Isolation Forest-based semi-supervised Anomaly Detection of multiple classes
Caio Melquiades, Fernando Buarque de Lima Neto · 2022 17th Iberian Conference on Information Systems and Technologies (CISTI) · 2022
Defining rules for finding all the uncountable patterns of events of interest, in complex and critical applications, is infeasible, if not impossible. Anomaly Detection (AD) methods are techniques well-suited for tackling this category of problem, namely, finding previously unknown deviant data due to their ability for identifying behavior that significantly went astray from an expected pattern. Isolation Forest (IF) is a state-of-the-art technique in the unsupervised Anomaly Detection area, mainly because of efficacy and low computational cost. However, unsupervised Anomaly Detection many times suffers from high false-positive rate and high false-negative rate. Semi-supervised techniques, e.g. Hybrid Isolation Forest (HIF)l can significantly improve the unsupervised algorithms with low human effort, and can also aggregate semantic knowledge into the models. HIF, however, can only aggregate known anomalies in a single class. This paper proposes a Hybrid Isolation Forest-based model capable of aggregating known anomalies in many classes, without loss of performance. Our proposed multiple anomaly classes semi-supervised model showed better performance in some known datasets, as well as showed the ability to significantly improve the underlying unsupervised algorithm.