Distribution Forest: An Anomaly Detection Method Based on Isolation Forest

摘要

Anomaly detection refers to finding patterns in the data that do not meet expectations. Anomaly detection has a variety of application domains and scenarios, such as network intrusion detection, fraud detection and fault detection. This paper proposes a new anomaly detection method Distribution Forest (dForest) inspired by Isolation Forest (iForest). dForest builds an ensemble of special binary trees called distribution tree (dTree). The basic idea of our method is to guide the building of dTree by the distribution of data at each node. And each node of dTree is treated as a subspace of input space. When dForest is built, the anomalies have a shorter path length than the normal instances. dForest has a different explanation from other methods. Compared with iForest, LOF and iNNE, the proposed method achieves competitive results in terms of AUC on different benchmark datasets. Also, dForest performs well in both semi-supervised and unsupervised anomaly detection modes.