Isolation Forest Based Anomaly Detection Framework on Non-IID Data

Xiang, Haolong; Wang, Jiayu; Ramamohanarao, Kotagiri; Salčić, Zoran; Dou, Wanchun; Zhang, Xuyun

doi:10.1109/mis.2021.3057914

Cited by 9 publications

(3 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, we consider the problem of intrusion detection from both an accept/reject and open set recognition perspective using the NSL-KDD dataset [47]. This data represents a distinctly different one from either the OLETTER or multi-feature Fourier character based datasets given all of the features are either categorical, discrete or integer in nature, and we leverage (12) in the process of anomaly generation. For this data set, in addition to 'Normal' network traffic, we chose to include Probe, Denial of Service (DoS) and Remote-to-Local types of attacks with attack types tabulated in Table 4 in the training set.…”

Section: Categorical Datamentioning

confidence: 99%

“…Isolation forest is a tree ensemble based method that measures anomalies by the depth of decision before reaching a leaf node. The more shallow and the fewer the cuts needed to reach a leaf node, the more likely it is that the sample is an anomaly [12]. Although OC-SVMs, AEs and Isolation Forests use different distance measures to identify anomalies, they represent some of the most mature and commonly employed discriminative approaches to novelty detection [13].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Generative Approach to Open Set Recognition Using Distance-Based Probabilistic Anomaly Augmentation

2022

View full text Add to dashboard Cite

Machine learning (ML) algorithms that are used in decision support (DS) and autonomous systems commonly train on labeled categorical samples from a closed set. This, however, poses a problem for deployed DS and autonomous systems when they encounter an anomalous pattern that did not originate from the closed set distribution used for training. In this case, the ML algorithm that was trained only on closed set samples may erroneously identify an anomalous pattern as having originated from one of the categories in the closed set, sometimes with very high confidence. In this paper, we consider the problem of unknown pattern recognition from a generative perspective in which additional synthetic training samples that represent anomalies are added to the training data. These synthetic samples are generated to optimally balance the desire to place anomalies all along the boundary of the training set in feature space, while not adversely effecting core classification performance on the test set. We demonstrate the efficacy of distance-based probabilistic anomaly augmentation (DPAA) that is proposed in this paper for a diverse set of applications such as character recognition and intrusion detection, and compare its combined classification and identification performance to both recent open set and more traditional novelty detection approaches. INDEX TERMSMachine learning, outlier and novelty detection, open set recognition, anomalies, generative and discriminative architectures.

show abstract

Section: Categorical Datamentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

A Generative Approach to Open Set Recognition Using Distance-Based Probabilistic Anomaly Augmentation

2022

View full text Add to dashboard Cite

show abstract

“…In "Isolation forest based anomaly detection framework on non-IID data," 10 Xiang et al study the problem of extending a widely used outlier detector, called isolation forest (iForest), to handle data drawn from a nonmetric space. The authors combine the underlying mechanism of isolation forest and extend distance-based hashing techniques to tackle this problem.…”

mentioning

confidence: 99%