Isolation-based anomaly detection using nearest-neighbor ensembles

Tharindu R. Bandaragoda, Kai Ming Ting, David Albrecht, Fei Tony Liu, Ye Zhu, Jonathan R. Wells

Research output: Contribution to journalArticleResearchpeer-review

18 Citations (Scopus)

Abstract

The first successful isolation-based anomaly detector, ie, iForest, uses trees as a means to perform isolation. Although it has been shown to have advantages over existing anomaly detectors, we have identified 4 weaknesses, ie, its inability to detect local anomalies, anomalies with a high percentage of irrelevant attributes, anomalies that are masked by axis-parallel clusters, and anomalies in multimodal data sets. To overcome these weaknesses, this paper shows that an alternative isolation mechanism is required and thus presents iNNE or isolation using Nearest Neighbor Ensemble. Although relying on nearest neighbors, iNNE runs significantly faster than the existing nearest neighbor-based methods such as the local outlier factor, especially in data sets having thousands of dimensions or millions of instances. This is because the proposed method has linear time complexity and constant space complexity.

Original languageEnglish
Pages (from-to)968-998
Number of pages31
JournalComputational Intelligence
Volume34
Issue number4
DOIs
Publication statusPublished - Nov 2018

Keywords

  • Anomaly detection
  • Ensemble learning
  • Isolation-based
  • Nearest neighbor
  • Outlier detection

Cite this