead of spatial correlations. Therefore, it is necessary to learn the temporal and spatial correlations between different time series and timestamps. In this paper, to achieve improved anomaly detection performance for multivariate time series, we propose a novel architecture based on a graph attention network (GAT) with multihead dynamic attention (MDA). This framework simultaneously learns the dependencies between sensors in both the temporal and spatial dimensions. To tackle the overfitting problem in autoencoder (AE)-based methods, we propose a hybrid approach that combines a novel generative adversarial network (GAN) architecture as a reconstruction model with a multilayer perceptron (MLP) as a prediction-based model to detect anomalies together. The detection framework proposed in this paper is called the HAD-multihead dynamic GAT (MDGAT). Extensive experiments on different public benchmarks demonstrate the superior performance of HAD-MDGAT over state-of-the-art methods.INDEX TERMS Multivariate time series, graph attention network, anomaly detection, deep generative model, gated recurrent unit.

show abstract

Section: Introductionmentioning

confidence: 99%

Hybrid Anomaly Detection via Multihead Dynamic Graph Attention Networks for Multivariate Time Series

2022

View full text Add to dashboard Cite

show abstract

“…One can see there are many different solutions improving the underlying IF algorithm. An interested reader can find a comprehensive survey by Barbariol et al [44]. Nevertheless, it is important to highlight the different types of fusion of IF-based algorithms and other approaches that are commonly applied [45]- [48].…”

Section: Introductionmentioning

confidence: 99%

Isolation Forest Based on Minimal Spanning Tree

2022

View full text Add to dashboard Cite

Detecting anomalies in data sets has been one of the most studied issues in modern data analysis. Therefore, there is a plethora of applications in a very wide range of fields of science and technology. One of the most frequently used anomaly detection methods is Isolation Forest. In this study, we propose a novel efficient approach based on this technique. In order to improve the classification accuracy of the base method, we make two-fold modifications. First, we propose a change of the technique of building isolation trees to merge nodes by minimal spanning tree algorithm. The second change is based on a modification of the function assessing the anomaly of the analyzed element (data record) to sum of factors correlated with tree height and nearest point distance. In the series of comprehensive computational experiments, the proposed method has proven to produce better results than other compared state-of-the-art methods available in popular data mining programming libraries. It is worth stressing that the final version of the new method in comparison to original Isolation Forest is 2.9% better in terms of AUC measure.

show abstract