Premium
Isolation‐based anomaly detection using nearest‐neighbor ensembles
Author(s) -
Bandaragoda Tharindu R.,
Ting Kai Ming,
Albrecht David,
Liu Fei Tony,
Zhu Ye,
Wells Jonathan R.
Publication year - 2018
Publication title -
computational intelligence
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.353
H-Index - 52
eISSN - 1467-8640
pISSN - 0824-7935
DOI - 10.1111/coin.12156
Subject(s) - anomaly detection , k nearest neighbors algorithm , anomaly (physics) , outlier , computer science , pattern recognition (psychology) , isolation (microbiology) , local outlier factor , artificial intelligence , data mining , algorithm , physics , condensed matter physics , microbiology and biotechnology , biology
The first successful isolation‐based anomaly detector, ie, iForest, uses trees as a means to perform isolation. Although it has been shown to have advantages over existing anomaly detectors, we have identified 4 weaknesses, ie, its inability to detect local anomalies, anomalies with a high percentage of irrelevant attributes, anomalies that are masked by axis‐parallel clusters, and anomalies in multimodal data sets. To overcome these weaknesses, this paper shows that an alternative isolation mechanism is required and thus presents iNNE or isolation using Nearest Neighbor Ensemble. Although relying on nearest neighbors, iNNE runs significantly faster than the existing nearest neighbor–based methods such as the local outlier factor, especially in data sets having thousands of dimensions or millions of instances. This is because the proposed method has linear time complexity and constant space complexity.