Improved Anomaly Detection by Using the Attention-Based Isolation Forest

Abstract

A new modification of the isolation forest called the attention-based isolation forest (ABIForest) is proposed for solving the anomaly detection problem. It incorporates an attention mechanism in the form of Nadaraya–Watson regression into the isolation forest to improve the solution of the anomaly detection problem. The main idea underlying the modification is the assignment of attention weights to each path of trees with learnable parameters depending on the instances and trees themselves. Huber’s contamination model is proposed to be used to define the attention weights and their parameters. As a result, the attention weights are linearly dependent on learnable attention parameters that are trained by solving a standard linear or quadratic optimization problem. ABIForest can be viewed as the first modification of the isolation forest to incorporate an attention mechanism in a simple way without applying gradient-based algorithms. Numerical experiments with synthetic and real datasets illustrate that the results of ABIForest outperform those of other methods. The code of the proposed algorithms has been made available.

Digital banking fortification: a real-time isolation forest architecture for detecting online transaction fraud

“…The IForest divides inspections into sets by choosing an attribute and arbitrarily choosing a split point among its highest and lowest possible values. The distance of a path connecting the initial node to the final node is equivalent to the number of splits required for the isolation of each trial [25,26].…”

End-to-End Real-time Architecture for Fraud Detection in Online Digital Transactions

“…Another limitation of these related studies is that most of them establish a profile of regular cases and then detect anything that does not fall within the usual profile as an abnormality; leading to misclassification, a high false positive rate, and also, they are not adept at handling real-time detection. In contrast with that, IForest segregates observations by picking a property and then erratically determining a splitting point between the selected property's maximum and minimum values [22]. The amount of splits required to isolate a trial equals the path length from the root node to the ending node [23]; by giving high fraud detection accuracy over large datasets, with the least false positive rates.…”